Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
AccountChanger.exe

Overview

General Information

Sample name:AccountChanger.exe
Analysis ID:1431268
MD5:874d9918ac068743ff1d236347ffa120
SHA1:589821e6b92f03e1954ba9d13654e246627ebd73
SHA256:4e0e9d2d6101cb27fc1f17a2bba9bbf545f2bb25d8e7d8438662989a62ffbc19
Tags:exeStealer
Infos:

Detection

Score:28
Range:0 - 100
Whitelisted:false
Confidence:20%

Signatures

Found pyInstaller with non standard icon
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox
Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior
Sample searches for specific file, try point organization specific fake files to the analysis machine
  • System is w10x64
  • AccountChanger.exe (PID: 7620 cmdline: "C:\Users\user\Desktop\AccountChanger.exe" MD5: 874D9918AC068743FF1D236347FFA120)
    • AccountChanger.exe (PID: 7756 cmdline: "C:\Users\user\Desktop\AccountChanger.exe" MD5: 874D9918AC068743FF1D236347FFA120)
      • cmd.exe (PID: 7776 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results
Source: AccountChanger.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3076587122.00007FFDFB65C000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078492048.00007FFE0EB5B000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: AccountChanger.exe, 00000003.00000002.3077795068.00007FFE00536000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: AccountChanger.exe, 00000003.00000002.3076218985.00007FFDFB2CF000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078942098.00007FFE120C5000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078624251.00007FFE101D8000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3079625631.00007FFE130C3000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: AccountChanger.exe, 00000000.00000003.1822394310.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3080243031.00007FFE14641000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: AccountChanger.exe, 00000003.00000002.3080001626.00007FFE13390000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078374538.00007FFE0EB26000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078737105.00007FFE10307000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: AccountChanger.exe, 00000003.00000002.3077795068.00007FFE00536000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: AccountChanger.exe, 00000003.00000002.3076969726.00007FFDFB9B0000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: AccountChanger.exe, 00000003.00000002.3078262639.00007FFE0E172000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3079435463.00007FFE12E13000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078492048.00007FFE0EB5B000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3079278608.00007FFE126ED000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3079049149.00007FFE126C8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3070353496.000001ADD2F20000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1s 1 Nov 2022built on: Mon Jan 9 20:35:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: AccountChanger.exe, 00000003.00000002.3076218985.00007FFDFB2CF000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: AccountChanger.exe, 00000003.00000002.3076218985.00007FFDFB351000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: AccountChanger.exe, 00000003.00000002.3078096610.00007FFE0CFCD000.00000002.00000001.01000000.0000000F.sdmp
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10609B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7E10609B4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1056714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1047820 FindFirstFileExW,FindClose,0_2_00007FF7E1047820
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1056714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10609B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_00007FF7E10609B4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1056714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,3_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1047820 FindFirstFileExW,FindClose,3_2_00007FF7E1047820
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1056714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,3_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB083229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,3_2_00007FFDFB083229
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application DataJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application DataJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\LocalJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\Local\Application Data\Application DataJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\Local\Application DataJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppDataJump to behavior
Source: AccountChanger.exe, 00000003.00000002.3074581227.000001ADD58C4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: AccountChanger.exe, 00000003.00000002.3072715015.000001ADD4840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27
Source: AccountChanger.exe, 00000003.00000003.1928747456.000001ADD4A94000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3074292629.000001ADD5480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue23606)
Source: AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B60A4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B60A4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923556809.000001ADD36AB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3070795017.000001ADD3640000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD4235000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1922405188.000001ADD36AA000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1922405188.000001ADD367A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: AccountChanger.exe, 00000003.00000002.3070795017.000001ADD3640000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1922015625.000001ADD3F41000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1922015625.000001ADD3F80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.dig
Source: AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/D
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B60A4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _ctypes.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digk
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B60A4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AccountChanger.exe, 00000003.00000002.3074581227.000001ADD58A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: AccountChanger.exe, 00000003.00000002.3074094032.000001ADD5240000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: AccountChanger.exe, 00000003.00000002.3074094032.000001ADD5240000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: AccountChanger.exe, 00000003.00000002.3072715015.000001ADD4840000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: AccountChanger.exe, 00000003.00000002.3072364442.000001ADD4440000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
Source: AccountChanger.exe, 00000003.00000002.3071727863.000001ADD3E40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
Source: AccountChanger.exe, 00000003.00000002.3072932570.000001ADD4A9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: AccountChanger.exe, 00000003.00000002.3070795017.000001ADD36DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071175342.000001ADD3A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B60A4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B60A4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0A
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
Source: AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.0.dr, _ctypes.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0X
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
Source: AccountChanger.exe, 00000003.00000002.3071052437.000001ADD3940000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/19622133/
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tip.tcl.tk/48)
Source: AccountChanger.exe, 00000003.00000002.3074376097.000001ADD5590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: AccountChanger.exe, 00000000.00000003.1856215562.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: AccountChanger.exe, 00000000.00000003.1856020425.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0RobotoMedium
Source: AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1828266038.000002D5B60A4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1831002272.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: __init__.py10.0.dr, _dummy.py.0.dr, _base.py.0.drString found in binary or memory: http://www.gnu.org/licenses/
Source: AccountChanger.exe, 00000000.00000003.1841215913.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.graficaobscura.com/interp/index.html
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: AccountChanger.exe, 00000000.00000003.1861515037.000002D5B609E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1861799573.000002D5B609E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1928104208.000001ADD4AC4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3072932570.000001ADD4A9C000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1928627813.000001ADD4AC4000.00000004.00000020.00020000.00000000.sdmp, ctk_font.cpython-310.pyc.0.dr, ctk_font.py.0.drString found in binary or memory: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html
Source: AccountChanger.exe, 00000000.00000003.1861163480.000002D5B609B000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1928747456.000001ADD4A94000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmp, ctk_textbox.py.0.drString found in binary or memory: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html
Source: AccountChanger.exe, 00000003.00000002.3074186345.000001ADD5370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/botz
Source: AccountChanger.exe, 00000000.00000003.1844940821.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://archive.org/details/gg243631
Source: AccountChanger.exe, 00000000.00000003.1838002370.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.ghostscript.com/show_bug.cgi?id=698272)
Source: AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
Source: AccountChanger.exe, 00000000.00000003.1840449610.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki
Source: AccountChanger.exe, 00000000.00000003.1839251843.000002D5B609D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1837880982.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1836678512.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/
Source: METADATA.0.drString found in binary or memory: https://cryptography.io
Source: METADATA.0.drString found in binary or memory: https://cryptography.io/
Source: METADATA.0.drString found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: METADATA.0.drString found in binary or memory: https://cryptography.io/en/latest/installation/
Source: METADATA.0.drString found in binary or memory: https://cryptography.io/en/latest/security/
Source: AccountChanger.exe, 00000003.00000003.1924245611.000001ADD4000000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: AccountChanger.exe, 00000003.00000003.1924245611.000001ADD4000000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
Source: AccountChanger.exe, 00000003.00000002.3072364442.000001ADD4440000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923899330.000001ADD3FB2000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923899330.000001ADD4009000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: AccountChanger.exe, 00000000.00000003.1840917199.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drafts.csswg.org/css-color-4/
Source: AccountChanger.exe, 00000000.00000003.1844385195.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://exiv2.org/tags.html)
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539#
Source: AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: AccountChanger.exe, 00000000.00000003.1839414250.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GNOME/gimp/blob/mainline/devel-docs/gbr.txt
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: __init__.py8.0.drString found in binary or memory: https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exe
Source: AccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: AccountChanger.exe, 00000003.00000002.3072540717.000001ADD4640000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1922405188.000001ADD367A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: AccountChanger.exe, 00000000.00000003.1844272308.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/matthewwithanm/django-imagekit/issues/50
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography/
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography/issues
Source: METADATA.0.drString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
Source: AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packagingSP
Source: AccountChanger.exe, 00000003.00000002.3072364442.000001ADD4440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: AccountChanger.exe, 00000003.00000002.3071052437.000001ADD3940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: AccountChanger.exe, 00000003.00000002.3074094032.000001ADD5240000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/
Source: AccountChanger.exe, 00000000.00000003.1836904744.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/issues/1293
Source: AccountChanger.exe, 00000000.00000003.1842906781.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/issues/1370
Source: AccountChanger.exe, 00000000.00000003.1846998844.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/issues/279
Source: AccountChanger.exe, 00000000.00000003.1844149816.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1844149816.000002D5B60A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/issues/4343
Source: AccountChanger.exe, 00000000.00000003.1841543248.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/pull/4910#discussion_r486682929
Source: AccountChanger.exe, 00000003.00000002.3070509337.000001ADD3300000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: AccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: AccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: AccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3070795017.000001ADD3640000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: AccountChanger.exe, 00000003.00000002.3070795017.000001ADD3640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: AccountChanger.exe, 00000003.00000002.3074292629.000001ADD5480000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4BC3000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071175342.000001ADD3A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: METADATA.0.drString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: AccountChanger.exe, 00000003.00000003.1927839049.000001ADD4235000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: AccountChanger.exe, 00000000.00000003.1912245200.000002D5B60D1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4BC3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://linuxreviews.org/HOWTO_change_the_mouse_speed_in_X
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: METADATA.0.drString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: AccountChanger.exe, 00000003.00000002.3070944731.000001ADD3840000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: METADATA.0.drString found in binary or memory: https://pypi.org/project/cryptography/
Source: AccountChanger.exe, 00000003.00000002.3076969726.00007FFDFB9B0000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: METADATA.0.drString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3074767094.000001ADD5948000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: AccountChanger.exe, 00000000.00000003.1841543248.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://savannah.nongnu.org/bugs/?56186
Source: AccountChanger.exe, 00000003.00000003.1921541584.000001ADD3B18000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1921631662.000001ADD3B1F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1921698137.000001ADD3AFF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1921631662.000001ADD3B70000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071175342.000001ADD3A40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1921474228.000001ADD3B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: AccountChanger.exe, 00000003.00000002.3072540717.000001ADD4640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
Source: AccountChanger.exe, 00000003.00000002.3074292629.000001ADD5480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309#30631309
Source: AccountChanger.exe, 00000003.00000003.1928104208.000001ADD4AC4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1928627813.000001ADD4AC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/3063yB
Source: AccountChanger.exe, 00000003.00000002.3074767094.000001ADD59B8000.00000004.00001000.00020000.00000000.sdmp, ctk_tk.cpython-310.pyc.0.dr, ctk_tk.py.0.drString found in binary or memory: https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666#70724666
Source: AccountChanger.exe, 00000003.00000003.1924245611.000001ADD4000000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923899330.000001ADD3FB2000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923899330.000001ADD4009000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: AccountChanger.exe, 00000003.00000002.3073522975.000001ADD4CE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.apple.com/en-us/HT200s
Source: tk.tcl.0.drString found in binary or memory: https://support.apple.com/en-us/HT201236
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3070795017.000001ADD3640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/
Source: AccountChanger.exe, 00000003.00000002.3074292629.000001ADD5480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: AccountChanger.exe, 00000003.00000002.3074376097.000001ADD55CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: AccountChanger.exe, 00000000.00000003.1844385195.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: AccountChanger.exe, 00000000.00000003.1837880982.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu
Source: AccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: LICENSE.APACHE.0.drString found in binary or memory: https://www.apache.org/licenses/
Source: LICENSE.APACHE.0.drString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: AccountChanger.exe, 00000000.00000003.1842451666.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1849510446.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cazabon.com
Source: AccountChanger.exe, 00000000.00000003.1849510446.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cazabon.com/pyCMS
Source: AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1833330040.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: AccountChanger.exe, 00000000.00000003.1844940821.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.fileformat.info/format/mspaint/egff.htm
Source: AccountChanger.exe, 00000000.00000003.1849510446.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.littlecms.com
Source: AccountChanger.exe, 00000000.00000003.1839765661.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.matthewflickinger.com/lab/whatsinagif/bits_and_bytes.asp
Source: AccountChanger.exe, 00000000.00000003.1841405207.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdf
Source: AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3077877317.00007FFE0056B000.00000002.00000001.01000000.00000011.sdmp, AccountChanger.exe, 00000003.00000002.3076461310.00007FFDFB3C6000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: https://www.openssl.org/H
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: AccountChanger.exe, 00000000.00000003.1854692859.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071052437.000001ADD3940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: AccountChanger.exe, 00000003.00000002.3070509337.000001ADD3300000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1064E200_2_00007FF7E1064E20
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1065D6C0_2_00007FF7E1065D6C
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10467800_2_00007FF7E1046780
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10609B40_2_00007FF7E10609B4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10509A00_2_00007FF7E10509A0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10631CC0_2_00007FF7E10631CC
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10511C00_2_00007FF7E10511C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E105FA080_2_00007FF7E105FA08
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1068B680_2_00007FF7E1068B68
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1041B900_2_00007FF7E1041B90
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1050BA40_2_00007FF7E1050BA4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1058BA00_2_00007FF7E1058BA0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10513C40_2_00007FF7E10513C4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E105CC040_2_00007FF7E105CC04
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1052C040_2_00007FF7E1052C04
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1051E700_2_00007FF7E1051E70
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10567140_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1062D300_2_00007FF7E1062D30
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E105FA080_2_00007FF7E105FA08
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10565600_2_00007FF7E1056560
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1050DB00_2_00007FF7E1050DB0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10658200_2_00007FF7E1065820
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10567140_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E106509C0_2_00007FF7E106509C
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E105D0980_2_00007FF7E105D098
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10480A00_2_00007FF7E10480A0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E105D7180_2_00007FF7E105D718
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1054F500_2_00007FF7E1054F50
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1050FB40_2_00007FF7E1050FB4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1056F980_2_00007FF7E1056F98
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10528000_2_00007FF7E1052800
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1041B903_2_00007FF7E1041B90
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1065D6C3_2_00007FF7E1065D6C
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10609B43_2_00007FF7E10609B4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10509A03_2_00007FF7E10509A0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10631CC3_2_00007FF7E10631CC
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10511C03_2_00007FF7E10511C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E105FA083_2_00007FF7E105FA08
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1068B683_2_00007FF7E1068B68
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1050BA43_2_00007FF7E1050BA4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1058BA03_2_00007FF7E1058BA0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10513C43_2_00007FF7E10513C4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E105CC043_2_00007FF7E105CC04
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1052C043_2_00007FF7E1052C04
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1064E203_2_00007FF7E1064E20
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1051E703_2_00007FF7E1051E70
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10567143_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1062D303_2_00007FF7E1062D30
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E105FA083_2_00007FF7E105FA08
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10565603_2_00007FF7E1056560
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1050DB03_2_00007FF7E1050DB0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10658203_2_00007FF7E1065820
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10567143_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E106509C3_2_00007FF7E106509C
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E105D0983_2_00007FF7E105D098
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10480A03_2_00007FF7E10480A0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E105D7183_2_00007FF7E105D718
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1054F503_2_00007FF7E1054F50
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10467803_2_00007FF7E1046780
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1050FB43_2_00007FF7E1050FB4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1056F983_2_00007FF7E1056F98
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10528003_2_00007FF7E1052800
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF662703_2_00007FFDFAF66270
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEC4C273_2_00007FFDFAEC4C27
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF33D03_2_00007FFDFAEF33D0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAECC3C93_2_00007FFDFAECC3C9
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEB10FE3_2_00007FFDFAEB10FE
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEB37293_2_00007FFDFAEB3729
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB019E903_2_00007FFDFB019E90
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEFD8303_2_00007FFDFAEFD830
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEE67A03_2_00007FFDFAEE67A0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEE5F803_2_00007FFDFAEE5F80
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF1BDB03_2_00007FFDFAF1BDB0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFACDF03_2_00007FFDFAFACDF0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF225103_2_00007FFDFAF22510
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAED6B403_2_00007FFDFAED6B40
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF13303_2_00007FFDFAEF1330
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB00CB803_2_00007FFDFB00CB80
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEEF3103_2_00007FFDFAEEF310
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF063003_2_00007FFDFAF06300
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF07B003_2_00007FFDFAF07B00
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFC0BC03_2_00007FFDFAFC0BC0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEE2AE03_2_00007FFDFAEE2AE0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF06AD03_2_00007FFDFAF06AD0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF103F03_2_00007FFDFAF103F0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF042A03_2_00007FFDFAF042A0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEECAA03_2_00007FFDFAEECAA0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF002703_2_00007FFDFAF00270
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF402803_2_00007FFDFAF40280
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF014203_2_00007FFDFAF01420
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEC5C213_2_00007FFDFAEC5C21
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF88AA03_2_00007FFDFAF88AA0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFDC2B03_2_00007FFDFAFDC2B0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEDF4003_2_00007FFDFAEDF400
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF6B2C03_2_00007FFDFAF6B2C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF0A2C33_2_00007FFDFAF0A2C3
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEFF3F03_2_00007FFDFAEFF3F0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEE13F03_2_00007FFDFAEE13F0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEC2BD03_2_00007FFDFAEC2BD0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFDF2E03_2_00007FFDFAFDF2E0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFD6B203_2_00007FFDFAFD6B20
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEEFB603_2_00007FFDFAEEFB60
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFDBB503_2_00007FFDFAFDBB50
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF529803_2_00007FFDFAF52980
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF049203_2_00007FFDFAF04920
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFFB1D03_2_00007FFDFAFFB1D0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF099DA3_2_00007FFDFAF099DA
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEFA0D03_2_00007FFDFAEFA0D0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF30703_2_00007FFDFAEF3070
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF542503_2_00007FFDFAF54250
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEFFA503_2_00007FFDFAEFFA50
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFE70703_2_00007FFDFAFE7070
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFD18903_2_00007FFDFAFD1890
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF3A0C03_2_00007FFDFAF3A0C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF740C03_2_00007FFDFAF740C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF0A8CD3_2_00007FFDFAF0A8CD
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEDE9E03_2_00007FFDFAEDE9E0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAED11D03_2_00007FFDFAED11D0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF6D0F03_2_00007FFDFAF6D0F0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF419303_2_00007FFDFAF41930
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEED9803_2_00007FFDFAEED980
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEC89703_2_00007FFDFAEC8970
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF71603_2_00007FFDFAEF7160
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF75F603_2_00007FFDFAF75F60
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF4F403_2_00007FFDFAEF4F40
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEFCF303_2_00007FFDFAEFCF30
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFCF7903_2_00007FFDFAFCF790
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF0E7A03_2_00007FFDFAF0E7A0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF04F103_2_00007FFDFAF04F10
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF0B7B03_2_00007FFDFAF0B7B0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF10FD03_2_00007FFDFAF10FD0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFB37F03_2_00007FFDFAFB37F0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEFA6C03_2_00007FFDFAEFA6C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFCDFF03_2_00007FFDFAFCDFF0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF288203_2_00007FFDFAF28820
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEE76903_2_00007FFDFAEE7690
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF118503_2_00007FFDFAF11850
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEFB0503_2_00007FFDFAEFB050
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEC80203_2_00007FFDFAEC8020
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF010103_2_00007FFDFAF01010
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF027E03_2_00007FFDFAF027E0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF07FE03_2_00007FFDFAF07FE0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF27C03_2_00007FFDFAEF27C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFFD7003_2_00007FFDFAFFD700
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF007B03_2_00007FFDFAF007B0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFFBF303_2_00007FFDFAFFBF30
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF02F603_2_00007FFDFAF02F60
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAED4D403_2_00007FFDFAED4D40
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF065203_2_00007FFDFAF06520
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF80DA03_2_00007FFDFAF80DA0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF054F03_2_00007FFDFAF054F0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF74F03_2_00007FFDFAEF74F0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF185D03_2_00007FFDFAF185D0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEE8CB03_2_00007FFDFAEE8CB0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF0960E3_2_00007FFDFAF0960E
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF01C803_2_00007FFDFAF01C80
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF24803_2_00007FFDFAEF2480
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEBF4703_2_00007FFDFAEBF470
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF03C603_2_00007FFDFAF03C60
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEEB6503_2_00007FFDFAEEB650
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFF7C803_2_00007FFDFAFF7C80
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEE06003_2_00007FFDFAEE0600
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAFD5CF03_2_00007FFDFAFD5CF0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF0BD003_2_00007FFDFAF0BD00
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF32D103_2_00007FFDFAF32D10
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEDDDA03_2_00007FFDFAEDDDA0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEC9DA03_2_00007FFDFAEC9DA0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAEF1D903_2_00007FFDFAEF1D90
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF035803_2_00007FFDFAF03580
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF3ED403_2_00007FFDFAF3ED40
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAF3DD503_2_00007FFDFAF3DD50
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0830C13_2_00007FFDFB0830C1
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB237A703_2_00007FFDFB237A70
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB1B7AC03_2_00007FFDFB1B7AC0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB086A823_2_00007FFDFB086A82
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0841653_2_00007FFDFB084165
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB223A303_2_00007FFDFB223A30
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB083FDA3_2_00007FFDFB083FDA
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB08655A3_2_00007FFDFB08655A
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB084C373_2_00007FFDFB084C37
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0827663_2_00007FFDFB082766
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB09BF203_2_00007FFDFB09BF20
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB09BD603_2_00007FFDFB09BD60
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0832E73_2_00007FFDFB0832E7
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0822893_2_00007FFDFB082289
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB1AFE203_2_00007FFDFB1AFE20
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB083B933_2_00007FFDFB083B93
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0851693_2_00007FFDFB085169
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB085D853_2_00007FFDFB085D85
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB1B72F03_2_00007FFDFB1B72F0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB08114F3_2_00007FFDFB08114F
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB086CB73_2_00007FFDFB086CB7
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0AB1C03_2_00007FFDFB0AB1C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB09F2003_2_00007FFDFB09F200
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB09F0603_2_00007FFDFB09F060
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB086EEC3_2_00007FFDFB086EEC
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0829CD3_2_00007FFDFB0829CD
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0822E83_2_00007FFDFB0822E8
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0821B73_2_00007FFDFB0821B7
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB08609B3_2_00007FFDFB08609B
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB2BF6D03_2_00007FFDFB2BF6D0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB086F233_2_00007FFDFB086F23
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0EF7003_2_00007FFDFB0EF700
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB081EA13_2_00007FFDFB081EA1
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0870453_2_00007FFDFB087045
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0AB5503_2_00007FFDFB0AB550
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB162BC03_2_00007FFDFB162BC0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB085B0F3_2_00007FFDFB085B0F
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB081B223_2_00007FFDFB081B22
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB222AF03_2_00007FFDFB222AF0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB084D043_2_00007FFDFB084D04
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB085D9E3_2_00007FFDFB085D9E
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0860D73_2_00007FFDFB0860D7
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0823F13_2_00007FFDFB0823F1
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB1BAFF03_2_00007FFDFB1BAFF0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0846333_2_00007FFDFB084633
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB08213F3_2_00007FFDFB08213F
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB09EF003_2_00007FFDFB09EF00
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0872C03_2_00007FFDFB0872C0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB081A4B3_2_00007FFDFB081A4B
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0870773_2_00007FFDFB087077
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0834863_2_00007FFDFB083486
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0836933_2_00007FFDFB083693
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB1B61103_2_00007FFDFB1B6110
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB0857D13_2_00007FFDFB0857D1
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB085E203_2_00007FFDFB085E20
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB084E4E3_2_00007FFDFB084E4E
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB081CC13_2_00007FFDFB081CC1
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFB081EF1 appears 647 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFB0824B9 appears 50 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFB08483B appears 62 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFAFC2D10 appears 152 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFB084057 appears 380 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFAFA8BD0 appears 1209 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFB08300D appears 50 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFB082734 appears 268 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FF7E1042770 appears 82 times
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: String function: 00007FFDFAFBB210 appears 75 times
Source: AccountChanger.exe, 00000000.00000003.1829981189.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1823063229.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1824198431.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1822394310.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1829458078.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_tkinter.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000000.00000003.1832653141.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenametcl86.dllP vs AccountChanger.exe
Source: AccountChanger.exeBinary or memory string: OriginalFilename vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3077381954.00007FFDFBAB9000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython310.dll. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3070353496.000001ADD2F20000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3079704221.00007FFE130C6000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3078309089.00007FFE0E17D000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3080333917.00007FFE14647000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3078985292.00007FFE120CA000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3078781793.00007FFE1030E000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3079518328.00007FFE12E16000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3077877317.00007FFE0056B000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilenamelibsslH vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3078669144.00007FFE101DE000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilename_tkinter.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3077661911.00007FFDFF2E2000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilenametk86.dllP vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3078419310.00007FFE0EB2E000.00000002.00000001.01000000.00000018.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3080078492.00007FFE1339D000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3078556265.00007FFE0EB64000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3079098045.00007FFE126D2000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3078190455.00007FFE0CFE5000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3076772458.00007FFDFB661000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3079357033.00007FFE126F2000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenametcl86.dllP vs AccountChanger.exe
Source: AccountChanger.exe, 00000003.00000002.3076461310.00007FFDFB3C6000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs AccountChanger.exe
Source: classification engineClassification label: sus28.winEXE@6/1025@0/0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10474B0 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF7E10474B0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202Jump to behavior
Source: AccountChanger.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\AccountChanger.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile read: C:\Users\user\Desktop\AccountChanger.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\AccountChanger.exe "C:\Users\user\Desktop\AccountChanger.exe"
Source: C:\Users\user\Desktop\AccountChanger.exeProcess created: C:\Users\user\Desktop\AccountChanger.exe "C:\Users\user\Desktop\AccountChanger.exe"
Source: C:\Users\user\Desktop\AccountChanger.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AccountChanger.exeProcess created: C:\Users\user\Desktop\AccountChanger.exe "C:\Users\user\Desktop\AccountChanger.exe"Jump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: libffi-7.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: libcrypto-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: libssl-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: tcl86t.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: tk86t.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: AccountChanger.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: AccountChanger.exeStatic file information: File size 18565178 > 1048576
Source: AccountChanger.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AccountChanger.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AccountChanger.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AccountChanger.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AccountChanger.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AccountChanger.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: AccountChanger.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: AccountChanger.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: AccountChanger.exe, 00000000.00000003.1834078158.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3076587122.00007FFDFB65C000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078492048.00007FFE0EB5B000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: AccountChanger.exe, 00000003.00000002.3077795068.00007FFE00536000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: AccountChanger.exe, 00000003.00000002.3076218985.00007FFDFB2CF000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: AccountChanger.exe, 00000000.00000003.1823768215.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078942098.00007FFE120C5000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: AccountChanger.exe, 00000000.00000003.1824356702.000002D5B6099000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078624251.00007FFE101D8000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: AccountChanger.exe, 00000000.00000003.1823669813.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: AccountChanger.exe, 00000000.00000003.1832348896.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3079625631.00007FFE130C3000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: AccountChanger.exe, 00000000.00000003.1822394310.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3080243031.00007FFE14641000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: AccountChanger.exe, 00000003.00000002.3080001626.00007FFE13390000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: AccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078374538.00007FFE0EB26000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: AccountChanger.exe, 00000000.00000003.1822550575.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078737105.00007FFE10307000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: AccountChanger.exe, 00000003.00000002.3077795068.00007FFE00536000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python310.pdb source: AccountChanger.exe, 00000003.00000002.3076969726.00007FFDFB9B0000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: AccountChanger.exe, 00000003.00000002.3078262639.00007FFE0E172000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: AccountChanger.exe, 00000000.00000003.1823872243.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3079435463.00007FFE12E13000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: AccountChanger.exe, 00000000.00000003.1823530092.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3078492048.00007FFE0EB5B000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: AccountChanger.exe, 00000000.00000003.1822666199.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3079278608.00007FFE126ED000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: AccountChanger.exe, 00000000.00000003.1824023023.000002D5B6098000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3079049149.00007FFE126C8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: AccountChanger.exe, 00000000.00000003.1830327285.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3070353496.000001ADD2F20000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1s 1 Nov 2022built on: Mon Jan 9 20:35:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: AccountChanger.exe, 00000003.00000002.3076218985.00007FFDFB2CF000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: AccountChanger.exe, 00000003.00000002.3076218985.00007FFDFB351000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: AccountChanger.exe, 00000003.00000002.3078096610.00007FFE0CFCD000.00000002.00000001.01000000.0000000F.sdmp
Source: AccountChanger.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: AccountChanger.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: AccountChanger.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: AccountChanger.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: AccountChanger.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: AccountChanger.exeStatic PE information: section name: _RDATA
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: _imagingft.cp310-win_amd64.pyd.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10910CC push rbp; retn 0000h0_2_00007FF7E10910CD
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10910E4 push rcx; retn 0000h0_2_00007FF7E10910ED
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10910CC push rbp; retn 0000h3_2_00007FF7E10910CD
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10910E4 push rcx; retn 0000h3_2_00007FF7E10910ED
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAC64F44 push 6FFDC5CAh; ret 3_2_00007FFDFAC64F4A
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAC67679 push 6FFDC5D5h; iretd 3_2_00007FFDFAC6767F
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAC64A94 push 6FFDC5D5h; iretd 3_2_00007FFDFAC64A9A
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAC673CB push 60F5C5F1h; iretd 3_2_00007FFDFAC673D3
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAC64F90 push 6FFDC5C3h; iretd 3_2_00007FFDFAC64F96
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAC67929 push 6FFDC5CAh; ret 3_2_00007FFDFAC6792F
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAC645E6 push 60F5C5F1h; iretd 3_2_00007FFDFAC645EE
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFAC67975 push 6FFDC5C3h; iretd 3_2_00007FFDFAC6797B

Persistence and Installation Behavior

barindex
Source: C:\Users\user\Desktop\AccountChanger.exeProcess created: "C:\Users\user\Desktop\AccountChanger.exe"
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingmath.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_webp.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingft.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingmorph.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI76202\_cffi_backend.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10455D0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF7E10455D0
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingmath.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_webp.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingtk.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingft.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingmorph.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingcms.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imaging.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76202\_cffi_backend.cp310-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\AccountChanger.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-16117
Source: C:\Users\user\Desktop\AccountChanger.exeAPI coverage: 5.5 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10609B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7E10609B4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1056714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1047820 FindFirstFileExW,FindClose,0_2_00007FF7E1047820
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1056714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E10609B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_00007FF7E10609B4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1056714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,3_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1047820 FindFirstFileExW,FindClose,3_2_00007FF7E1047820
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1056714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,3_2_00007FF7E1056714
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB083229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,3_2_00007FFDFB083229
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB00BF30 GetModuleHandleW,GetProcAddress,GetVersionExW,GetSystemInfo,wsprintfA,memmove,3_2_00007FFDFB00BF30
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application DataJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application DataJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\LocalJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\Local\Application Data\Application DataJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppData\Local\Application DataJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeFile opened: C:\Documents and Settings\Default\AppDataJump to behavior
Source: AccountChanger.exe, 00000003.00000002.3073640696.000001ADD4D49000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\qO
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}E
Source: AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: AccountChanger.exe, 00000003.00000002.3070795017.000001ADD36DC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:roup3WO
Source: AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\@
Source: cacert.pem.0.drBinary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: AccountChanger.exe, 00000003.00000003.1921222928.000001ADD3A92000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071175342.000001ADD3A40000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWnot %SystemRoot%\system32\mswsock.dllnetwork address is in use.
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1059AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E1059AE4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10625A0 GetProcessHeap,0_2_00007FF7E10625A0
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1059AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E1059AE4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E104B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E104B69C
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E104AE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF7E104AE00
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E104B880 SetUnhandledExceptionFilter,0_2_00007FF7E104B880
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E1059AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF7E1059AE4
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E104B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF7E104B69C
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E104AE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FF7E104AE00
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FF7E104B880 SetUnhandledExceptionFilter,3_2_00007FF7E104B880
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB01AE20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FFDFB01AE20
Source: C:\Users\user\Desktop\AccountChanger.exeProcess created: C:\Users\user\Desktop\AccountChanger.exe "C:\Users\user\Desktop\AccountChanger.exe"Jump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E10689B0 cpuid 0_2_00007FF7E10689B0
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\assets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\assets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\assets\fonts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\assets\fonts\Roboto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\appearance_mode VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\appearance_mode\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\core_rendering\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\image\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\scaling VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\scaling VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\scaling\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\scaling VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\theme VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray\__pycache__ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray\_util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pystray VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl8\8.4 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\pyexpat.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202\cryptography-41.0.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI76202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeQueries volume information: C:\Users\user\Desktop\AccountChanger.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E104B580 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7E104B580
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB00BE40 GetUserNameW,3_2_00007FFDFB00BE40
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 0_2_00007FF7E1064E20 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF7E1064E20
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB00BF30 GetModuleHandleW,GetProcAddress,GetVersionExW,GetSystemInfo,wsprintfA,memmove,3_2_00007FFDFB00BF30
Source: C:\Users\user\Desktop\AccountChanger.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\Desktop\AccountChanger.exeCode function: 3_2_00007FFDFB082B5D bind,WSAGetLastError,3_2_00007FFDFB082B5D
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API
1
DLL Side-Loading
11
Process Injection
11
Process Injection
OS Credential Dumping2
System Time Discovery
Remote Services1
Archive Collected Data
1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading
1
Deobfuscate/Decode Files or Information
LSASS Memory21
Security Software Discovery
Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)2
Obfuscated Files or Information
Security Account Manager1
Account Discovery
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading
NTDS1
System Owner/User Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets3
File and Directory Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials25
System Information Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431268 Sample: AccountChanger.exe Startdate: 24/04/2024 Architecture: WINDOWS Score: 28 7 AccountChanger.exe 1001 2->7         started        file3 17 C:\Users\user\AppData\Local\...\__init__.py, Python 7->17 dropped 19 C:\Users\user\AppData\Local\Temp\...\_gtk.py, Python 7->19 dropped 21 C:\Users\user\AppData\Local\...\_dummy.py, Python 7->21 dropped 23 69 other files (none is malicious) 7->23 dropped 25 Found pyInstaller with non standard icon 7->25 11 AccountChanger.exe 1 7->11         started        signatures4 process5 process6 13 cmd.exe 1 11->13         started        process7 15 conhost.exe 13->15         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
AccountChanger.exe3%ReversingLabs
SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\PngImagePlugin.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\PpmImagePlugin.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\PsdImagePlugin.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\PyAccess.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\QoiImagePlugin.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_binary.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_deprecate.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imaging.cp310-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingcms.cp310-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingft.cp310-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingmath.cp310-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingmorph.cp310-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_imagingtk.cp310-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_tkinter_finder.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_util.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\_webp.cp310-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\PIL\features.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\_asyncio.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\_cffi_backend.cp310-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\ctk_input_dialog.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\ctk_tk.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\ctk_toplevel.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\appearance_mode\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\appearance_mode\appearance_mode_base_class.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\appearance_mode\appearance_mode_tracker.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\core_rendering\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\core_rendering\ctk_canvas.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\core_rendering\draw_engine.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\core_widget_classes\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\core_widget_classes\ctk_base_class.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\core_widget_classes\dropdown_menu.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_button.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_checkbox.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_combobox.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_entry.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_frame.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_label.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_optionmenu.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_progressbar.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_radiobutton.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_scrollable_frame.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_scrollbar.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_segmented_button.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_slider.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_switch.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_tabview.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\ctk_textbox.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\font\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\font\ctk_font.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\font\font_manager.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\image\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\image\ctk_image.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\scaling\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\scaling\scaling_base_class.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\scaling\scaling_tracker.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\theme\__init__.py0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76202\customtkinter\windows\widgets\theme\theme_manager.py0%ReversingLabs
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
http://cacerts.digicert.co0%URL Reputationsafe
https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
http://.../back.jpeg0%Avira URL Cloudsafe
https://www.matthewflickinger.com/lab/whatsinagif/bits_and_bytes.asp0%Avira URL Cloudsafe
https://exiv2.org/tags.html)0%Avira URL Cloudsafe
https://www.littlecms.com0%Avira URL Cloudsafe
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html0%Avira URL Cloudsafe
https://foss.heptapod.net/pypy/pypy/-/issues/3539#0%Avira URL Cloudsafe
https://linuxreviews.org/HOWTO_change_the_mouse_speed_in_X0%Avira URL Cloudsafe
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html0%Avira URL Cloudsafe
https://www.cazabon.com0%Avira URL Cloudsafe
http://crl3.digk0%Avira URL Cloudsafe
http://www.graficaobscura.com/interp/index.html0%Avira URL Cloudsafe
NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalse
    unknown
    fp2e7a.wpc.phicdn.net
    192.229.211.108
    truefalse
      unknown
      NameSourceMaliciousAntivirus DetectionReputation
      https://github.com/python-pillow/Pillow/pull/4910#discussion_r486682929AccountChanger.exe, 00000000.00000003.1841543248.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
        high
        https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.htmlAccountChanger.exe, 00000000.00000003.1861163480.000002D5B609B000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1928747456.000001ADD4A94000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmp, ctk_textbox.py.0.drfalse
        • Avira URL Cloud: safe
        unknown
        https://api.telegram.org/botAccountChanger.exe, 00000003.00000002.3074186345.000001ADD5370000.00000004.00001000.00020000.00000000.sdmpfalse
          high
          https://api.telegram.org/botzAccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmpfalse
            high
            http://aka.ms/vcpython27AccountChanger.exe, 00000003.00000002.3072715015.000001ADD4840000.00000004.00001000.00020000.00000000.sdmpfalse
              high
              https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textuAccountChanger.exe, 00000000.00000003.1837880982.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                high
                http://docs.python.org/library/unittest.htmlAccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpfalse
                  high
                  https://python.org/dev/peps/pep-0263/AccountChanger.exe, 00000003.00000002.3076969726.00007FFDFB9B0000.00000002.00000001.01000000.00000004.sdmpfalse
                    high
                    https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/3063yBAccountChanger.exe, 00000003.00000003.1928104208.000001ADD4AC4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1928627813.000001ADD4AC4000.00000004.00000020.00020000.00000000.sdmpfalse
                      high
                      https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#AccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpfalse
                        high
                        https://github.com/pyca/cryptography/actions?query=workflow%3ACIMETADATA.0.drfalse
                          high
                          https://tools.ietf.org/html/rfc2388#section-4.4AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpfalse
                            high
                            https://www.apache.org/licenses/LICENSE-2.0LICENSE.APACHE.0.drfalse
                              high
                              https://github.com/pypa/packagingAccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmpfalse
                                high
                                https://github.com/matthewwithanm/django-imagekit/issues/50AccountChanger.exe, 00000000.00000003.1844272308.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                  high
                                  http://stackoverflow.com/questions/19622133/AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmpfalse
                                    high
                                    https://archive.org/details/gg243631AccountChanger.exe, 00000000.00000003.1844940821.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpfalse
                                      high
                                      https://refspecs.linuxfoundation.org/elf/gabi4AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpfalse
                                        high
                                        https://www.matthewflickinger.com/lab/whatsinagif/bits_and_bytes.aspAccountChanger.exe, 00000000.00000003.1839765661.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpfalse
                                          high
                                          http://docs.python.org/3/library/subprocess#subprocess.Popen.killAccountChanger.exe, 00000003.00000002.3074094032.000001ADD5240000.00000004.00001000.00020000.00000000.sdmpfalse
                                            high
                                            https://www.littlecms.comAccountChanger.exe, 00000000.00000003.1849510446.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            http://curl.haxx.se/rfc/cookie_spec.htmlAccountChanger.exe, 00000003.00000002.3074581227.000001ADD58A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              high
                                              http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodeAccountChanger.exe, 00000003.00000002.3074094032.000001ADD5240000.00000004.00001000.00020000.00000000.sdmpfalse
                                                high
                                                https://github.com/python-pillow/Pillow/issues/4343AccountChanger.exe, 00000000.00000003.1844149816.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1844149816.000002D5B60A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  high
                                                  https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyAccountChanger.exe, 00000003.00000002.3074292629.000001ADD5480000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    high
                                                    https://docs.python.org/3/library/pprint.htmlAccountChanger.exe, 00000003.00000003.1924245611.000001ADD4000000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      high
                                                      https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688AccountChanger.exe, 00000003.00000002.3070509337.000001ADD3300000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        high
                                                        https://httpbin.org/getAccountChanger.exe, 00000003.00000002.3074292629.000001ADD5480000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4BC3000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071175342.000001ADD3A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          high
                                                          https://exiv2.org/tags.html)AccountChanger.exe, 00000000.00000003.1844385195.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://linuxreviews.org/HOWTO_change_the_mouse_speed_in_XAccountChanger.exe, 00000000.00000003.1912245200.000002D5B60D1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4BC3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://github.com/python-pillow/Pillow/AccountChanger.exe, 00000003.00000002.3074094032.000001ADD5240000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            high
                                                            https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-accessAccountChanger.exe, 00000003.00000003.1921541584.000001ADD3B18000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1921631662.000001ADD3B1F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1921698137.000001ADD3AFF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1921631662.000001ADD3B70000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071175342.000001ADD3A40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1921474228.000001ADD3B70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              high
                                                              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerAccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                high
                                                                https://httpbin.org/AccountChanger.exe, 00000003.00000002.3070795017.000001ADD3640000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  high
                                                                  https://www.apache.org/licenses/LICENSE.APACHE.0.drfalse
                                                                    high
                                                                    https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=mainMETADATA.0.drfalse
                                                                      high
                                                                      https://foss.heptapod.net/pypy/pypy/-/issues/3539#AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      unknown
                                                                      https://github.com/GNOME/gimp/blob/mainline/devel-docs/gbr.txtAccountChanger.exe, 00000000.00000003.1839414250.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        high
                                                                        http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071175342.000001ADD3A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          high
                                                                          https://cryptography.io/en/latest/installation/METADATA.0.drfalse
                                                                            high
                                                                            https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syAccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              high
                                                                              https://docs.python.org/3/library/re.htmlAccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                high
                                                                                https://github.com/pypa/setuptools/issues/417#issuecomment-392298401AccountChanger.exe, 00000003.00000002.3071052437.000001ADD3940000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  high
                                                                                  https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdfAccountChanger.exe, 00000000.00000003.1841405207.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    high
                                                                                    http://github.com/ActiveState/appdirsAccountChanger.exe, 00000003.00000002.3071727863.000001ADD3E40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      high
                                                                                      https://wiki.debian.org/XDGBaseDirectorySpecification#stateAccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        high
                                                                                        http://wwwsearch.sf.net/):AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          high
                                                                                          http://tools.ietf.org/html/rfc6125#section-6.4.3AccountChanger.exe, 00000003.00000002.3074376097.000001ADD5590000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            high
                                                                                            https://cryptography.io/en/latest/security/METADATA.0.drfalse
                                                                                              high
                                                                                              https://bugs.python.org/issue44497.AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                high
                                                                                                https://google.com/mailAccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  high
                                                                                                  https://packaging.python.org/specifications/entry-points/AccountChanger.exe, 00000003.00000002.3070944731.000001ADD3840000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    high
                                                                                                    https://github.com/jaraco/jaraco.functools/issues/5AccountChanger.exe, 00000003.00000002.3072540717.000001ADD4640000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1922405188.000001ADD367A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      high
                                                                                                      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyAccountChanger.exe, 00000003.00000002.3070035299.000001ADD16C2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        high
                                                                                                        https://github.com/pyca/cryptography/issuesMETADATA.0.drfalse
                                                                                                          high
                                                                                                          https://github.com/python-pillow/Pillow/issues/1293AccountChanger.exe, 00000000.00000003.1836904744.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            high
                                                                                                            http://bugs.python.org/issue23606)AccountChanger.exe, 00000003.00000003.1928747456.000001ADD4A94000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3074292629.000001ADD5480000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              high
                                                                                                              https://readthedocs.org/projects/cryptography/badge/?version=latestMETADATA.0.drfalse
                                                                                                                high
                                                                                                                https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  high
                                                                                                                  http://google.com/AccountChanger.exe, 00000003.00000002.3072932570.000001ADD4A9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    high
                                                                                                                    https://mahler:8092/site-updates.pyAccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    low
                                                                                                                    https://savannah.nongnu.org/bugs/?56186AccountChanger.exe, 00000000.00000003.1841543248.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      high
                                                                                                                      http://.../back.jpegAccountChanger.exe, 00000003.00000002.3074581227.000001ADD58C4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      low
                                                                                                                      https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.htmlAccountChanger.exe, 00000000.00000003.1861515037.000002D5B609E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1861799573.000002D5B609E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1928104208.000001ADD4AC4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3072932570.000001ADD4A9C000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1928627813.000001ADD4AC4000.00000004.00000020.00020000.00000000.sdmp, ctk_font.cpython-310.pyc.0.dr, ctk_font.py.0.drfalse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      unknown
                                                                                                                      https://github.com/pyca/cryptographyMETADATA.0.drfalse
                                                                                                                        high
                                                                                                                        https://www.python.org/download/releases/2.3/mro/.AccountChanger.exe, 00000003.00000002.3070509337.000001ADD3300000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          high
                                                                                                                          https://cryptography.io/METADATA.0.drfalse
                                                                                                                            high
                                                                                                                            https://httpbin.org/postAccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              high
                                                                                                                              https://github.com/pyca/cryptography/METADATA.0.drfalse
                                                                                                                                high
                                                                                                                                https://github.com/Ousret/charset_normalizerAccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://www.cazabon.comAccountChanger.exe, 00000000.00000003.1842451666.000002D5B609A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000000.00000003.1849510446.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                  unknown
                                                                                                                                  https://docs.python.org/3/library/re.html#re.subAccountChanger.exe, 00000003.00000002.3072364442.000001ADD4440000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923899330.000001ADD3FB2000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923899330.000001ADD4009000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    high
                                                                                                                                    https://drafts.csswg.org/css-color-4/AccountChanger.exe, 00000000.00000003.1840917199.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      high
                                                                                                                                      https://yahoo.com/AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        high
                                                                                                                                        http://crl3.digkAccountChanger.exe, 00000000.00000003.1822916459.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        unknown
                                                                                                                                        http://tip.tcl.tk/48)AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3073012826.000001ADD4B1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          high
                                                                                                                                          https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2AccountChanger.exe, 00000003.00000002.3072540717.000001ADD4640000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            high
                                                                                                                                            https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666#70724666AccountChanger.exe, 00000003.00000002.3074767094.000001ADD59B8000.00000004.00001000.00020000.00000000.sdmp, ctk_tk.cpython-310.pyc.0.dr, ctk_tk.py.0.drfalse
                                                                                                                                              high
                                                                                                                                              https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regularAccountChanger.exe, 00000003.00000003.1924245611.000001ADD4000000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923899330.000001ADD3FB2000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1923899330.000001ADD4009000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                high
                                                                                                                                                http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  high
                                                                                                                                                  https://github.com/pypa/packagingSPAccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    high
                                                                                                                                                    http://cacerts.digicert.coAccountChanger.exe, 00000000.00000003.1823245124.000002D5B6098000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    unknown
                                                                                                                                                    http://crl.thawte.com/ThawteTimestampingCA.crl0AccountChanger.exe, 00000000.00000003.1829166093.000002D5B6099000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      high
                                                                                                                                                      https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exe__init__.py8.0.drfalse
                                                                                                                                                        high
                                                                                                                                                        https://html.spec.whatwg.org/multipage/AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4235000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          high
                                                                                                                                                          https://github.com/pyparsing/pyparsing/wikiAccountChanger.exe, 00000003.00000002.3071819598.000001ADD3F40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            high
                                                                                                                                                            https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsAccountChanger.exe, 00000003.00000002.3074376097.000001ADD55CC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              high
                                                                                                                                                              https://cryptography.io/en/latest/changelog/METADATA.0.drfalse
                                                                                                                                                                high
                                                                                                                                                                https://mail.python.org/mailman/listinfo/cryptography-devMETADATA.0.drfalse
                                                                                                                                                                  high
                                                                                                                                                                  https://upload.pypi.org/legacy/AccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    high
                                                                                                                                                                    http://docs.python.org/library/itertools.html#recipesAccountChanger.exe, 00000003.00000002.3072364442.000001ADD4440000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071641885.000001ADD3D40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      high
                                                                                                                                                                      https://requests.readthedocs.ioAccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3074767094.000001ADD5948000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        high
                                                                                                                                                                        http://www.graficaobscura.com/interp/index.htmlAccountChanger.exe, 00000000.00000003.1841215913.000002D5B609D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                        unknown
                                                                                                                                                                        http://www.gnu.org/licenses/__init__.py10.0.dr, _dummy.py.0.dr, _base.py.0.drfalse
                                                                                                                                                                          high
                                                                                                                                                                          https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcaAccountChanger.exe, 00000003.00000002.3072453319.000001ADD4540000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000002.3071549164.000001ADD3C40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            high
                                                                                                                                                                            https://packaging.python.org/en/latest/specifications/declaring-project-metadata/AccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927322302.000001ADD40DB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000003.00000003.1927839049.000001ADD417D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              high
                                                                                                                                                                              http://www.apache.org/licenses/LICENSE-2.0AccountChanger.exe, 00000000.00000003.1856215562.000002D5B609A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                high
                                                                                                                                                                                https://github.com/pypa/setuptools/issues/1024.AccountChanger.exe, 00000003.00000002.3072364442.000001ADD4440000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  high
                                                                                                                                                                                  https://www.python.orgAccountChanger.exe, 00000003.00000002.3071819598.000001ADD4066000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    high
                                                                                                                                                                                    No contacted IP infos
                                                                                                                                                                                    Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                    Analysis ID:1431268
                                                                                                                                                                                    Start date and time:2024-04-24 18:57:08 +02:00
                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                    Overall analysis duration:0h 8m 48s
                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                    Report type:full
                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                    Number of analysed new started processes analysed:7
                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                                                    Technologies:
                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                    Sample name:AccountChanger.exe
                                                                                                                                                                                    Detection:SUS
                                                                                                                                                                                    Classification:sus28.winEXE@6/1025@0/0
                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                    • Successful, ratio: 79%
                                                                                                                                                                                    • Number of executed functions: 84
                                                                                                                                                                                    • Number of non-executed functions: 158
                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                    • Found application associated with file extension: .exe
                                                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 20.190.151.6, 20.190.151.69, 20.190.151.9, 20.190.151.70, 20.190.151.68, 20.190.151.8, 20.190.151.133, 20.190.151.134, 52.168.117.173
                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, www.tm.lg.prod.aadmsa.akadns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com
                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                    • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                    • VT rate limit hit for: AccountChanger.exe
                                                                                                                                                                                    No simulations
                                                                                                                                                                                    No context
                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    fp2e7a.wpc.phicdn.nethttps://runrun.it/share/form/0SRuaDvcQOCgwT9FGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    https://phoenixdevcom.glastec.org/?nLN3=brX8qGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    http://ncdocvault.netGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    https://btcpike.topGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    https://www.maultalk.com/url.php?to=https://www.serserijeans.com/vkrWO3usk17alli2Psx0qFe5aglFe5dy9WO3rgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Flookerstudio%2Egoogle%2Ecom%2Fs%2FscrHqwjeA3k&urlhash=dcQj&trk=public_profile-settings_topcard-websiteGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    https://midissant.netGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    https://ken.fnh.temporary.site/wp-includes/sitemaps/updateGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    https://8fq7c.eceydri.com/WK9D/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    http://womenofgoodworks-my.sharepoint.com/:b:/g/personal/tia_womenofgoodworks_org/EVICmRtg-CVNtsngkb8KQlgBH2LYVfumjH5s-SFbeQjN_QGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    • 192.229.211.108
                                                                                                                                                                                    bg.microsoft.map.fastly.nethttps://phoenixdevcom.glastec.org/?nLN3=brX8qGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    • 199.232.210.172
                                                                                                                                                                                    http://ncdocvault.netGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 199.232.210.172
                                                                                                                                                                                    bUHH.exeGet hashmaliciousAsyncRAT, DcRatBrowse
                                                                                                                                                                                    • 199.232.214.172
                                                                                                                                                                                    https://btcpike.topGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 199.232.214.172
                                                                                                                                                                                    https://www.maultalk.com/url.php?to=https://www.serserijeans.com/vkrWO3usk17alli2Psx0qFe5aglFe5dy9WO3rgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 199.232.210.172
                                                                                                                                                                                    https://midissant.netGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 199.232.210.172
                                                                                                                                                                                    lmg1_Mlakaifa443456.vbsGet hashmaliciousAsyncRAT, DcRat, RemcosBrowse
                                                                                                                                                                                    • 199.232.210.172
                                                                                                                                                                                    https://ken.fnh.temporary.site/wp-includes/sitemaps/updateGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 199.232.210.172
                                                                                                                                                                                    https://8fq7c.eceydri.com/WK9D/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    • 199.232.210.172
                                                                                                                                                                                    http://womenofgoodworks-my.sharepoint.com/:b:/g/personal/tia_womenofgoodworks_org/EVICmRtg-CVNtsngkb8KQlgBH2LYVfumjH5s-SFbeQjN_QGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                    • 199.232.214.172
                                                                                                                                                                                    No context
                                                                                                                                                                                    No context
                                                                                                                                                                                    No context
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):48199
                                                                                                                                                                                    Entropy (8bit):4.576360193039458
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:PhrGdBPc36FP8nJF8PvOKQ1vlS5taKVgSmgtp:PhKbr01I5tjgRgtp
                                                                                                                                                                                    MD5:4F458F32FEAF90F637441D102CC2335D
                                                                                                                                                                                    SHA1:199D6F3CA892EF720BF5E5A6458074F67F0432A9
                                                                                                                                                                                    SHA-256:3290CC30F3166E543214A0037B122E3458CFE397119AB003622F35F6034D9A93
                                                                                                                                                                                    SHA-512:58771311E68DD852ED9ED2B2D3163359E74E84C013487408D3EFDF2BA264B0D470D0A2FE1CAFA25412F66EBC97792BCB6A14648A64CB763F699CFF783A1822F4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:#..# The Python Imaging Library...# $Id$..#..# PNG support code..#..# See "PNG (Portable Network Graphics) Specification, version 1.0;..# W3C Recommendation", 1996-10-01, Thomas Boutell (ed.)...#..# history:..# 1996-05-06 fl Created (couldn't resist it)..# 1996-12-14 fl Upgraded, added read and verify support (0.2)..# 1996-12-15 fl Separate PNG stream parser..# 1996-12-29 fl Added write support, added getchunks..# 1996-12-30 fl Eliminated circular references in decoder (0.3)..# 1998-07-12 fl Read/write 16-bit images as mode I (0.4)..# 2001-02-08 fl Added transparency support (from Zircon) (0.5)..# 2001-04-16 fl Don't close data source in "open" method (0.6)..# 2004-02-24 fl Don't even pretend to support interlaced files (0.7)..# 2004-08-31 fl Do basic sanity check on chunk identifiers (0.8)..# 2004-09-20 fl Added PngInfo chunk container..# 2004-12-18 fl Added DPI read support (based on code by Niki Spahiev)..# 2008-08-13 fl Added tRNS support for RGB images..#
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11746
                                                                                                                                                                                    Entropy (8bit):4.447633518664499
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:YCP3xlGMWYjb5aHt01n/4vVsIgO/sDMFu4VjHqPGyvyc3hPYF1QUtA:b5WYjb5aH0nAGIeDMFtVGPpvz3h
                                                                                                                                                                                    MD5:CEC49A3D8BD5B490A17966499FDE600A
                                                                                                                                                                                    SHA1:D474A5ABB0B8130D0BA65566791EC6878C83BD65
                                                                                                                                                                                    SHA-256:D1D7F9D820C1E9D624F9154ED294DDDAE93552F15DDD44A806D3BC6B3A5AE073
                                                                                                                                                                                    SHA-512:FFE936856350A6FC3C4D556E8BD3DB1DDAF569090C75F855CFDC4A49FEED3F869562D1E4DB948E3C2C34C90F8DD850768C0F35613B7E89F0450835BEE7E897FC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:#..# The Python Imaging Library...# $Id$..#..# PPM support for PIL..#..# History:..# 96-03-24 fl Created..# 98-03-06 fl Write RGBA images (as RGB, that is)..#..# Copyright (c) Secret Labs AB 1997-98...# Copyright (c) Fredrik Lundh 1996...#..# See the README file for information on usage and redistribution...#......from . import Image, ImageFile..from ._binary import i16be as i16..from ._binary import o8..from ._binary import o32le as o32....#..# --------------------------------------------------------------------....b_whitespace = b"\x20\x09\x0a\x0b\x0c\x0d"....MODES = {.. # standard.. b"P1": "1",.. b"P2": "L",.. b"P3": "RGB",.. b"P4": "1",.. b"P5": "L",.. b"P6": "RGB",.. # extensions.. b"P0CMYK": "CMYK",.. # PIL extensions (for test purposes only).. b"PyP": "P",.. b"PyRGBA": "RGBA",.. b"PyCMYK": "CMYK",..}......def _accept(prefix):.. return prefix[0:1] == b"P" and prefix[1] in b"0123456y"......##..# Image plugin for PBM, PG
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7838
                                                                                                                                                                                    Entropy (8bit):4.467446977609828
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:RxCtkVKFOCDUGjC/bTn9pyzneeWqTFRP3WM7SNFrz4GXk26ruBa5JGSLZWrCxwjx:OtkECDTP6yOXSZXk/WinLZtmtKs
                                                                                                                                                                                    MD5:955466D46DD8EDE6309AD4E4366BA6D3
                                                                                                                                                                                    SHA1:8CFDC77ADBDAE863DFF135C54D791368729C711B
                                                                                                                                                                                    SHA-256:297539D06B1A516A433FD1BEFB36558C57E5339B1DB7D0832822FDCB31199F29
                                                                                                                                                                                    SHA-512:34B5FD53335A60315A5F73318473DD8F5CC374A44C2863E98AFF6887643A107379F320044EEF5D03CF26803E7858CD349954C22F350A9BE97F3BEEC3E4AF9D96
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:#..# The Python Imaging Library..# $Id$..#..# Adobe PSD 2.5/3.0 file handling..#..# History:..# 1995-09-01 fl Created..# 1997-01-03 fl Read most PSD images..# 1997-01-18 fl Fixed P and CMYK support..# 2001-10-21 fl Added seek/tell support (for layers)..#..# Copyright (c) 1997-2001 by Secret Labs AB...# Copyright (c) 1995-2001 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#....import io....from . import Image, ImageFile, ImagePalette..from ._binary import i8..from ._binary import i16be as i16..from ._binary import i32be as i32..from ._binary import si16be as si16....MODES = {.. # (photoshop mode, bits) -> (pil mode, required channels).. (0, 1): ("1", 1),.. (0, 8): ("L", 1),.. (1, 8): ("L", 1),.. (2, 8): ("P", 1),.. (3, 8): ("RGB", 3),.. (4, 8): ("CMYK", 4),.. (7, 8): ("L", 1), # FIXME: multilayer.. (8, 8): ("L", 1), # duotone.. (9, 8): ("LAB", 3),..}......# ------------------------------------------------
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10189
                                                                                                                                                                                    Entropy (8bit):4.762847239927027
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:EwHJ7Kxs54rsprs6wmY6ZhtmftOimHzRmpyACKtc:nHJ7KjgFxW2C2
                                                                                                                                                                                    MD5:F9FCD35E87C34995794FCB281C626471
                                                                                                                                                                                    SHA1:2FDE5AA613474A42703515E3549DC32A3CAB2021
                                                                                                                                                                                    SHA-256:25E2E6620EA9A34E3EAF2A0D41946E7CC9AFE300ED9750D5D0074D5458547973
                                                                                                                                                                                    SHA-512:69D33E8C7162B9F6D76D2DB4B99180C16B33AA7FF6946AD49F915652262382F927D6D4187CB62A840CFE5D5499A19D098B8F317D814F04AE8E0AB79DCCC7807C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:#..# The Python Imaging Library..# Pillow fork..#..# Python implementation of the PixelAccess Object..#..# Copyright (c) 1997-2009 by Secret Labs AB. All rights reserved...# Copyright (c) 1995-2009 by Fredrik Lundh...# Copyright (c) 2013 Eric Soroos..#..# See the README file for information on usage and redistribution..#....# Notes:..#..# * Implements the pixel access object following Access.c..# * Taking only the tuple form, which is used from python...# * Fill.c uses the integer form, but it's still going to use the old..# Access.c implementation...#....import logging..import sys....try:.. from cffi import FFI.... defs = """.. struct Pixel_RGBA {.. unsigned char r,g,b,a;.. };.. struct Pixel_I16 {.. unsigned char l,r;.. };.. """.. ffi = FFI().. ffi.cdef(defs)..except ImportError as ex:.. # Allow error import for doc purposes, but error out when accessing.. # anything in core... from ._util import DeferredError.... FFI = f
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3722
                                                                                                                                                                                    Entropy (8bit):4.467195317132569
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:RItUfpyQTGaf3TxnTM0iinbqg+0wqAGeCwDyCwhHwI/i:rZTGaf3Txjiimg+eAGe/EhQz
                                                                                                                                                                                    MD5:8FAC20A531F2BC092DFB84CAA462D0DA
                                                                                                                                                                                    SHA1:6DCB348DFBB8C67768AA2A0D715AE56B7D5C2AE4
                                                                                                                                                                                    SHA-256:56F8A9388F1CC8CB65801FFC4E4ECEC5EBF13B401A7662528F590532247F6713
                                                                                                                                                                                    SHA-512:5D63ED61EB7D7D4F4FC2CB8D27CEDB4AC2F13E2EDA8E57B2FD810DFBD75731FDD5710716ED39E070DB86EC8A003B24040D76511AC9FA27DA5C17B3F7F2C81555
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:#..# The Python Imaging Library...#..# QOI support for PIL..#..# See the README file for information on usage and redistribution...#....import os....from . import Image, ImageFile..from ._binary import i32be as i32..from ._binary import o8......def _accept(prefix):.. return prefix[:4] == b"qoif"......class QoiImageFile(ImageFile.ImageFile):.. format = "QOI".. format_description = "Quite OK Image".... def _open(self):.. if not _accept(self.fp.read(4)):.. msg = "not a QOI file".. raise SyntaxError(msg).... self._size = tuple(i32(self.fp.read(4)) for i in range(2)).... channels = self.fp.read(1)[0].. self.mode = "RGB" if channels == 3 else "RGBA".... self.fp.seek(1, os.SEEK_CUR) # colorspace.. self.tile = [("qoi", (0, 0) + self._size, self.fp.tell(), None)]......class QoiDecoder(ImageFile.PyDecoder):.. _pulls_fd = True.... def _add_to_previous_pixels(self, value):.. self._previous_pixel = value....
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12827
                                                                                                                                                                                    Entropy (8bit):6.098020721768083
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:6y0UJg/OjKvafcCpW4viVym51IQ1DsS5rOyjA7qxy0k4bde:I/8BWv5NGWrkO1Rw
                                                                                                                                                                                    MD5:CB15D5B021198C5E90F94D2B06981775
                                                                                                                                                                                    SHA1:03F13552D8BFA9E01C90EFD097DE50CF092EF64E
                                                                                                                                                                                    SHA-256:41CC288569F3E2370C226AF5B54D4A74B37307B4777731BAF59D8F68F4F9D99B
                                                                                                                                                                                    SHA-512:0FE5C8841ACB4FEBF7736A7595E5CD4C85D712D3D7B17F8A8260525008104CD65D52CE3B3931AB5C7A76CBA558915BBBFA8F48EF97556095397ECE734E75DC72
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:o.......5+.d.C.......................@...s@...d.d.l.m.Z...G.d.d...d.e.d.d.....Z...d"d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d e.d.f...d!d"e.d.d.d.d.d.d.d.d#d$..f...d%d&e.d.d.d.d.d.d.d.d.d.d'd(d)..f...d*d+e.d.f...d,d-e.d.f...d.d/e.d.f...d0d1e.d.f...d2d3e.d.f...d4d5e.d.f...d6d7e.d.f...d8d9e.d.f...d:d;e.d.f...d<d=e.d.f...i.d>d?e.d.f...d@dAe.d.f...dBdCe.d.f...dDdEe.d.f...dFdGe.d.f...dHdIe.d.f...dJdKe.d.f...dLdMe.d.d.d.dN..f...dOdPe.d.f...dQdRe.d.f...dSdTe.d.f...dUdVe.d.f...dWdXe.d.f...dYdZe.d.f...d[d\e.d.f...d]d^e.d.f...d_d`e.d.f.....i.dadbe.d.d.d.d.dc..f...dddee.d.f...dfdge.d.f...dhdie.d.f...djdke.d.f...dldme.d.f...dndoe.d.f...dpdqe.d.d.d.dr..f...dsdte.d.f...dudve.d.f...dwdxe.d.f...dydze.d.f...d{d|e.d.f...d}d~e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f.....i.d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2886
                                                                                                                                                                                    Entropy (8bit):5.998193538378216
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/lXoOokqW9P76k59LeLet2SWUpQe/FEvaMGulxu7XDqQby4Yxm:ipW9P7lWLRUHSaOl87O9Y
                                                                                                                                                                                    MD5:512D00CD90B1ED97CDE9B9CA63165660
                                                                                                                                                                                    SHA1:164641C12B00BA75849C19FBDA5C4FDAE015FB17
                                                                                                                                                                                    SHA-256:F075D5B5EAF0C3E2AA8D8793B3DDD6FE3BC7F40483AAC777BF84F0E793BAEA21
                                                                                                                                                                                    SHA-512:32B04DFA7487F3082E447C360D19BC3ED313BD380FC497CCD0326F97E6B6D4D227C59B0DC0B2987533B5DB8F5E232705463FEECA70E71BE16ED1BBC16E464FAD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:o.......5+.d.........................@...sB...d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.d...Z.d.Z.d.S.).a.....This reader is based on the specification available from:.https://www.flipcode.com/archives/Quake_2_BSP_File_Format.shtml.and has been tested with a few sample files found using google..... note::. This format cannot be automatically recognized, so the reader. is not registered for use with :py:func:`PIL.Image.open()`.. To open a WAL file, use the :py:func:`PIL.WalImageFile.open()` function instead.......)...Image..ImageFile)...i32lec....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...WalImageFileZ.WALz.Quake2 Texturec....................C...s....d.|._.|.j...d...}.t.|.d...t.|.d...f.|._.t...|.j.....t.|.d...}.|.j...|.....|.d.d.......d.d...d...|.j.d.<.|.d.d.......d.d...d...}.|.rI|.|.j.d.<.d.S.d.S.).N..P.d.... ....$....(.........r...........name.8....X.....next_name)...mode..fp..read..i32.._sizer....Z._decompression_bomb_check..size..seek..split.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7532
                                                                                                                                                                                    Entropy (8bit):5.492225976651654
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mN0AHU7yy5Nt948/SAlAr9qOs+RKMHW9h:fAHU7yy5N5ArgOsV
                                                                                                                                                                                    MD5:FDFF885230A525C4D11438F3ECA62442
                                                                                                                                                                                    SHA1:BC1D8C8113C2F14A74F695ABF59463A61B3A9CB7
                                                                                                                                                                                    SHA-256:677D814A4BCF9C723BC1CAD4F7CB0617B35E922A2B4322F8EF537CF60F846944
                                                                                                                                                                                    SHA-512:38652B4297CBF0806549776215EFD8434AB70918ADAFD3F9248EC0D4CB9C720E63998BC54BE75EAE7686B5055A999C52B9A613F261B15D5E6E071C00EDEB6DA6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:o.......5+.d.-.......................@...s....d.d.l.m.Z...d.d.l.m.Z.m.Z...z.d.d.l.m.Z...d.Z.W.n...e.y#......d.Z.Y.n.w.d.d.d.d...Z.d.d.d...Z.d.d.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.d.d...Z.e...e.j.e.e.....e.rue...e.j.e.....e.j.ree...e.j.e.....e...e.j.d.....e...e.j.d.....d.S.d.S.)......)...BytesIO.....)...Image..ImageFile)..._webpTF)...RGBX..RGBA..RGB).r....r....r....r....).s....VP8 s....VP8Xs....VP8Lc....................C...sV...|.d.d.....d.k.}.|.d.d.....d.k.}.|.d.d.....t.v.}.|.r%|.r'|.r)t.s#..d.S.d.S.d.S.d.S.d.S.).N.....s....RIFF..........s....WEBP.....zEimage file could not be identified because WEBP support not installedT)..._VP8_MODES_BY_IDENTIFIER..SUPPORTED)...prefixZ.is_riff_file_formatZ.is_webp_fileZ.is_valid_vp8_mode..r....._C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/WebPImagePlugin.py.._accept....s......................r....c........................sr...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z...f
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3454
                                                                                                                                                                                    Entropy (8bit):5.245874075977342
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:FFqlpWUFa1E4Bd/mNHMIn4KL33iVIfWOrnFhoirl9nZzVa8DPa:FWplF0E2FCnn/iqrnFqiR9nZzVa8DPa
                                                                                                                                                                                    MD5:6B7FCE91B2A4865642DED2CD92664AEA
                                                                                                                                                                                    SHA1:0D7C5CFF854D35E15115E298438E168B9CE3C02F
                                                                                                                                                                                    SHA-256:30F40F90E1BFCB7AB4989E1301FAC620D91F5D29E5EAB05BA86E408FCDE924DF
                                                                                                                                                                                    SHA-512:E715395BF738188CCF0DDD848F2B2DD1736738374848BE08A28187E6A94657010D7871D417E96E8D5B0AC6B491B9656268DE297E11222C032792AC6F1DB4CB75
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:o.......5+.d.........................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.a.d.d...Z.e.e.j.d...r2G.d.d...d...Z.e.e.......d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.d.g.....d.S.)......)...Image..ImageFile)...i16le)...si16le)...si32leNc....................C...s....|.a.d.S.).z^. Install application-specific WMF image handler... :param handler: Handler object.. N...._handler)...handler..r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/WmfImagePlugin.py..register_handler....s......r......drawwmfc....................@...s....e.Z.d.Z.d.d...Z.d.d...Z.d.S.)...WmfHandlerc....................C...s....d.|._.|.j.d...|._.d.S.).N..RGB..wmf_bbox)...mode..info..bbox....self..imr....r....r......open,...s........z.WmfHandler.openc....................C...sL...|.j...d.....t...d.|.j.t.j...|.j.....|.j.|.j...d.d.|.j.d...d...d...d.@.d...S.).N.....r......rawZ.BGR...............)...fp..seekr......frombytes..size..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1455
                                                                                                                                                                                    Entropy (8bit):5.450023753847409
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:v7joRVOhCY/B/Hn95ht6ArzWDD5wfCY1dA8/BdU/8bJGkSO5wSF25Viesw/srzIx:QRMVH95fZWDN//8bJGkL5wY25V5czO
                                                                                                                                                                                    MD5:07346657C727FA022B6F873338F33B30
                                                                                                                                                                                    SHA1:7CF88FC81BB9F86A6D18299026021A197C5F14D8
                                                                                                                                                                                    SHA-256:A3DEC612B10717CE2C89CDECB26C899FB44A4EC8B3215CADF5B1B5C6C66547CE
                                                                                                                                                                                    SHA-512:3D967014B74543FB7A9029416E2AA519BB58E642559E9B9DE661B63D19A6FA658F836DA375D974782589D17ACFE31BDB98001FE7622AC892B1703165BE847A26
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:o.......5+.d.........................@...s....d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.e.d...D.]*Z.e.d...D.]#Z.e.d...D.].Z.e.e.e.d...d.....e.e.d...d.......e.e.d...d.........Z.q$q.q.d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....d.S.)......)...Image..ImageFile..ImagePalette)...o8s....P7 332..............................c....................C...s....|.d.d.....t.k.S.).N.....)..._MAGIC)...prefix..r.....bC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/XVThumbImagePlugin.py.._accept#...s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...XVThumbImageFileZ.XVThumbz.XV thumbnail imagec....................C...s....t.|.j...d.....s.d.}.t.|.....|.j.........|.j.....}.|.s!d.}.t.|.....|.d...d.k.r(n.q.|.........}.d.|._.t.|.d.....t.|.d.....f.|._.t...d.t...|._.d.d.|.j...|.j.....|.j.d.d.f.f.g.|._.d.S.).Nr....z.not an XV thumbnail fileTz(Unexpected EOF reading XV thumbnail file......#.....Pr......RGB..raw).r....r....).r......fp..read..SyntaxError..readline..stri
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2120
                                                                                                                                                                                    Entropy (8bit):5.591489847137234
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+QW/yPvZj5KWvw4oe1PsYFqPmXR7kF7oQFMDjJFzkmXU/y9yB:HXZjFwGkQRhQWDjJdXU/y9yB
                                                                                                                                                                                    MD5:4FF6F1660CDEDB05F07BC46C4DD87231
                                                                                                                                                                                    SHA1:996A6E6CDBFC056B94C5CCDFBC3F271408514B0E
                                                                                                                                                                                    SHA-256:11837AE2A8F18D24355ED863F2AAAA0124270C53BFF044EFD586270A6CEE7986
                                                                                                                                                                                    SHA-512:EED91D1D337C7B74EF1B7AE04BDCD90C96DFADEF0AE53E6326D4F29C32A03BB31C1077F659EBF337B10915B11D55071739157671B69D23A4ED88C7092558B89B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:o.......5+.d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...e...d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....e...e.j.d.....d.S.)......N.....)...Image..ImageFiles....\s*#define[ \t]+.*_width[ \t]+(?P<width>[0-9]+)[\r\n]+#define[ .]+.*_height[ .]+(?P<height>[0-9]+)[..]+(?P<hotspot>#define[ .]+[^_]*_x_hot[ .]+(?P<xhot>[0-9]+)[..]+#define[ .]+[^_]*_y_hot[ .]+(?P<yhot>[0-9]+)[..]+)?[\000-\377]*_bits\[]c....................C...s....|.....d.d.....d.k.S.).N.....s....#define)...lstrip)...prefix..r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/XbmImagePlugin.py.._accept&...s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...XbmImageFileZ.XBMz.X11 Bitmapc....................C...s....t...|.j...d.....}.|.s.d.}.t.|.....t.|...d.....}.t.|...d.....}.|...d...r5t.|...d.....t.|...d.....f.|.j.d.<.d.|._.|.|.f.|._.d.d.|.j...|.....d.f.g.|._.d.S.).Ni....z.not a XBM file..width..height..hotspotZ.xhotZ.yhot
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2275
                                                                                                                                                                                    Entropy (8bit):5.514228424423944
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:yovkl98767MT1CrYrl7lfRh/YsJLUj4mmOvW51X5ak8yqn19P:ql9HEnxFpYECvW7oNn19P
                                                                                                                                                                                    MD5:16ED196D45E355226C949CFC426EE0C2
                                                                                                                                                                                    SHA1:B674870F7754C7CEDE150B5FE9F16B6B16777203
                                                                                                                                                                                    SHA-256:30AAC0B943BE316D1B827103F2713705FC22FC10C680D0642372BD29E3F99097
                                                                                                                                                                                    SHA-512:5DF3D09216DE4A811E8C0F4A01ED6704A51D137FD9D1AC00497EAD024F56B646D95706D6E244DE895C6B4383BADAE24DAE0E3FB1B17CFAF40B1FB3151BE566AD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.d.........................@...s|...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...e...d...Z.d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....e...e.j.d.....d.S.)......N.....)...Image..ImageFile..ImagePalette)...o8s$..."([0-9]*) ([0-9]*) ([0-9]*) ([0-9]*)c....................C...s....|.d.d.....d.k.S.).N.....s..../* XPM */..)...prefixr....r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/XpmImagePlugin.py.._accept....s......r....c....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...XpmImageFileZ.XPMz.X11 Pixel Mapc....................C...s....t.|.j...d.....s.d.}.t.|.......|.j.....}.|.s.d.}.t.|.....t...|...}.|.r$n.q.t.|...d.....t.|...d.....f.|._.t.|...d.....}.t.|...d.....}.|.d.k.sJ|.d.k.rPd.}.t.|.....d.g.d...}.t.|...D.].}.|.j.....}.|.d.d.....d.k.ro|.d.d.....}.n.|.d.d.....d.v.r}|.d.d.....}.|.d...}.|.d.d.........}.t.d.t.|...d...D.]J}.|.|...d.k.r.|.|.d.....}.|.d.k.r.|.|.j.d.<.n0|.d.d.....d.k.r.t.|.d.d.....d...}.t.|.d.?.d.@...t.|.d.?
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1932
                                                                                                                                                                                    Entropy (8bit):5.396717591242199
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/UqetD27XhaCqLfLgpG08IqLUYRuYaQr5TS:8dDfCifLj0ZqL+A1e
                                                                                                                                                                                    MD5:98CBD308586F81C95E051AB8B53F93D9
                                                                                                                                                                                    SHA1:EE5AB9B826E7A4C61F6500427D4C2F5D6A45F156
                                                                                                                                                                                    SHA-256:7BF25C5E3BAB140A7AAB4E6455A3651D20E8380011F9377D9A1034D1CB5D1C93
                                                                                                                                                                                    SHA-512:274D9297079524004D63ED017FF61EF10207297F880255DFE035F469FEC9E3EF1B8D990B53F61E398C656C67A936B83161B5F22B1536090096A179DA0E243503
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.d+........................@...s4...d.Z.d.d.l.m.Z...e.j.Z.[.g.d...Z.G.d.d...d.e...Z.d.S.).ah...Pillow (Fork of the Python Imaging Library)..Pillow is the friendly PIL fork by Jeffrey A. Clark (Alex) and contributors.. https://github.com/python-pillow/Pillow/..Pillow is forked from PIL 1.1.7...PIL is the Python Imaging Library by Fredrik Lundh and contributors..Copyright (c) 1999 by Secret Labs AB...Use PIL.__version__ for this Pillow version...;-)......)..._version)/Z.BlpImagePluginZ.BmpImagePluginZ.BufrStubImagePluginZ.CurImagePluginZ.DcxImagePluginZ.DdsImagePluginZ.EpsImagePluginZ.FitsImagePluginZ.FitsStubImagePluginZ.FliImagePluginZ.FpxImagePluginZ.FtexImagePluginZ.GbrImagePluginZ.GifImagePluginZ.GribStubImagePluginZ.Hdf5StubImagePluginZ.IcnsImagePluginZ.IcoImagePluginZ.ImImagePluginZ.ImtImagePluginZ.IptcImagePluginZ.JpegImagePluginZ.Jpeg2KImagePluginZ.McIdasImagePluginZ.MicImagePluginZ.MpegImagePluginZ.MpoImagePluginZ.MspImagePluginZ.PalmImagePluginZ.PcdImagePluginZ.Pc
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):229
                                                                                                                                                                                    Entropy (8bit):4.935349120084603
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/Kqtez/QolsQjkWhY6f+uyxn23d6ZUArE6x:Cdez/QonY6zIi6x
                                                                                                                                                                                    MD5:145B65EE12AF3402FB057F255B538B79
                                                                                                                                                                                    SHA1:696D0C9F9466727603C9FA257979D97ECC86E355
                                                                                                                                                                                    SHA-256:9073BE862DABBE750FCF37504A645F7277041E7EBC5D6229EFD6BC3422D45E75
                                                                                                                                                                                    SHA-512:92D25C2F037D74AED3F7C758FBDE4C8BBC839C9A9D9BD46F09889948DF5D690788FB25A457C84B63C1C635640BFB2EE584F98A4331A8E5B5D7E5353D41556A27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.d,........................@...s....d.d.l.m.Z...e.....d.S.)......)...pilinfoN)...featuresr......r....r.....XC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/__main__.py..<module>....s........
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2580
                                                                                                                                                                                    Entropy (8bit):4.7500406426629596
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:vFgArZ6vqHrOAbIUG5EJrXuAWai5N8A+ux:vFgsKIRA5N8A+I
                                                                                                                                                                                    MD5:74E3F4B6BE97C9F2D651A0FBF5E4EDC2
                                                                                                                                                                                    SHA1:A1EB5BEF5A8FBD169D93E9487E7AF074F3B30D2E
                                                                                                                                                                                    SHA-256:2AE4B04605EB0FE69D29E288FD241BE9339E55E61401EE52C898EFF2A156DD60
                                                                                                                                                                                    SHA-512:6860F5C4FEF0D0079C61D3E88EC040601221E7B568AE05FBEC5D57526CC8CDB201BE69F960EE1403FFAE6E919505A96B3C345CAF217D8499F04E4281A4607CB8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.da........................@...s....d.Z.d.d.l.m.Z.m.Z...d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z%Binary input/output support routines......)...pack..unpack_fromc....................C...s....|.j.t.u.r.|.S.|.d...S.).Nr....)...__class__..int)...c..r.....WC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/_binary.py..i8....s......r....c....................C...s....t.|.d.@.f...S.).N.....)...bytes....ir....r....r......o8....s......r....c....................C........t.d.|.|...d...S.).z.. Converts a 2-bytes (16 bits) string to an unsigned integer... :param c: string containing bytes to convert. :param o: offset of bytes to convert in string. ..<Hr......r......r......or....r....r......i16le...........r....c....................C...r....).z.. Converts a 2-bytes (16 bits) string to a signed integer... :param c: string containing bytes to convert. :param o: o
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2116
                                                                                                                                                                                    Entropy (8bit):5.445934275465931
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:MSwvVVxX8YL3wP5m0vwmvrrVlDgfZV1hyGzC:MtHxXJL3irr/ERVvLzC
                                                                                                                                                                                    MD5:31587D665150D655F299DEA2F62DDA60
                                                                                                                                                                                    SHA1:61B0E49A484E8F57A6D98BD8F66CC72CF8D3BA99
                                                                                                                                                                                    SHA-256:6BA5A5D8DB033DB3B2D45C7330FEF342E92F800E995D12F26ED9425C0C24F9F1
                                                                                                                                                                                    SHA-512:F4AB713F9F1BD3625B12115307610F3B5C394DB247B323C8D95C35DC3FB0648DE5D06505E19CE84BEC85D4746491F355A505D3730C9AA8A199B1042D7A7AD4DA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.d.........................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...d.d.d...Z.d.S.)......)...annotationsN.....)...__version__F)...action..plural..deprecated..str..when..int | None..replacement..str | Noner....r......bool..return..Nonec....................C...s....|.r.d.n.d.}.|.d.u.r.d.}.n2|.t.t...d...d.....k.r$|...d.|...d...}.t.|.....|.d.k.r+d.}.n.|.d.k.r2d.}.n.d.|...d.t...d...}.t.|.....|.rI|.rId.}.t.|.....|.rRd.|...d...}.n.|.r^d.|...d.....d...}.n.d.}.t.j.|...d.|...d.|...|.....t.d.d.....d.S.).a..... Deprecations helper... :param deprecated: Name of thing to be deprecated.. :param when: Pillow major version to be removed in.. :param replacement: Name of replacement.. :param action: Instead of "replacement", give a custom call to action. e.g. "Upgrade to new thing".. :param plural: if the deprecated thing is plural, needing "are" instead of "is"... Usually of the form:.. "[deprecated] is deprecated and will be removed in Pillow [wh
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):686
                                                                                                                                                                                    Entropy (8bit):5.610620108094022
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:CmUvGBcYmcmfWO/dilNZy6ert2WRXF73xq63tHfXsYnhWE7IoDIfyt:8ywWO/wlNZyNhRXFVphWqX
                                                                                                                                                                                    MD5:41FE69B5F6E796FCBD4134261A1C2626
                                                                                                                                                                                    SHA1:824F3B119A8EC491981513A18F654125293C4D24
                                                                                                                                                                                    SHA-256:4EB052202D803E8C50FC2C4FBF9DF47A5305EB1FE27FA342B64F79F63EB814DA
                                                                                                                                                                                    SHA-512:95B56DE4ECCE4B76565B9523584CBE75F5B8BF244D91420BD83D4EAAAFB07CDF25935BDABE0B1BF64CB0A74FE11030BED7F0F24493BB0D9C054C607252C71650
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...z.e.e.d...r!e.j.j.Z.n.e.j.Z.W.n...e.y0......d.Z.Y.n.w.e.e.j...Z.e.d.k.rCe.d.d.d.d.....d.S.d.S.).z4 Find compiled module linking to Tcl / Tk libraries......N)..._tkinter.....)...deprecateZ.pypy_find_executablez.8.4z.Support for Tk/Tcl 8.4.....z%Please upgrade to Tk/Tcl 8.5 or newer)...action)...__doc__..sys..tkinterr....Z.tkZ._deprecater......hasattrZ.tklib_cffi..__file__Z.TKINTER_LIB..AttributeError..strZ.TkVersionZ.tk_version..r....r....._C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/_tkinter_finder.py..<module>....s&.........................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1017
                                                                                                                                                                                    Entropy (8bit):4.671276991409208
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:CoUhX9DkeZduL2n/MOU543Mf6IcvVXkJWlpA5oQG:CDzDZ7M2NO1S/dX3l0od
                                                                                                                                                                                    MD5:9D4D760E386913AD7830B6AF5DB059DC
                                                                                                                                                                                    SHA1:0CC2EE61817EEDB015F8E3CCFE6F187D0420E19C
                                                                                                                                                                                    SHA-256:FEF6E030EB01601D3D59D4F8D2F2ED95475CFB47C8320CA0C95B1B340D9AB6C6
                                                                                                                                                                                    SHA-512:E7BEA1AFC141AF39C4F2494A87C2595FC4DC1008339B8C2BAC8D248E547D436C037836FC78C68787A8A551F795ACDDF597C11E1374212BC2CDED9D90440C2C80
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.d.........................@...s6...d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d...Z.G.d.d...d...Z.d.S.)......N)...Pathc....................C...s....t.|.t.t.t.f...S...N)...isinstance..bytes..strr........f..r.....UC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/_util.py..is_path....s......r....c....................C...s....t.|...o.t.j...|...S.).zCChecks if an object is a string, and that it points to a directory.).r......os..path..isdirr....r....r....r......is_directory....s......r....c....................@...s....e.Z.d.Z.d.d...Z.d.d...Z.d.S.)...DeferredErrorc....................C...s....|.|._.d.S.r........ex)...selfr....r....r....r......__init__....s......z.DeferredError.__init__c....................C...s....|.j...r....r....).r......eltr....r....r......__getattr__....s......z.DeferredError.__getattr__N)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....).r......pathlibr....r....r....r....r....r....r....r......<module>..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):202
                                                                                                                                                                                    Entropy (8bit):4.976492164482279
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:y/K3WuletxbkCo1Kntt/lPle5jAuy2LqiE2J51X6rSkuDVWrzr9GMe8ITgM:y/KGqetGCownr++uyxn23d6ZUAr1i8It
                                                                                                                                                                                    MD5:D15146BAE76F9E6C50852939AEE510E9
                                                                                                                                                                                    SHA1:E8991DA4D4E0060F4D47227CDA207758898CF29B
                                                                                                                                                                                    SHA-256:53C70811D925807374B3440DAD2C170F0C7D16E62F734D068D74A7E48F127AC6
                                                                                                                                                                                    SHA-512:A3E2F4431ABC1F47F311E2D7FAF478277D81FCE7BB65C8B388C442829611345E346CB903632AB8B09BC14F63DDB964A76BBF51B8CD7787835BB647C2C55D1765
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.d4........................@...s....d.Z.d.S.).z.9.5.0N)...__version__..r....r.....XC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/_version.py..<module>....s......
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8802
                                                                                                                                                                                    Entropy (8bit):5.611343509782036
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:eKKSksSV9CXmXSbLO/ZqcSqxNmXrDSvDqPY1u5kK/iGs3yzcCtq:edsSV97XSXSZqcSqLe/Sv2PYQ5kKNs3L
                                                                                                                                                                                    MD5:69FCFD9FC77EC531371D781A3C18CB36
                                                                                                                                                                                    SHA1:E35893F4CB9ABB9F9AEE65A19FD0C2805D9A8E90
                                                                                                                                                                                    SHA-256:E2D009EA1F2161ACEE8A9DEDC0AEE518E11DF63CA63FDBAF5819D5C3008D5439
                                                                                                                                                                                    SHA-512:579EBAEE8B214E883CD55141CA2CEAD8173D6126894131523407128AB67EE37AA0A163805222853635DA21EB37A6A3F57E9988A15C3718A245050FEB9FDE6B84
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......5+.d.&.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d.d.d.d d!d"d#d$..Z.d%d&..Z.d'd(..Z.d)d*..Z.d+d,..Z.d-d...Z.d/d0..Z.d4d2d3..Z.d.S.)5.....N.....)...Image)...PIL._imagingZ.PILLOW_VERSION).z.PIL._tkinter_finderZ.tk_version)...PIL._imagingftZ.freetype2_version).z.PIL._imagingcmsZ.littlecms_version)...PIL._webpZ.webpdecoder_version)...pil..tkinter..freetype2..littlecms2..webpc....................C...s|...|.t.v.r.d.|.....}.t.|.....t.|...\.}.}.z.t.|.....W.d.S...t.y$......Y.d.S...t.y=..}...z.t...t.|.......W.Y.d.}.~.d.S.d.}.~.w.w.).z.. Checks if a module is available... :param feature: The module to check for.. :returns: ``True`` if available, ``False`` otherwise.. :raises ValueError: If the module is not defined in this version of Pillow.. z.Unknown module TFN)...modules..ValueError..__import__..ModuleNotFoundError..ImportError..warnings..warn..str)
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2145
                                                                                                                                                                                    Entropy (8bit):4.824787796839016
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:RqKCCopbkQRIPC4PKUERbUkT8Ui4KUPTbUvkCm1HaM69Et:RjCHRI64hEqkPiaPsvkCm1HaM69Et
                                                                                                                                                                                    MD5:021DBA4C7A4B29D423782244D3A144CB
                                                                                                                                                                                    SHA1:48E63ABC3B144E00687B3D0EE43E4C3CC5D5FBF5
                                                                                                                                                                                    SHA-256:4ECD872A828431CF4DE03B202184E624CFDE7232AC7B1C4986C2FACD1D2D9AE4
                                                                                                                                                                                    SHA-512:02B1DD134F6626DF4CFACBCE125B7A3D112F3B4B2AC70B9107EE4F0FB7481A233FB05C048A6E1B9DDB7FCCD06A910F86E91279A93C5653CF952A6E8C7A31A26A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:#..# The Python Imaging Library...# $Id$..#..# Binary input/output support routines...#..# Copyright (c) 1997-2003 by Secret Labs AB..# Copyright (c) 1995-2003 by Fredrik Lundh..# Copyright (c) 2012 by Brian Crowell..#..# See the README file for information on usage and redistribution...#......"""Binary input/output support routines."""......from struct import pack, unpack_from......def i8(c):.. return c if c.__class__ is int else c[0]......def o8(i):.. return bytes((i & 255,))......# Input, le = little endian, be = big endian..def i16le(c, o=0):.. """.. Converts a 2-bytes (16 bits) string to an unsigned integer..... :param c: string containing bytes to convert.. :param o: offset of bytes to convert in string.. """.. return unpack_from("<H", c, o)[0]......def si16le(c, o=0):.. """.. Converts a 2-bytes (16 bits) string to a signed integer..... :param c: string containing bytes to convert.. :param o: offset of bytes to convert in string.. """.. r
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2071
                                                                                                                                                                                    Entropy (8bit):4.589222340458015
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:1Rwg1cgFqz0R/vAcM7LyAzyilznQkfw3mDpLGlgByTyZ85CMCMrO0Z8N0jXQYzSa:Ph1c0EC/vAcMPhckUmwlg0rh9ys
                                                                                                                                                                                    MD5:1FF3429EB212EA16009031EDF66922D3
                                                                                                                                                                                    SHA1:A2C8CC2898598921F4E5B92F2F16AEEBA7C6B4B7
                                                                                                                                                                                    SHA-256:033BFA7B1CAA13F7D126C44DD85D79E6256D4622F02DD71CDE0020953D57AFC5
                                                                                                                                                                                    SHA-512:94F7C00E2EFFF78476C8ED564799191B61553BF47D29E3368662268279523950815EE0AA7624397D5E67533D69E8346C8DC0D1997C506D77FAC95939A3A0411B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from __future__ import annotations....import warnings....from . import __version__......def deprecate(.. deprecated: str,.. when: int | None,.. replacement: str | None = None,.. *,.. action: str | None = None,.. plural: bool = False,..) -> None:.. """.. Deprecations helper..... :param deprecated: Name of thing to be deprecated... :param when: Pillow major version to be removed in... :param replacement: Name of replacement... :param action: Instead of "replacement", give a custom call to action.. e.g. "Upgrade to new thing"... :param plural: if the deprecated thing is plural, needing "are" instead of "is"..... Usually of the form:.... "[deprecated] is deprecated and will be removed in Pillow [when] (yyyy-mm-dd)... Use [replacement] instead.".... You can leave out the replacement sentence:.... "[deprecated] is deprecated and will be removed in Pillow [when] (yyyy-mm-dd)".... Or with another call to action:....
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2386432
                                                                                                                                                                                    Entropy (8bit):6.458806639765433
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:49152:poPTLlqtAyK7DhgHpHtxqqmLrLrLrLK2QF86:GsK7Du1
                                                                                                                                                                                    MD5:66DFB3FC790A5C300BBFF1BA50B664F0
                                                                                                                                                                                    SHA1:B4C1FD1459E2B58A2EB04AE78D3CF17D1291EC60
                                                                                                                                                                                    SHA-256:A25E90A4EA75A77A21F1C25D456B20C1220EC453894A0FDE427AFD351F093696
                                                                                                                                                                                    SHA-512:D6181AB99036C9BBA57ED6EC666DAB89C184077740186EC0B0F02C0EA1210D0911EB7C10DD7C4AB8D128B49606311858DB871794BA0926A3030E527E977C0F63
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#d.5g..fg..fg..fn}.fw..f(y.ge..f(yufc..f(y.gi..f(y.go..f(y.gc..f.p.ge..f,}.g`..fg..fc..f.y.g...fg..f|..f.y.g-..f.y.gf..f.ywff..f.y.gf..fRichg..f........PE..d.....'d.........." ...".0...h......L.........................................$...........`.........................................@.".`.....".......$.......#...............$.l.....!.......................!.(...`.!.@............@...............................text............0.................. ..`.rdata.......@.......4..............@..@.data.........#..^....#.............@....pdata........#......`#.............@..@.rsrc.........$......R$.............@..@.reloc..l.....$......T$.............@..B........................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):256512
                                                                                                                                                                                    Entropy (8bit):6.27431486327295
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:0WPp77fBTec1HNY3AklPRI7Odh0wXLg9uP1+74/LgHmPr9qvZqhLanLTLzLfqeqv:0WB775TH7PQh0wXLg9uP1+74/LgHmPrO
                                                                                                                                                                                    MD5:4CFF38E4A1613D9E86D453A5D8D74BE6
                                                                                                                                                                                    SHA1:9C147F579ADCD0F12B71A55B966B0F074EBBBFC4
                                                                                                                                                                                    SHA-256:FDAF3833C1A97B69AFBAE5368700964127C9F851CDBE95F2EF464CFA04F9A4A4
                                                                                                                                                                                    SHA-512:E759C0B985FC76A9E9D399B408DAFEEAA068EB8B993DC96323F2500AAE90652DC90B1B2F91C9902FF46CC964CA8680C4435B84E0A31C9CA62C96761914C41F92
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rx..+..+..+...+..+...*..+...*..+...*..+...*..+!..*..+...*..+..+...+$..*...+$..*..+$..+..+$..*..+Rich..+........................PE..d.....'d.........." ..."..... ......\........................................ ............`.........................................py..h....y..................\....................?..............................`>..@...............p............................text............................... ..`.rdata..N...........................@..@.data....>.......8...z..............@....pdata..\........0..................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1715712
                                                                                                                                                                                    Entropy (8bit):6.766126807611171
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24576:avFvHnJD9hnKf7IT6Cscv78+yiMW2X2IUAZe/vkrrsaCWZy+1XxZZANNX2wl4N:atvHB206gv7dyiMA3HknsPWDk2k4
                                                                                                                                                                                    MD5:0324E8CB4617E1A9CCB78291D5E2776A
                                                                                                                                                                                    SHA1:C027A22A39CA595735F6C765ABA19DEFBC1DA369
                                                                                                                                                                                    SHA-256:FBF63B8A450B36B6315803737459D0842A672A65669A39DDDDAB443B4128A8ED
                                                                                                                                                                                    SHA-512:5F1600E514EF35CA47230650B82469181A706C864AEED2E5D481F118593FB6903F0D7F00D3594655D583D7FC22F800E4BF568BD92859C65ED20A1847DC757FA5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......................<................R............................X........................P.........Rich...........................PE..d.....'d.........." ...".....R...............................................p............`..........................................#..d...D$.......P.......`..@............`..........................................@............... ............................text...h........................... ..`.rdata...B.......D..................@..@.data........@.......(..............@....pdata..@....`.......>..............@..@_RDATA..0....@......................@..@.rsrc........P......................@..@.reloc.......`....... ..............@..B................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24064
                                                                                                                                                                                    Entropy (8bit):5.587195639192031
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:5wU5804Pp/4TsXwCrhBOa8j65XGmIgyJ+:5p80s4T/Crhs565Vt
                                                                                                                                                                                    MD5:FDF4B8E8A1B7B69A7B35B82103E3572B
                                                                                                                                                                                    SHA1:E7586001239D37396ED5291F6ED169A29F342DC1
                                                                                                                                                                                    SHA-256:7EC3047EE84DE49B32264F58E70D19E549BF07042FEDC9C7AC34740647D43FC1
                                                                                                                                                                                    SHA-512:DB227860926354E0DF51B00FFCE639EDD50A1680004D8B8486E961CEADF143D3A19BCA99E4B999F888416ACB371EBED8B4A8B4664B76EFD104C25CB0D284B7C9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<...<...<...D...<...@...<...D...<...@...<...@...<...@...<..(I...<...<...<..-@...<..-@...<..-@..<..-@...<..Rich.<..................PE..d.....'d.........." ...".4...,.......8....................................................`.........................................``..h....`..x...............P...............@....U...............................S..@............P..`............................text...X3.......4.................. ..`.rdata.. ....P.......8..............@..@.data........p.......P..............@....pdata..P............R..............@..@.rsrc................Z..............@..@.reloc..@............\..............@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):13312
                                                                                                                                                                                    Entropy (8bit):5.058822923477256
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:s+9Tf1MbDVmnZDhGmuvD2j1mhaD7YFcqgiR:VoDVmao57YbgiR
                                                                                                                                                                                    MD5:57A8FF7CA333A71F3CA3DCB1A4E67ECD
                                                                                                                                                                                    SHA1:9052EC54155B8EEBEE8AA0FC3A30BAC80962E31D
                                                                                                                                                                                    SHA-256:390A9881C0E0DEA97DE0023B503F048619FCD97BFC198BD3C6EC2E2C5C18CAD9
                                                                                                                                                                                    SHA-512:C12B72E4194BC22CB666DA52AE67307AE02EF524A6C3CAE77A7BFF0B6E5019CB7000E225197A19C6A9487A91D3F112C2C55EC9C51337FCAF836F575FD5153D6F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2E+.v$E.v$E.v$E..\..t$E.9XD.t$E.=\D.t$E.9X@.}$E.9XA.~$E.9XF.u$E..QD.u$E.v$D.[$E..XM.w$E..XE.w$E..X..w$E..XG.w$E.Richv$E.................PE..d.....'d.........." ..."..... ............................................................`..........................................:..l...l:..d....`.......P..L............p..H...@4...............................3..@............0..H............................text............................... ..`.rdata..p....0......................@..@.data...(....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..H....p.......2..............@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14848
                                                                                                                                                                                    Entropy (8bit):5.079910680000704
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:DiIAkktYe8JHhVo2fu1h8M1L1SZityQSstkPLInCQXtG/AdckgTTQm:D6cJHhVDuj8EIZk6sGPLYS/AZgT8m
                                                                                                                                                                                    MD5:B933B29AC15227F8B6851D30841C0FC5
                                                                                                                                                                                    SHA1:F2879198D18FEAC3EF3ABF836054C8F2D16D7925
                                                                                                                                                                                    SHA-256:E59553C74D4374752E536F41CC352B520C18FA4BF8F0B689262C93DB509FD5BF
                                                                                                                                                                                    SHA-512:0E117E12692DDDC86CE3E8E402F49E1379AEF74C8238ACED804A3146115F43F9D1CE445E69AF0FA2DC5CE75511B2DBAB8DFF68B25BE2F0FD215E74DF47BD8070
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bJ.?&+.l&+.l&+.l/S}l,+.liW.m$+.liW.m*+.liW.m.+.liW.m%+.l.^.m$+.lmS.m#+.l&+.l.+.l.W.m$+.l.W.m'+.l.W.l'+.l.W.m'+.lRich&+.l........................PE..d.....'d.........." ...".....$............................................................`..........................................<..d...t<.......p.......`..................<....5..............................P4..@............0...............................text............................... ..`.rdata..N....0......................@..@.data...(....P.......0..............@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc..<............8..............@..B................................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):691
                                                                                                                                                                                    Entropy (8bit):4.822168600321646
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:S1lNZycKOFRjr8l8cBk13cFxmiFHyFxmiF2dRsWbouygcXnvGrcQ/W9xmiFrm26T:SlNZyjqCl2Mf5yfkvouygx4Q/WHRmVuu
                                                                                                                                                                                    MD5:BD776E00A5CB9FAAF42AC17BA87B3DA4
                                                                                                                                                                                    SHA1:595308611BBE97C4B99591B9501ED4910B9D2B46
                                                                                                                                                                                    SHA-256:C9326F241351EB53290F35A62AEFF70BCE906ED3C8A9A709900DB72C63A58748
                                                                                                                                                                                    SHA-512:15F632424D378D21EC63E99591BA3ABD58E225EC97E53EFFA89E7C9B3C68E80735BFC22B1AC8AC54FC26043D66F80B8334A8090BEDC1AF212C36724CD1B7DA14
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:""" Find compiled module linking to Tcl / Tk libraries.."""..import sys..import tkinter..from tkinter import _tkinter as tk....from ._deprecate import deprecate....try:.. if hasattr(sys, "pypy_find_executable"):.. TKINTER_LIB = tk.tklib_cffi.__file__.. else:.. TKINTER_LIB = tk.__file__..except AttributeError:.. # _tkinter may be compiled directly into Python, in which case __file__ is.. # not available. load_tkinter_funcs will check the binary first in any case... TKINTER_LIB = None....tk_version = str(tkinter.TkVersion)..if tk_version == "8.4":.. deprecate(.. "Support for Tk/Tcl 8.4", 10, action="Please upgrade to Tk/Tcl 8.5 or newer".. )..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):388
                                                                                                                                                                                    Entropy (8bit):4.497225624490064
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:BVATA/uWxWwYJXMd2AVmj42DpWuWhjTuU1ATPRrvkv:BVA0/uWxWwRdndMpWfOgATPdkv
                                                                                                                                                                                    MD5:113C6F819B27D22FFDAAB16F60051E5D
                                                                                                                                                                                    SHA1:56411CDB5119098A9937D1819DDB9463936AF279
                                                                                                                                                                                    SHA-256:B17F218E3AF9A0239034B0A1C8533B94FE5968A2292126B849CD2FB9C96C47EE
                                                                                                                                                                                    SHA-512:977CF8BFC2C46DC4B10A3AB1C00D179E9261F55CA4C3CCA90070F44A36F014B4E376CF40E12B0C53FE4522F8D233026499DE67F76E20E886F75ECA0F3640DBBD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import os..from pathlib import Path......def is_path(f):.. return isinstance(f, (bytes, str, Path))......def is_directory(f):.. """Checks if an object is a string, and that it points to a directory.""".. return is_path(f) and os.path.isdir(f)......class DeferredError:.. def __init__(self, ex):.. self.ex = ex.... def __getattr__(self, elt):.. raise self.ex..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52
                                                                                                                                                                                    Entropy (8bit):4.397085150625374
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SZ1TAX8Lv0QhS:SZ1MsL0R
                                                                                                                                                                                    MD5:116D4FA15A02C87FFC0665975D4D2B41
                                                                                                                                                                                    SHA1:298EC1FC7230108BF03BD933BD814FEA2FA61CAF
                                                                                                                                                                                    SHA-256:11985B1A4844C4B631191307A34B16A66BDB4FF3395C01250FA6CC08663A3FF9
                                                                                                                                                                                    SHA-512:04F9DB976725430813B3F5C712F872A8BAE48DA0F68E4BC78A13DEC3CC32B783F5B3D7629252510D0F7C54DD240D45E325F96CD38C951EB011AB3ADF21591576
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Master version for Pillow..__version__ = "9.5.0"..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):530432
                                                                                                                                                                                    Entropy (8bit):6.579847192422614
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:Lwfj8PoAtpyT3bT9IMSFLrLrLrLWzxyOjD9i5qWJRG:L1oAfegFLrLrLrLWzcs9eqWJ
                                                                                                                                                                                    MD5:C0A2A9D24002BCB64602AEFAE20D50DF
                                                                                                                                                                                    SHA1:B51D305BDE85EC19A2042F35F6A25A1F6049E238
                                                                                                                                                                                    SHA-256:AB66A03F87D2D251A687ECB793AEA01CD6A127922972894B23AB9FFBA0889138
                                                                                                                                                                                    SHA-512:97634C5CC5DB8B579614907EC7D1161ACB2DF136A07C5904AA447B6F915FD0D15ACF5C0D0293A1A1BCBB293E76FBD8011C700C8307957AA54232FF51166D7A88
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.4...Z...Z...Z.......Z.D.[...Z.@.[...Z.D._...Z.D.^...Z.D.Y...Z..[...Z...[.X.Z..^.].Z..R...Z..Z...Z......Z..X...Z.Rich..Z.........................PE..d.....'d.........." ...".................................................................`.............................................\...<........p....... ...L...................V...............................U..@............................................text...x........................... ..`.rdata..$...........................@..@.data....2..........................@....pdata...L... ...N..................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9949
                                                                                                                                                                                    Entropy (8bit):4.716030003088541
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:BS/eZSanOBVSUKx27fnTdfSjnvMNuS1MC5ooEGp9hTCvbZG4eYm:BlZS3SsnTdfSY4S113p9hTClDU
                                                                                                                                                                                    MD5:F849DCBF6E55EEA352E6B2793D1FCAB7
                                                                                                                                                                                    SHA1:0C5A3442AD80E4B537FC1AEF2629C2D521BE23FE
                                                                                                                                                                                    SHA-256:D256AD97266ED08C64901AA19C6AA06E3AC0AC07ECCFCFCEF4E094838495C764
                                                                                                                                                                                    SHA-512:473571BEB65AA945EDC1B4B4ED6449D830E89519E886D770B59D6F8934422EE307D7BD61E7BC8F91B6E8B01AF246BE2D4BB89CB1A59C3FC4B4EF5582C0D21B00
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import collections..import os..import sys..import warnings....import PIL....from . import Image....modules = {.. "pil": ("PIL._imaging", "PILLOW_VERSION"),.. "tkinter": ("PIL._tkinter_finder", "tk_version"),.. "freetype2": ("PIL._imagingft", "freetype2_version"),.. "littlecms2": ("PIL._imagingcms", "littlecms_version"),.. "webp": ("PIL._webp", "webpdecoder_version"),..}......def check_module(feature):.. """.. Checks if a module is available..... :param feature: The module to check for... :returns: ``True`` if available, ``False`` otherwise... :raises ValueError: If the module is not defined in this version of Pillow... """.. if not (feature in modules):.. msg = f"Unknown module {feature}".. raise ValueError(msg).... module, ver = modules[feature].... try:.. __import__(module).. return True.. except ModuleNotFoundError:.. return False.. except ImportError as ex:.. warnings.warn(str(ex)).. re
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):98224
                                                                                                                                                                                    Entropy (8bit):6.452201564717313
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
                                                                                                                                                                                    MD5:F34EB034AA4A9735218686590CBA2E8B
                                                                                                                                                                                    SHA1:2BC20ACDCB201676B77A66FA7EC6B53FA2644713
                                                                                                                                                                                    SHA-256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
                                                                                                                                                                                    SHA-512:D27D5E65E8206BD7923CF2A3C4384FEC0FC59E8BC29E25F8C03D039F3741C01D1A8C82979D7B88C10B209DB31FBBEC23909E976B3EE593DC33481F0050A445AF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...%|.a.........." .........`......p................................................{....`A.........................................B..4....J...............p..X....X...'..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):65304
                                                                                                                                                                                    Entropy (8bit):6.190247079543149
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:y9wmuopcJpgVyR40axzEfpIwOnNM7Syx4LPxh:y9wmu4tAR40axzEfpIwOn6cxh
                                                                                                                                                                                    MD5:686262283BA69CCE7F3EABA7CDEB0372
                                                                                                                                                                                    SHA1:5B771E444EE97B246545AFFCDC8FA910C8F591EA
                                                                                                                                                                                    SHA-256:02EC5CD22543C0CA298C598B7E13949A4E8247CEC288D0BCA0A1269059B548EF
                                                                                                                                                                                    SHA-512:DCA7403CFE2BFE14CF51F747A893F49DB52D4D43691DBCCECAA83796351B6F7E644CF8E455A0B9C38C6C006F481D5C45D32AE789756250A2B29978E9FEB839D0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.A.r./.r./.r./.{..p./. ...p./. .*.y./. .+.z./. .,.q./....q./.9...p./.r...../..".s./../.s./....s./..-.s./.Richr./.........................PE..d......c.........." .....T..........`.....................................................`.........................................p...P.......d......................../...........v..T...........................pv..8............p...............................text...aR.......T.................. ..`.rdata...I...p...J...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):83736
                                                                                                                                                                                    Entropy (8bit):6.5948841503958775
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:FXOz78ZqjUyAsIi7W/5ED8335mjZm3xIwCVd7SyuEPxD:dOzwpyAFi7Wqg334jZm3xIwCVd1xD
                                                                                                                                                                                    MD5:56203038756826A0A683D5750EE04093
                                                                                                                                                                                    SHA1:93D5A07F49BDCC7EB8FBA458B2428FE4AFCC20D2
                                                                                                                                                                                    SHA-256:31C2F21ADF27CA77FA746C0FDA9C7D7734587AB123B95F2310725AAF4BF4FF3C
                                                                                                                                                                                    SHA-512:3DA5AE98511300694C9E91617C152805761D3DE567981B5AB3EF7CD3DBBA3521AAE0D49B1EB42123D241B5ED13E8637D5C5BC1B44B9EAA754657F30662159F3A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.>...m...m...m.{<m...m.v.l...m.lRm...m.v.l...m.v.l...m.v.l...mWv.l...m.{.l...m...m...mWv.l...mWv.l...mWvPm...mWv.l...mRich...m........................PE..d......c.........." .........\..............................................P............`......................................... ...H...h........0....... ..,......../...@......`...T...............................8............................................text.............................. ..`.rdata...=.......>..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181248
                                                                                                                                                                                    Entropy (8bit):6.191174351377468
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:fp5LZ3sgWSqjfy8dBbm/6WnUsHozssS7piSTLkKyS7TlSyQH:fptZ8gW9jrBbQnfIzLIiSTLLymlSy
                                                                                                                                                                                    MD5:6F1B90884343F717C5DC14F94EF5ACEA
                                                                                                                                                                                    SHA1:CCA1A4DCF7A32BF698E75D58C5F130FB3572E423
                                                                                                                                                                                    SHA-256:2093E7E4F5359B38F0819BDEF8314FDA332A1427F22E09AFC416E1EDD5910FE1
                                                                                                                                                                                    SHA-512:E2C673B75162D3432BAB497BAD3F5F15A9571910D25F1DFFB655755C74457AC78E5311BD5B38D29A91AEC4D3EF883AE5C062B9A3255B5800145EB997863A7D73
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.....C...C...C..NC...CI..B...C}. C...CI..B...CI..B...CI..B...C...B...C...B...C...C..C...B...C..HC...C...B...C.."C...C...B...CRich...C........PE..d...o.b.........." .........@...............................................0............`..........................................g..l...|g..................H............ .......M...............................M..8............................................text...H........................... ..`.rdata..............................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):123672
                                                                                                                                                                                    Entropy (8bit):6.045416582727718
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:HJEi92UxKtXwJuNVtgxfF9frIk0sjMRAdIwLPIrxx:pEdEaBgxfTfrIQIRAs
                                                                                                                                                                                    MD5:462FD515CA586048459B9D90A660CB93
                                                                                                                                                                                    SHA1:06089F5D5E2A6411A0D7B106D24D5203EB70EC60
                                                                                                                                                                                    SHA-256:BF017767AC650420487CA3225B3077445D24260BF1A33E75F7361B0C6D3E96B4
                                                                                                                                                                                    SHA-512:67851BDBF9BA007012B89C89B86FD430FCE24790466FEFBB54431A7C200884FC9EB2F90C36D57ACD300018F607630248F1A3ADDC2AA5F212458EB7A5C27054B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.....d...d...d.......d.^.e...d.^.a...d.^.`...d.^.g...d...e...d.G.`...d.G.e...d...e...d...e..d...i...d...d...d.....d...f...d.Rich..d.........PE..d......c.........." ................0Z..............................................B.....`..........................................P.......P..................D......../..............T...........................0...8...............H............................text............................... ..`.rdata...k.......l..................@..@.data...T>...p...8...\..............@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):252184
                                                                                                                                                                                    Entropy (8bit):6.558077381106031
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:IfIH+lmtrvD42UAYiHnd2TVymx76oO/x9qWMa3pLW1AQ4wQY2:pH++rv0AYiI4iuoOvDY2
                                                                                                                                                                                    MD5:709613D7D7BC30ABDAEE015C331664B6
                                                                                                                                                                                    SHA1:84278FD8ACC53C50B4E2FFA3F47B9DDAD7DD7A70
                                                                                                                                                                                    SHA-256:8600CAE4F34CC64C406198E19539D0D4F5A574FC60B32B8AA8F32FD64C981DA5
                                                                                                                                                                                    SHA-512:4EB48BBCDF7CD9EBB9909E5269D4663BF14906A282A1F1418CC7E137F2BE1C792019D78446D4D8BEA63024CBF01BEC14E28633D6E4EBBD85D7D074B948CAB211
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........79..VW..VW..VW.....VW..#V..VW..#R..VW..#S..VW..#T..VW.R#V..VW...V..VW..VV..VW.R#T..VW.R#Z..VW.R#W..VW.R#...VW.R#U..VW.Rich.VW.........................PE..d......c.........." .....r...:......|...............................................Y.....`..........................................U..P...`U...................'......./......<.......T...........................`...8............................................text....q.......r.................. ..`.rdata..<............v..............@..@.data....)...p...$...N..............@....pdata...'.......(...r..............@..@.rsrc...............................@..@.reloc..<...........................@..B........................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1066353
                                                                                                                                                                                    Entropy (8bit):5.671219011999444
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:wgYJu4KXWyBC6SJIEljA4a2YWh3dpVwx/fpEK+riUu+kPSLMNq:wgYJiVBsLa2VJVwx/fpEK+Du+k8MNq
                                                                                                                                                                                    MD5:6D02F71360E1E373743AB7B2A962FD59
                                                                                                                                                                                    SHA1:3F46FF5E0452CF247487ADC72B871AE91100AF3F
                                                                                                                                                                                    SHA-256:01325CCE27323FA5CE1CBDF9CBEC6BEA24DAE999D91165AB1125E5B953BEB694
                                                                                                                                                                                    SHA-512:62E268CCEC6CCEB56C1B16E74215BCF0C0A544235F0FC66F4F013ABFA5C92A9A6E9FADBBB28E9F5C86C5C8C5F58715D48E9416F527D33CB9BAC30F648140A519
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:PK..........!..8.q5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):278952
                                                                                                                                                                                    Entropy (8bit):6.049041164740881
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:QW1H/M8fRR0mNplkXCRrVADwYCuCigT/Q5MSRqNb7d86:QWN/TRLNLWCRrI55MWavdJ
                                                                                                                                                                                    MD5:8D0619BFE30DEADF6F21196F0F8D53D3
                                                                                                                                                                                    SHA1:E7ABD65A8CCAFEFF6CAF6A2FF98D27D24D87C9AD
                                                                                                                                                                                    SHA-256:B301535DCA491D9814EA28FAA320AC7A19D0F5D94237996FA0A3B5A936432514
                                                                                                                                                                                    SHA-512:5A88E4A06B98832AAA9BBB89E382F6C7E9B65C5ECBA48DE8F4FF1FA58BB06A74B9C2F6B2EC185C2A306CB0B5D68D0B28D74B323432A0B2953D8DFC29FED920D7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4
                                                                                                                                                                                    Entropy (8bit):1.5
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:Mn:M
                                                                                                                                                                                    MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                    SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                    SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                    SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:pip.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):197
                                                                                                                                                                                    Entropy (8bit):4.61968998873571
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                    MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                    SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                    SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                    SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11360
                                                                                                                                                                                    Entropy (8bit):4.426756947907149
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                    MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                    SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                    SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                    SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1532
                                                                                                                                                                                    Entropy (8bit):5.058591167088024
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                    MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                    SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                    SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                    SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5308
                                                                                                                                                                                    Entropy (8bit):5.12808207864762
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:DxEpqZink/QIHQIyzQIZQILuQIR8vtklGovxNx6FWHCbCcbGLrrg9BMMzVEQDjye:+JnkoBs/sqL+4TcbGLrrUiMzVEQDjyeh
                                                                                                                                                                                    MD5:4E5169613D93EC27EE0B3A0E80DB6640
                                                                                                                                                                                    SHA1:7D721C24EAD56B9CD623ED9B5E0811DE9A71B85B
                                                                                                                                                                                    SHA-256:855ED42CAAB9FBDCC6A95C098A02BC58C9035757D40129A9B715D8F7F4189624
                                                                                                                                                                                    SHA-512:14179FCA4596CBDF4201ED38E8C0866BCC67F334B880D2F0A447B283A7B7FB61F7FB75B0FDE98DD6918FF6C578FDC61654302595503062900EBBBD7CC98392F7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Metadata-Version: 2.1..Name: cryptography..Version: 41.0.1..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15240
                                                                                                                                                                                    Entropy (8bit):5.551089627538169
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:1XbU/ZfaigPOSJN5E6W1HepPNx6uvnpLEw:1rUxfzOPt9Ew
                                                                                                                                                                                    MD5:E37C1AB144452FDB2ED9F66C119AE9C0
                                                                                                                                                                                    SHA1:D4A3C94DF3FDCBE9EFF8011123537DB160F334A7
                                                                                                                                                                                    SHA-256:201644EED53B9AB5E903A8A9269D1E6F4EFF6B4F2B3CCA0248F5922311306B86
                                                                                                                                                                                    SHA-512:0F94409EF84CB2FAD2B4A45D0C42ED5A484444B4DE9870EB00D6C6A799167EB496B5A785520312BF0B9CE282030A959190F12B2ABA2642957B378B37FFBAE3B5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:cryptography-41.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-41.0.1.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-41.0.1.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-41.0.1.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-41.0.1.dist-info/METADATA,sha256=hV7ULKq5-9zGqVwJigK8WMkDV1fUASmptxXY9_QYliQ,5308..cryptography-41.0.1.dist-info/RECORD,,..cryptography-41.0.1.dist-info/WHEEL,sha256=AF8zPkSkcAhmODpLt1et9zmyR4I9Cg-zXEqffJFVfzk,100..cryptography-41.0.1.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=X4SPKBQ74QTjSR70oBCtcO9O5AR7x7Wa_9nHGNUbL2I,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/__about__.cpython-310.pyc,,..cryptography/__pycache__/__init__.cpython-310.pyc,,..cryptography/
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):100
                                                                                                                                                                                    Entropy (8bit):4.987885415836538
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:RtEeX7MWcSlVlhVMSgP+tkKc/SKQLn:RtBMwlVSZWKxDQLn
                                                                                                                                                                                    MD5:C20F485EC06558EB04B2EDCE8362FD4F
                                                                                                                                                                                    SHA1:D621F40B4522E88FD3E56EBEAA6332C7BDF40BED
                                                                                                                                                                                    SHA-256:005F333E44A4700866383A4BB757ADF739B247823D0A0FB35C4A9F7C91557F39
                                                                                                                                                                                    SHA-512:C701255A1793C5478F8B8FF7CBD86ADB4FE2320808C6A395461459B422D159312472519F01F337FD2801271D9732DB19F9F18E8BD4D0541C0F38387AF4A87F52
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.40.0).Root-Is-Purelib: false.Tag: cp37-abi3-win_amd64..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):13
                                                                                                                                                                                    Entropy (8bit):3.2389012566026314
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:cOv:Nv
                                                                                                                                                                                    MD5:E7274BD06FF93210298E7117D11EA631
                                                                                                                                                                                    SHA1:7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
                                                                                                                                                                                    SHA-256:28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
                                                                                                                                                                                    SHA-512:AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:cryptography.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2739
                                                                                                                                                                                    Entropy (8bit):4.783133177195051
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:znD1AWMQi+WQ2zDhXeFKgA3iEsted6MgCQTGqTZONOgR:jDPMQ129uFmgCkGKZv8
                                                                                                                                                                                    MD5:16025A45D4096B93FB5D17137D028160
                                                                                                                                                                                    SHA1:AA3248B6E8998AB29925A02BD0CBE8C135992716
                                                                                                                                                                                    SHA-256:7EC00E53C2FBD0AABF6713E817AF097B018526F74B7CD283B88B1D052B2B4D47
                                                                                                                                                                                    SHA-512:451564E4B93E04C22A695708EE4796764D0F28442DF2F7EE709AB1FE62FAAB9D03EBA810AC4C8DA6CECF0CEACB718F9D1BAA62179B48B8D27EBC77C511B3A5B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:__version__ = "5.1.3"..import os.import sys.from tkinter import Variable, StringVar, IntVar, DoubleVar, BooleanVar.from tkinter.constants import *.import tkinter.filedialog as filedialog..# import manager classes.from .windows.widgets.appearance_mode import AppearanceModeTracker.from .windows.widgets.font import FontManager.from .windows.widgets.scaling import ScalingTracker.from .windows.widgets.theme import ThemeManager.from .windows.widgets.core_rendering import DrawEngine..# import base widgets.from .windows.widgets.core_rendering import CTkCanvas.from .windows.widgets.core_widget_classes import CTkBaseClass..# import widgets.from .windows.widgets import CTkButton.from .windows.widgets import CTkCheckBox.from .windows.widgets import CTkComboBox.from .windows.widgets import CTkEntry.from .windows.widgets import CTkFrame.from .windows.widgets import CTkLabel.from .windows.widgets import CTkOptionMenu.from .windows.widgets import CTkProgressBar.from .windows.widgets import CTkRadioBut
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2909
                                                                                                                                                                                    Entropy (8bit):5.417342939259122
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:ry8Yan2wJpkLURmQ0pqxarmgiWRIaDSqipEZ82g/4ITeUHT5gE8p/aUGmPN:r6/QRmzpqxUPhSVE82gAseUzX2N
                                                                                                                                                                                    MD5:0DCC4E4A065ADC5C8BA88AD3857BF28F
                                                                                                                                                                                    SHA1:2F054E922E8D10B29D6112F4079B365206A766A2
                                                                                                                                                                                    SHA-256:7A2691DD3816130D1F43800DC16A2762165C859169875771E9485372BBAB4B27
                                                                                                                                                                                    SHA-512:7DEE054AFD28470F0A853DE13F47B28365B3690C86DF4845EBC3CD7D7501963B6ACF8E495F6D6840DB4E20FE15E722EA6A0F74DE6982DA63B973A63D07F41828
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.m'Z'..d.d.l.m(Z(..d.d.l.m)Z)..d.d.l*m+Z+..d.d.l*m,Z,..d.d.l*m-Z-..d.d l.m.Z...d.d!l/m0Z0..e.e.e.e.e.e1e.f.Z2d"e3f.d#d$..Z4d%e3f.d&d'..Z5d(e3f.d)d*..Z6d+e7f.d,d-..Z8d+e7f.d.d/..Z9d0d1..Z:d.S.)2z.5.1.3.....N)...Variable..StringVar..IntVar..DoubleVar..BooleanVar)...*.....)...AppearanceModeTracker)...FontManager)...ScalingTracker)...ThemeManager)...DrawEngine)...CTkCanvas)...CTkBaseClass)...CTkButton)...CTkCheckBox)...CTkComboBox)...CTkEntry)...CTkFrame)...CTkLabel)...CTkOptionMenu)...CTkProgressBar)...CTkRadioButton)...CTkScrollbar)...CTkSegmentedButton)...CTkSlider)...CTkSwitch)...CTkTabview)...CTkTextbox)...CTkScrollableFrame)...CTk)
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Apple Desktop Services Store
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6148
                                                                                                                                                                                    Entropy (8bit):0.6888931042627182
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:Q2ggpaOJTZ4OJTajdO3oz6ifn9mmNIlwO89EEX/HnXw6XUEK/XDXw6X:3fpFTZDToE3oz6ifnImm+fnV2V
                                                                                                                                                                                    MD5:A2FE3C1CC8F70B63D7B51111A5E45EAD
                                                                                                                                                                                    SHA1:450C18DF31657412B794688CB1CACE5DBF5E8EFA
                                                                                                                                                                                    SHA-256:57ADA387AF15BFF448242A05E4E35D2B757798B0802CB894C81B4DC4E473002F
                                                                                                                                                                                    SHA-512:90D6A5D667A4386DB834EDDFFB526218F1C10B9F56F020B52AAB3E31B5B7E0E51E86867760C7BAFC18DF9F3C52A76C63774A6EE915127C39296209C39A2A77B5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....Bud1.................................................................................sIlocblob...............................................................................................................................................................................................................................................................................................................................................................................................................................................f.o.n.t.sIlocblob.......A.................i.c.o.n.sIlocblob.........................i.c.o.n.sbwspblob....bplist00.............]ShowStatusBar[ShowToolbar[ShowTabView_..ContainerShowSidebar\WindowBounds[ShowSidebar...._..{{380, 96}, {1099, 800}}...#/;R_klmno......................................i.c.o.n.svSrnlong.........t.h.e.m.e.sIlocblob....................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:OpenType font data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3528
                                                                                                                                                                                    Entropy (8bit):5.5463381859994065
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:AhHW6DYnFFJFRFO7XPfWB8O8E09Li3kX6QpyotT6c43W:AhH/D2FrbQXPuCE09HScSW
                                                                                                                                                                                    MD5:5F1BFE2E716608D1394D7A444CBD0354
                                                                                                                                                                                    SHA1:20D061B3B742CFA31E5FBC862D34F557534EFDBF
                                                                                                                                                                                    SHA-256:FAD67E2B060C318B6C8646D087FBD3ADD938B6676243F14B0C52623179641274
                                                                                                                                                                                    SHA-512:57E4C2743FDB6D54B7736F88E267ADC1953508075E211A95539A31BF62AEF0DF67367EA9326D43118D69827D3376606705047BFF8092D1D6278D002594B68ABF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:OTTO........CFF ..&.........OS/2i.d........`cmap.J.I........head../........6hhea...........$hmtxYf.....d...dmaxp..P.........name.P.....`...Qpost........... .........a.._.<..........v......v...........................................................P................................1..............................XXXX.@. .Z.........,.........^... . .....".............y.......................K.........#.J.........!.`...........#......... .............y...........y...........y...........y...........y...........y...........y...........y.......................K.....................2.............R.........F.m.........B.............0.........@...........................................................................................................2.............RCustomTkinter_shapes_font.C.u.s.t.o.m.T.k.i.n.t.e.r._.s.h.a.p.e.s._.f.o.n.tRegular.R.e.g.u.l.a.rCustomTkinter_shapes_font Regular.C.u.s.t.o.m.T.k.i.n.t.e.r._.s.h.a.p.e.s._.f.o.n.t. .R.e.g.u.l.a.rCustomTkinter_shapes_fontRegular.C.u.s.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:TrueType Font data, 18 tables, 1st "GDEF", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto MediumRegularVersion 2.137; 2017Roboto-Med
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):168644
                                                                                                                                                                                    Entropy (8bit):6.500433229170635
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:Fqmtn5wkex8r6Qym7KCkygAKuXylCC9ptSUXl8j/6afWZCyhASD/JwXI:425wklN7T3QtSUXz/2STyXI
                                                                                                                                                                                    MD5:B2D307DF606F23CB14E6483039E2B7FA
                                                                                                                                                                                    SHA1:FDDC8B1C688EF3BAED0D5A46ABF5F01F0EDAF02B
                                                                                                                                                                                    SHA-256:4AC8E03606FFA4C37F61A6510A2080F1F37A7054F4726C214887D3B23F72E369
                                                                                                                                                                                    SHA-512:2623C2A235720F389E0D8668DA01891B7A0D23A0FC3DB82865D8CB9BB730804EE84FCD863F33D28AAA236C1261714FF7C325FA677A4599356C29682D3571ACEE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........... GDEF.B.........bGPOS.nK.......e.GSUB..Y..}4....OS/2.....<...`cmap..Qm........cvt 1..K...H...\fpgm..$....8....gasp............glyf/......,...<hdmxd.t.........head...r......6hhea...........$hmtx..M........8loca..n........maxp.>.....h... name>.mR........post.m.d...t... prep...).......S...d...(.............o......9........................EX../... >Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^...............<......9.........EX../... >Y..EX../....>Y.....+X!...Y..../01.#.!.462...."&.~......J.JH.H......9KK97JJ....e...@.......%...EX../...">Y..../..../......./01..#.3..#.3..#...-#...w.}....}.....`...............EX../... >Y..EX../... >Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#5!.#5!.3.3.3.3.#.3.#.#.3.#...L.L...:...N.N.N.N..:..L.v.:....f....9....`...`....f.8.9...d.-.&...,...*-...9...EX../... >Y..EX../... >Y..EX.#/.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-RegularRob
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):168260
                                                                                                                                                                                    Entropy (8bit):6.486835016949693
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:Jy2goL/sAQRuzzlPrvRwhRFUzMWlYfxJVBxV+aYT3qPXI0eH4OuNOIOU7og2FnI:BOmCeu+bqPaHkWUMxFnI
                                                                                                                                                                                    MD5:F36638C2135B71E5A623DCA52B611173
                                                                                                                                                                                    SHA1:84D102488738B0EBBC7A5087973EFFBD54C95BD5
                                                                                                                                                                                    SHA-256:319CFF6E7A31F0F2A41C475DCA42890AA5D19FE16017E2290F8C1D4E14F76481
                                                                                                                                                                                    SHA-512:E9D55580EDDDE182CD9AB96057E129039154F54EFB0384613AA9513ED0D2D16EACCB5F6D77A299DE601ADDF0150DCDDE1FE98E31D047BBF85A66AC319C3280B5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........... GDEF.B.........bGPOS..........].GSUB..Y..{.....OS/2.......l...`cmap..Qm........cvt +......p...Tfpgmw.`....h....gasp.......x....glyf&......,...lhdmxUz`z........head.j.z.......6hhea.......H...$hmtx.r.........8loca.w.........maxp.>........ name6!a.........post.m.d...X... prep.f.....$...I...d...(.............q......9........................EX../....>Y..EX../....>Y......9......9......9......9..........9......9.......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^.......{.......0...EX../....>Y..EX../....>Y.....+X!...Y......901.#.3.462..."&.[....7l88l7......-==Z;;........#.........../......9../........01..#.3..#.3...o.....o...x...........w...............EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9|../......+X!...Y............../.....+X!...Y...............................01.!.#.#5!.!5!.3.!.3.3.#.3.#.#.!.!....P.P...E....R.R..R.R..E..P....E.....f....b....`...`.....f.#.b....n.0.....+.i...EX../....>Y..EX."/..".>Y.."...9..................+X!.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Apple Desktop Services Store
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6148
                                                                                                                                                                                    Entropy (8bit):0.3190422957527575
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:VWilXPQIIW7e4WNW3dDh+Sk1dfl/CuX86XkEslX/9ldlXSPnrtHP8//ktLERulXC:Qi/fHIBdNaO89EEX/HnXw6XAERqXw6X
                                                                                                                                                                                    MD5:0B5F6FF2993F88FB78902D1CCDD8BEB1
                                                                                                                                                                                    SHA1:B26C174A98E6564B0E60E2E99BC78E6490B5F42A
                                                                                                                                                                                    SHA-256:E53EFB2CA4FDE2219A3DC5DED422EC46EECC7A0547B6663B9AC9E16196AC6D25
                                                                                                                                                                                    SHA-512:D30900D33A2D7387BD115BC2C403C1A70F792579E320C0EE175BF64F68EA2F1C2872D65A8E803653151C94559D2D2CBAD5A0E683347F7D7A926015A6C0F94A06
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....Bud1.................................................................................o.m.T.k.i.n.............................................C.u.s.t.o.m.T.k.i.n.t.e.r._.i.c.o.n._.W.i.n.d.o.w.s...i.c.oIlocblob.......A............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):13238
                                                                                                                                                                                    Entropy (8bit):7.73062615393382
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:BZXOm6Hm+o9UHgbqweqnjwzVBwNb3bezsRnsE4k7GdfH+jCQoGl8xf+4wznvYvQP:Ph6HmvHeqj4ViPosRnsE94fo0hWPQ+
                                                                                                                                                                                    MD5:F6E65C6257AFECA83D565264A490029A
                                                                                                                                                                                    SHA1:B3613164E587D09C052C34CCDC4D44DAC4FF44E2
                                                                                                                                                                                    SHA-256:1234C017C871EB2E20D36F668F93E066CDCB93DB464D5CEF9D7A5BF83506D28C
                                                                                                                                                                                    SHA-512:4F9EBE74582F8DB18287292FD5350F20D52E0118F7AAF6848BF6EEC37C4A16069939F0F5716E934FE3D7AAB0E0A0B2BE34BF2AEE359426FF2AAE681B992D75C6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:............ ..3.......PNG........IHDR.............\r.f....orNT..w...3ZIDATx....T...{..e.../~..q.....1N.3..|A#a..vh...%.q..(....@.[u..]...B...F.K..hDQ\YE....z..{...[.V.Zz.....?U.M.[.......s...8._A....@Z...7.T...3.H..7X.=.u...rQ.x.l...+..o...D..:...rEW..2...+.R...;.)..xJ....3.OaS@.;..W...>.......9 .% ..@zI..y.0*;..^.....0.....)7.ct.q.....V5.@W;..5...x..0.p'...`BQ../..5...u>.......K.&..~..k.....#.FO..g.T....A.>.RI'H....*.L*<3F*i_(.v..e].....@..[.T.].&?..JQ...bo..JZE..VzF..4(.............."M.V`b...W...B.?...56_..k\.A>...*....].L].3h..h.P.Q...............8......<H.MtHK>..^.R.!.J.....W.>_*h.!..-.J;.Ke....@.\.&.e4.U.^.i..W..t .X...`.;.x.......H3..h....X...._(0......Q.F.....gPs..p.7...:.@9O..s8.h.0F...j4..w1.7...|...0|>.M.. x...)..`x.<......$..5..a0.V{,oU.VaJ..."e.i...L>.4..v./..~RY..7......k.s..*..r.....QY.o.Y...h.%....n[.r..O.y..~M7.j|..=FUZ..UA.w.....P.T..........JO)...S.[..Q_M.../..._.R.....Q/....w.&.Y..+........1....S.*..l)..p..Kp...W.....@
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4520
                                                                                                                                                                                    Entropy (8bit):4.887912500576038
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:KupscLUBH2cEyzmGvNu/XaNgdacg2u/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGgC:KupNUtMiPw/XXIRJ/v+Y51hT/vlggf+4
                                                                                                                                                                                    MD5:9DCFADAD1B80E97512819C057CCBC56C
                                                                                                                                                                                    SHA1:D1720FD7A06B0300A313D7CFD0BF040585CEBB8A
                                                                                                                                                                                    SHA-256:6BAA6D0D43B58C90FA40428D2CB9237E31D2C181F0F95A5A768A6C78B88331E7
                                                                                                                                                                                    SHA-512:B798F1AA183C89B138750799CA57ABB5F5F239ED2656B57AD78E5644E53105D445B78605A5ECF1EFFA8D66FEDF97A89732288F5DB775CFD2F12F527EC8892724
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{. "CTk": {. "fg_color": ["gray92", "gray14"]. },. "CTkToplevel": {. "fg_color": ["gray92", "gray14"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray86", "gray17"],. "top_fg_color": ["gray81", "gray20"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#3B8ED0", "#1F6AA5"],. "hover_color": ["#36719F", "#144870"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["#DCE4EE", "#DCE4EE"],. "text_color_disabled": ["gray74", "gray60"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray10", "#DCE4EE"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color":["gray10", "#DCE4EE"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckbox": {. "corner_radius": 6,. "bo
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4514
                                                                                                                                                                                    Entropy (8bit):4.856927419089279
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Kg6L6Xv7Lo2cE0mUNFRCdV2FiaVdXcEdVfvLpwiunacELTaUb4:K5uXoM0VzonWiaVd9Xvlp604
                                                                                                                                                                                    MD5:9BA1D0F5ACEBA472B50E993C5107A101
                                                                                                                                                                                    SHA1:2E852CF342735770A6AAFCD5C39848133F63ED72
                                                                                                                                                                                    SHA-256:C008B3951C8E61A254029C1E7A9F23BAEA18F3A095E3B64CF99EE2FC0EC37233
                                                                                                                                                                                    SHA-512:EA7EC195C27D4DDD4F832D7CECD323FC5003FDD192B3AABCDC0E45C7DBF70419EF8419A0E61330ADA0B5D56DE242BDDF2E1313FCE41353057E8389BE485300D3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{. "CTk": {. "fg_color": ["gray95", "gray10"]. },. "CTkToplevel": {. "fg_color": ["gray95", "gray10"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray90", "gray13"],. "top_fg_color": ["gray85", "gray16"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#3a7ebf", "#1f538d"],. "hover_color": ["#325882", "#14375e"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["#DCE4EE", "#DCE4EE"],. "text_color_disabled": ["gray74", "gray60"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray14", "gray84"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color": ["gray14", "gray84"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckbox": {. "corner_radius": 6,. "bor
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4515
                                                                                                                                                                                    Entropy (8bit):4.877114268374594
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:KupscL34QyzmGvN1GNgdWg21WgKKuvQdVJFvLpwRun8Q+Gga1c4:KupN3FiPvDJmPKK1/vlfN+4
                                                                                                                                                                                    MD5:F9638A655454C5D0FC6A1CC6DC1C5ED5
                                                                                                                                                                                    SHA1:E31A6A20F3B169D7919224B27DED27C9DA410A05
                                                                                                                                                                                    SHA-256:FC280FC722BCD20842C0A9E32070AB285A19EEA3C903F8317B6040FDCE51982F
                                                                                                                                                                                    SHA-512:0F71BE1AFDC2F3691B5C9B34DFF385B5390128BD59AAC3E17FBD63EEF9C52F9D31524E31DF9921F913D2BB94BB8092EE9A748DB03FCEA03D19EDC0924A09E7E4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{. "CTk": {. "fg_color": ["gray92", "gray14"]. },. "CTkToplevel": {. "fg_color": ["gray92", "gray14"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray86", "gray17"],. "top_fg_color": ["gray81", "gray20"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#2CC985", "#2FA572"],. "hover_color": ["#0C955A", "#106A43"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["gray98", "#DCE4EE"],. "text_color_disabled": ["gray78", "gray68"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray10", "#DCE4EE"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color":["gray10", "#DCE4EE"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckbox": {. "corner_radius": 6,. "bor
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):107
                                                                                                                                                                                    Entropy (8bit):4.366846487824888
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:1LGxR73xG08s2oKBim4LGKVE6RKbIVQTRPEs:1LWjxiFxsLRVtKbIiJ
                                                                                                                                                                                    MD5:2C885BDEFAAC94EB10DD3402DFF878D5
                                                                                                                                                                                    SHA1:0177B07E7A8DD9C3D95AB94D50E1F4AD986013B0
                                                                                                                                                                                    SHA-256:792A28D31FF85E44A893F05A41BB4CF80B70311BB5CDAE8C3E177A61F5B3EAC2
                                                                                                                                                                                    SHA-512:D97906A6B6D7112FC9F854E41E29405254F19179255D84E3FD1B163284E1C0E26217123940DBD9390841C1894BB5D7B161598A2319084A8227E8259F0F23E087
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from .ctk_tk import CTk.from .ctk_toplevel import CTkToplevel.from .ctk_input_dialog import CTkInputDialog.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):336
                                                                                                                                                                                    Entropy (8bit):5.139769143165974
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/WI40eWkA3qSRi/m/8jBlFEOtKol/Q/Iyxn23d6ZUArsNNJPDkZ:CS0eWTOg8jBJK8/rI2JPDQ
                                                                                                                                                                                    MD5:6D58FF25B4D684D78FBD07A89B7C8568
                                                                                                                                                                                    SHA1:A2D9BD311F4243CF5A54E51A725C906292AD9CA3
                                                                                                                                                                                    SHA-256:D5AC3BD45E1A9EF3BF321B0AEE13DF53EDF899990A1EC38B800705E03FA4D24D
                                                                                                                                                                                    SHA-512:C9EC365BEAD7598AD850722E68785060F19B5ED813BF5F6D9E4F0DCE795CC837004396517386E6BEA002655BD9CCCAD6C584FEF18D6962F2A5F15639001D4BF6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdk........................@...s(...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...CTk)...CTkToplevel)...CTkInputDialogN).Z.ctk_tkr....Z.ctk_toplevelr....Z.ctk_input_dialogr......r....r.....jC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/__init__.py..<module>....s..........
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4052
                                                                                                                                                                                    Entropy (8bit):5.353513926128786
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:87Us6d1a7htBDcX8BSDlnil2ipOYLcqS3q77Hy8UJR:c5SJnitOpqTFUJR
                                                                                                                                                                                    MD5:F6BD8B660859A06DB837F2D04EA57E56
                                                                                                                                                                                    SHA1:96CA04C1B41036902AC522BB069DD2E914490006
                                                                                                                                                                                    SHA-256:2E372C7C1189255EB3005EAED61C8DA351FA7E31AFDFB72F7FF15D63576018BC
                                                                                                                                                                                    SHA-512:EC6DC2093ACBB2ED9A260E00680DB0AB50252B8345F87C6833F936392411D5C54299D9D1087D3B12C5CE63D5C6A451B1ED2EA61B942B6AD7D05D286662EA190B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...sd...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...Union..Tuple..Optional.....)...CTkLabel)...CTkEntry)...CTkButton)...ThemeManager)...CTkToplevelc........................s*...e.Z.d.Z.d.Z.....................d.d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.f...f.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)...CTkInputDialogz.. Dialog with extra window, message, entry widget, cancel and ok button.. For detailed information check out the documentation.. N..CTkDialog..fg_color..text_color..button_fg_color..button_hover_color..button_text_color..entry_fg_color..entry_border_color..entry_text_color..title..textc........................s....t...j.|.d.....|.d.u.r.t.j.d...d...n.|...|...|._.|.d.u.r#t.j.d...d...n.|...|
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10122
                                                                                                                                                                                    Entropy (8bit):5.391041619960797
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:bIl+Q92vdFZmu7Uq9szROoJz9U0wSjr+EGDkMN+mnk7zp8q+Qx/CLx63mwwb63B4:EVa5gBzVz4xFNWKq+4qVqAFPx
                                                                                                                                                                                    MD5:8E66EBE6AAC0EE8477571B3506146F59
                                                                                                                                                                                    SHA1:42074F93BE17D09BE791718C4B2C1542BD4688E0
                                                                                                                                                                                    SHA-256:75920203B4A5EF1C8B59761E5F7CE43CD1D7957D2D5B7C73EB0A9CBF74841E7B
                                                                                                                                                                                    SHA-512:49784E411180D0F1F5869F5F2140559F005F8765BE19A8E1D267DE8CD6EE522702BC09062C8A792C0959D5A97B20C79EFD49CC33742EB98BB91D55529FE6A78D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.<.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......N)...StrictVersion)...Union..Tuple..Optional.....)...ThemeManager)...CTkScalingBaseClass)...CTkAppearanceModeBaseClass)...pop_from_dict_by_set..check_kwargs_emptyc........................s....e.Z.d.Z.U.d.Z.h.d...Z.e.e.d.<.h.d...Z.e.e.d.<.d.Z.e.e.d.<.d.Z.e.e.d.<...dDd.e.e.e.e.e.e.f...f.....f...f.d.d...Z.d.d...Z.d.d...Z.dD..f.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z...f.d.d...Z...f.d.d...Z...f.d.d ..Z...f.d!d"..Z.dEd#e.d$e.f...f.d%d&..Z.dEd#e.d$e.f...f.d'd(..Z.dEd#e.d$e.f...f.d)d*..Z.dDd+e.f...f.d,d-..Z...f.d.d/..Z d0e.d1e!f...f.d2d3..Z"dE..f.d4d5..Z#dE..f.d6d7..Z$d8d9..Z%e&d:d;....Z'e&d<d=....Z(d>e.f...f.d?d@..Z)dAe.f...f.dBdC..Z*....Z+S.)F..CTkz|. Main app window with dark titlebar on Windows and macOS.. For detailed information check out the documentation.. >......baseN
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10341
                                                                                                                                                                                    Entropy (8bit):5.416202158692636
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:vIl+Q9sxLPzylrMyd6i12S5+ZF0RIeg62xgUIrGJtJ5QZk59JEXZ6yg/42yzLjnL:gVk2R6y+b0Y62cisE/42y/3heNJlbM
                                                                                                                                                                                    MD5:386B55E48566C1DE063BFB10ED64FDD1
                                                                                                                                                                                    SHA1:16885BC523B28D70F9934F25F7B75B8A0FDF5599
                                                                                                                                                                                    SHA-256:1D2CB73E500979136B417EECD1D92866B22CA0E4378E16B7AC9682DE02A836A7
                                                                                                                                                                                    SHA-512:24771DACE1457056ABFC105F6562A97289ADF96BD41DA149833E1EAE50AC35BBE5610B519A5AA3A2F586AAC0945F399DCC9FB875FD74F6F66B9F8D4AE08F7C48
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.9.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......N)...StrictVersion)...Union..Tuple..Optional.....)...ThemeManager)...CTkScalingBaseClass)...CTkAppearanceModeBaseClass)...pop_from_dict_by_set..check_kwargs_emptyc........................s....e.Z.d.Z.U.d.Z.h.d...Z.e.e.d.<.d.Z.e.e.d.<.d.Z.e.e.d.<.d.d...d.e.e.e.e.e.e.f...f.....f...f.d.d...Z.d.d...Z.d.d...Z.d>d.d...Z...f.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z.d>d.e.f...f.d.d...Z...f.d.d...Z...f.d.d ..Z.d?d!e.d"e.f...f.d#d$..Z.d?..f.d%d&..Z.d?..f.d'd(..Z...f.d)d*..Z.d+e.d,e.f...f.d-d...Z.d?..f.d/d0..Z.d1d2..Z e!d3d4....Z"e!d5d6....Z#d7e.f...f.d8d9..Z$..f.d:d;..Z%..f.d<d=..Z&....Z'S.)@..CTkToplevelz|. Toplevel window with dark titlebar on Windows and macOS.. For detailed information check out the documentation.. >....Z.menu..width..cursor..screenZ.borderwidthZ.takefocusZ.reliefZ.useZ.v
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5532
                                                                                                                                                                                    Entropy (8bit):4.397691671659192
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:gW7VJPJwJtJ8J4JBpJ0JGrIG08h1fJRVcewzV9zd7VGkp2G373ZQT8PxIW:pNSXWaRuaKu+2GrF1
                                                                                                                                                                                    MD5:2FFC792932F1C594894C7E9DEEAD13F2
                                                                                                                                                                                    SHA1:CFCD9D95F7875605BB8986D7A99F5FEF7EC8980D
                                                                                                                                                                                    SHA-256:25B3469B75A4B7E93A0875E65E67B75190667546BF3809C9630EBE27298909C5
                                                                                                                                                                                    SHA-512:F26022674DBF58498A9DA2A2104CB4600D7DC1662D583C6D6EE2A0730814F73A89862C044B745386D995024C4E2D2974CE3CF4992316E06CE44F098F1306EC6F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from typing import Union, Tuple, Optional..from .widgets import CTkLabel.from .widgets import CTkEntry.from .widgets import CTkButton.from .widgets.theme import ThemeManager.from .ctk_toplevel import CTkToplevel...class CTkInputDialog(CTkToplevel):. """. Dialog with extra window, message, entry widget, cancel and ok button.. For detailed information check out the documentation.. """.. def __init__(self,. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. text_color: Optional[Union[str, Tuple[str, str]]] = None,. button_fg_color: Optional[Union[str, Tuple[str, str]]] = None,. button_hover_color: Optional[Union[str, Tuple[str, str]]] = None,. button_text_color: Optional[Union[str, Tuple[str, str]]] = None,. entry_fg_color: Optional[Union[str, Tuple[str, str]]] = None,. entry_border_color: Optional[Union[str, Tuple[str, str]]] = None,. entry_
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15580
                                                                                                                                                                                    Entropy (8bit):4.599410844743333
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:7XLVUj1qjWHiivjnC1+x7d42wiUyKzlIrm+eWS4eB2/0OeNHgq2HgR88yAFJ9zTN:7ZGrCE4nkSgqQgRry0J9zTNhow
                                                                                                                                                                                    MD5:AF64D79CCFC48336844F626D4C79202F
                                                                                                                                                                                    SHA1:861072F247B068F9E07831C847A39DAB3DD95E42
                                                                                                                                                                                    SHA-256:C37DEE1A9BE3A9E5512A067A32ADA7323ACBE7711CB110C9F372F45E24110AC0
                                                                                                                                                                                    SHA-512:A057ED45F1D65857A897EC243BDD69B326CA4CEA26AA1031FCCC14240E902699CABC776A27A89596F60BCD70B4C610A9D42C8DED4BDF9D776B22C2AA48D083C5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.from distutils.version import StrictVersion as Version.import sys.import os.import platform.import ctypes.from typing import Union, Tuple, Optional..from .widgets.theme import ThemeManager.from .widgets.scaling import CTkScalingBaseClass.from .widgets.appearance_mode import CTkAppearanceModeBaseClass..from customtkinter.windows.widgets.utility.utility_functions import pop_from_dict_by_set, check_kwargs_empty...class CTk(tkinter.Tk, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. """. Main app window with dark titlebar on Windows and macOS.. For detailed information check out the documentation.. """.. _valid_tk_constructor_arguments: set = {"screenName", "baseName", "className", "useTk", "sync", "use"}.. _valid_tk_configure_arguments: set = {'bd', 'borderwidth', 'class', 'menu', 'relief', 'screen',. 'use', 'container', 'cursor', 'height',. 'highlightthickness', 'padx', '
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14727
                                                                                                                                                                                    Entropy (8bit):4.618743576463637
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:7XnYnUdADqlJuImivjnVx7d42wiB2/yekhXPQe2OnnHgqNHgRkybFJ3zTivJortv:7InP4lrR4PM/NgqtgRkyRJ3zTQJop
                                                                                                                                                                                    MD5:B53659F9C13265F95CEDD10D6F1B52E9
                                                                                                                                                                                    SHA1:C792D481CA4ECC30CE49FB70DF4A70A5422F5A67
                                                                                                                                                                                    SHA-256:D15599CE2663AF3BC9C678CB3A3D6920EA0421EE78A07FA5103AD30CAD002250
                                                                                                                                                                                    SHA-512:214E753F44BB163EE4747E0E3781DEC800092FAD43D3084D0498D0A4F67ECBAD7D085D9DC90588841B32AE28767355162D17027E406AB19E10EEEF00B827B951
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.from distutils.version import StrictVersion as Version.import sys.import os.import platform.import ctypes.from typing import Union, Tuple, Optional..from .widgets.theme import ThemeManager.from .widgets.scaling import CTkScalingBaseClass.from .widgets.appearance_mode import CTkAppearanceModeBaseClass..from customtkinter.windows.widgets.utility.utility_functions import pop_from_dict_by_set, check_kwargs_empty...class CTkToplevel(tkinter.Toplevel, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. """. Toplevel window with dark titlebar on Windows and macOS.. For detailed information check out the documentation.. """.. _valid_tk_toplevel_arguments: set = {"master", "bd", "borderwidth", "class", "container", "cursor", "height",. "highlightbackground", "highlightthickness", "menu", "relief",. "screen", "takefocus", "use", "visual", "width"}.. _deactivate_macos_window_header_mani
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):622
                                                                                                                                                                                    Entropy (8bit):4.588724608407315
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:1uL6A5fj54NjH6E51dRcwm/NRQLKqAk56ufiX/LRvxPIJA8:1ux2dPc7D0k0QTfIi8
                                                                                                                                                                                    MD5:0899CA62DE34AC843C6C088536E2FD1A
                                                                                                                                                                                    SHA1:34BB465EF3173868F397E1D7F6CF38095EE01700
                                                                                                                                                                                    SHA-256:0CDA213A917947601ED623F8C0DA6C0D890E9CC46256B70D77008F588C4D5862
                                                                                                                                                                                    SHA-512:7468BC0ABC32C562774AAFD1F03E4F75292063694D5B1DEF69705F781EFBFDD1D22B2A28AA861ED30BCDD2DB7308BFC5EAAD8A71ECDA9204803A4DDB9069C30E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from .ctk_button import CTkButton.from .ctk_checkbox import CTkCheckBox.from .ctk_combobox import CTkComboBox.from .ctk_entry import CTkEntry.from .ctk_frame import CTkFrame.from .ctk_label import CTkLabel.from .ctk_optionmenu import CTkOptionMenu.from .ctk_progressbar import CTkProgressBar.from .ctk_radiobutton import CTkRadioButton.from .ctk_scrollbar import CTkScrollbar.from .ctk_segmented_button import CTkSegmentedButton.from .ctk_slider import CTkSlider.from .ctk_switch import CTkSwitch.from .ctk_tabview import CTkTabview.from .ctk_textbox import CTkTextbox.from .ctk_scrollable_frame import CTkScrollableFrame.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):989
                                                                                                                                                                                    Entropy (8bit):5.371743825821769
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:gH2Wf8aTlqxxW/jHVmzlvCHISuKbhDalI7Dn67o:BW8elqxarmCHISuKtDqGDSo
                                                                                                                                                                                    MD5:0BB3EBFBD641B019E34F2DBDF91FC635
                                                                                                                                                                                    SHA1:D87E3FC9B236B8FBDC33DF81020F8430CD31CA18
                                                                                                                                                                                    SHA-256:32DFA951841DF7610BBB9D5D78DBA225953CF8AEEEEB16A6204FB85D734CAE43
                                                                                                                                                                                    SHA-512:0EA753654AA48803C7D3E0FAC440EFD7BF35940032E91CFD187F1A8616F627E890E4EFBAEC6810E309C0BCE6D719371CBC3DFF42E51DF5815F7AA398544D47C3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdn........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...CTkButton)...CTkCheckBox)...CTkComboBox)...CTkEntry)...CTkFrame)...CTkLabel)...CTkOptionMenu)...CTkProgressBar)...CTkRadioButton)...CTkScrollbar)...CTkSegmentedButton)...CTkSlider)...CTkSwitch)...CTkTabview)...CTkTextbox)...CTkScrollableFrameN) Z.ctk_buttonr....Z.ctk_checkboxr....Z.ctk_comboboxr....Z.ctk_entryr....Z.ctk_framer....Z.ctk_labelr....Z.ctk_optionmenur....Z.ctk_progressbarr....Z.ctk_radiobuttonr....Z.ctk_scrollbarr....Z.ctk_segmented_buttonr....Z.ctk_sliderr....Z.ctk_switchr....Z.ctk_tabviewr....Z.ctk_textboxr....Z.ctk_scrollable_framer......r....r.....rC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/__init__.py..<module>....s ...................................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14509
                                                                                                                                                                                    Entropy (8bit):5.356017338019303
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:JmL9LrBHoX8g4j5f4WTo80EeRBBwFpwiUbVEnD8gKHUFVS:JmL9m4j5f4WpeqFpwiUb4IHU7S
                                                                                                                                                                                    MD5:19BD99AB80BC4B34A0E165E0236B7AB4
                                                                                                                                                                                    SHA1:1FDE10B71E4B4EDBAEC43B511AA3B7436C265D69
                                                                                                                                                                                    SHA-256:DCFF54C53B65C3BE252224F50357CFA67961813F02BAA837BC2281CF1E0682AA
                                                                                                                                                                                    SHA-512:1F3771E17A80FFFE6CA00DA91857E2B911BD26652E64652BB041433D8BBC1798406E33DED9AC3B9FEDB85BB6E3C9F4158E79FE51D9C24E7B8B8AB8E4DA634F52
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.l.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFont)...CTkImagec................1.......s....e.Z.d.Z.U.d.Z.d.Z.e.e.d.<...............................................dZd.e.d.e.d.e.d.e.e...d.e.e...d.e.d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.e.f...f.....d.f...d.e.d.e.d.e.d.e.e.e.e.f.....d.e.e.j.d.f...d.e.e.d d.f...d!e.d"e.d#e.e.g.d.f...d.f...d$e.d%e.f0..f.d&d'..Z.d[d(e.e...f.d)d*..Z...f.d+d,..Z...f.d-d...Z.d\d.e.d.e.f...f.d/d0..Z.d1d2..Z.d3d4..Z...f.d5d6..Z.d]..f.d8d9..Z.d:d;..Z.d]..f.d<d=..Z.d>e.d?e.f...f.d@dA..Z.dBdC..Z.d[dDdE..Z d[dFdG..Z!dHdI..Z"d[dJdK..Z#dLdM..Z$d^d(e.d#e.dNe.e.e.f...f.dOdP..Z%d\d(e.dQe.f.dRdS..Z&dTdU..Z'dVdW..Z(d
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12350
                                                                                                                                                                                    Entropy (8bit):5.330003281289475
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:ITU8TzlOU3w6pKJ9888lM9D020ODRnRozwj7snwoDyRJPiogyW6:IPE888lMJ0wDRqzwf5o2bqogyW6
                                                                                                                                                                                    MD5:227229CDDFB97B94AA8011CF78AA46B1
                                                                                                                                                                                    SHA1:5F044B2B865D4A67D56CB51480E9476295FB0251
                                                                                                                                                                                    SHA-256:D2074B8F958BD2E6931D75C30AFC4DEC7A55639BFAAA0A2BD55439E3A104E5AF
                                                                                                                                                                                    SHA-512:767DD055A0F38CE1CD4E18B2AE343AF072BD1460EA1504EC1EED1DACFE625F6E149CA1A7FC34E4117CA27478F629A29FF6585F80F6D4102E824282FEF8E97179
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd:V.......................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFontc................1.......s....e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.d.d.d.d.d.f.d.e.d.e.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.e.j.d.f...d.e.d.e.d.e.e.g.d.f...d.f...d.e.e.e.f...d.e.e.e.f...d.e.e.j.d.f...f...f.d d!..Z.dRd"e.e...f.d#d$..Z...f.d%d&..Z.dSd.e.d.e.f...f.d'd(..Z.d)d*..Z...f.d+d,..Z.dT..f.d.d/..Z.dT..f.d0d1..Z.d2e.d3e.f...f.d4d5..Z.d6d7..Z.dUd8d9..Z.dUd:d;..Z.d<d=..Z.dUd>d?..Z.dTd@dA..Z.dTdBdC..Z d3e.e.e.f...f.dDdE..Z!dVd"e.d.e.dFe.e.e.f...f.dGdH..Z"dSd"e.dIe.f.dJdK..Z#dLdM..Z$dNdO..Z%dPdQ..Z&....Z'S.)W..CTkCheckB
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12051
                                                                                                                                                                                    Entropy (8bit):5.3289194335875205
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:97vVGTZXrWkWloROUG1Zs+A3Hup0/Xk9c9LExvAA3X2OBl4yS/gWYDI:97OZCJdWQp0/b24eX2+l4r/LYDI
                                                                                                                                                                                    MD5:A80B77AC67ADBEA46B96F5E074FF19FA
                                                                                                                                                                                    SHA1:4AF37B4E95801BDAC9254787427DCCDD21E1BE90
                                                                                                                                                                                    SHA-256:7488EF8B099118092D112B55FC4651A93957885591BEBEC299294BDCE050604A
                                                                                                                                                                                    SHA-512:0F77AFBEF603DCDE1CBD43C6A4749F4A0FC6537E5C55B4E69FBAA1C3779C70F54FF5D2AABE95986681AA81184CE21CA496FB161CC8494A87D101471387721F8F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdvP.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..List..Optional.....)...DropdownMenu)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFontc................0.......s....e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.d.d.d.d.f.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e.e.....d.e.d.e.d.e.e.j.d.f...d.e.e.e.g.d.f...d.f...d.e.f...f.d.d ..Z.dQd!e.e...f.d"d#..Z.d$d%..Z...f.d&d'..Z.dRd.e.d.e.f...f.d(d)..Z.d*d+..Z...f.d,d-..Z.dS..f.d/d0..Z.d1d2..Z.dS..f.d3d4..Z.d5e.d6e.f...f.d7d8..Z.dTd:d;..Z.dTd<d=..Z.d>e.f.d?d@..Z.d>e.f.dAdB..Z d6e.f.dCdD..Z!dQdEd
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12075
                                                                                                                                                                                    Entropy (8bit):5.208525721776839
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:wb5MivPiot4WHzYMshf2suUwblKhmb92dLnInfn1anH9nrn9aenXndnfnKn8nFhr:WZ4p2suUVkb92dLnInfnonH9nrnlnXnx
                                                                                                                                                                                    MD5:8A0FA37C195FC1890C61393CA362F4E8
                                                                                                                                                                                    SHA1:1256B23D6B03F43FC0C0D6D7C56A52553DF8F827
                                                                                                                                                                                    SHA-256:C29BB38058153E06BF2E4E955DCCABEC230ACAC23A82C3D6B9E457D0A7A72791
                                                                                                                                                                                    SHA-512:86DD5C08E36EA8DC34D7EF719F3CF5A780BDFAE5D1A12948B42D074696E108ABEEE33D14D1A59DD164AE7D4959C385E739C86B0CB08481CC6FE0F6D45847F12C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.E.......................@...s|...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFont)...pop_from_dict_by_set..check_kwargs_emptyc........................sP...e.Z.d.Z.d.Z.d.Z.h.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.e.j.f.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.j.d.f...d.e.e.d.f...d.e.e.e.e.f.....d.e.f...f.d.d...Z.d_d.e.e...f.d.d...Z.d.d...Z.d.d...Z...f.d.d ..Z.d`..f.d!d"..Z.d#d$..Z...f.d%d&..Z.da..f.d(d)..Z.da..f.d*d+..Z.d,e.d-e.f...f.d.d/..Z.dbd1d2..Z.d`d3d4..Z.d5d6..Z.d7d8..Z.d_d9d:..Z d_d;d<..Z!d_d=d>..Z"d?d@..Z#dAdB..Z$dCdD..Z%dEdF..Z&dGdH..Z'dIdJ..Z(dKdL..Z)dMdN..Z*dOdP..Z+dQdR..Z,dSdT..Z-dUdV..Z.dWdX..Z/dYdZ..Z0d[d\..Z1d]d^..Z2....Z3S.)c..CTkEntryz.. Entry with rounded corners, border,
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5883
                                                                                                                                                                                    Entropy (8bit):5.392117008409428
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:BH9usx6oqXK5DYAJOMb8LEG6Yl+9JFq3GdDss+8GKPQqxqdWHjyM1hFP3cYzuj85:DxzxEAjb8L163JFEGdH7RPJo0zMtqAUB
                                                                                                                                                                                    MD5:7739EFB283A2A227282A7983BF9CBBC8
                                                                                                                                                                                    SHA1:A7D148261B998FCF3FBB550E236E48347D7E1918
                                                                                                                                                                                    SHA-256:4A2553AE4BDBEFCAE79B53B249A05CF90312C30342D872C2535B4192FFE251A8
                                                                                                                                                                                    SHA-512:FCB88F12B2D2179FE0851EB6457AF2D426D8EA0D733E395218B026BA8AFABAFADB731E57830EF2A943A50AD8D783C697A02BCDAC806D65357C10D544791A06FC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd&%.......................@...s\...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...Union..Tuple..List..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClassc........................sH...e.Z.d.Z.d.Z...................d%d.e.d.e.d.e.d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.e.f...f.....d.f...d.e.e.d.f...f...f.d.d...Z.d.e.e...f...f.d.d...Z...f.d.d...Z.d&..f.d.d...Z.d'..f.d.d...Z.d'..f.d.d...Z.d.e.d.e.f...f.d.d...Z.d(d!d"..Z.d&d#d$..Z.....Z.S.))..CTkFramez.. Frame with rounded corners and border.. Default foreground colors are set according to theme.. To make the frame transparent set fg_color=None.. For detailed information check out the documentation.. .....N..transparent..master..width..height..corner_radius..border_width..bg_color..fg_color..border_color..background_corner_colors."overwrite_preferred_drawing_methodc..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8310
                                                                                                                                                                                    Entropy (8bit):5.294890559644191
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Gy8bCQuJQ9Ix4Uo/YkyaRMlvpOtjW1zINeY/E3GvfLEadvELVHEHEPBbgfzaA93n:GyO8Wqf1cNeY/KyBExbS243y3qk5y9v
                                                                                                                                                                                    MD5:06183FE6AB86759995F7DFC7E5AF4247
                                                                                                                                                                                    SHA1:AFE6D89AE128F19161D8D98012E4C79F938127CF
                                                                                                                                                                                    SHA-256:2EB426080434755C9E860496A9F91E32CA41CCF3E6F39020CA3B97E5D1BAAF68
                                                                                                                                                                                    SHA-512:FC1A40E8EC8951030E8719903AC52532F71659DF889DD6ADDC7631AB77C46CE0D9AF03F171DF104D85F74DA2E8E57BB7C831DB2477BA93C5262652EDBA61A036
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdh/.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFont)...CTkImage)...pop_from_dict_by_set..check_kwargs_emptyc........................s....e.Z.d.Z.d.Z.h.d...Z.........................d=d.e.d.e.d.e.d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.e.d.f...d.e.d.e.d.e.f...f.d.d...Z...f.d.d...Z...f.d.d...Z.d>..f.d.d...Z.d.d...Z.d.d ..Z...f.d!d"..Z.d#d$..Z.d?..f.d&d'..Z.d?..f.d(d)..Z.d*e.d+e.f...f.d,d-..Z.d@d/e.d0e.d1e.f.d2d3..Z.d>d/e.d4e.e...f.d5d6..Z.d7d8..Z.d9d:..Z.d;d<..Z.....Z.S.)A..CTkLabelz.. Label with rounded corners. Default is fg_color=None (transparent fg_color).. For detailed information check out the documentation... state argument will probably be removed because it has
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11894
                                                                                                                                                                                    Entropy (8bit):5.3197873400566476
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:nIi18/OpKufluL17hNJG8885ouX9IxykhpT5VuZfmpjGq:nqOpKq074888akSuZfmpaq
                                                                                                                                                                                    MD5:79610FE4A846E258725C59A8839526AC
                                                                                                                                                                                    SHA1:70A08522C624684BF3E970718A0A0F46A5993F32
                                                                                                                                                                                    SHA-256:8D382C585C715B58602D155419FB14378844BB88BEFB112FE9E37ABC872C93F6
                                                                                                                                                                                    SHA-512:4C636FD1752091E422D2AF49888428326E225979D8BC728DD6B52EE6D5778539B2BC1D67FBB0589B542BE3901F58AD6BF3611BB3DCC480B22336759F6365ED37
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.L.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...DropdownMenu)...CTkFontc................-.......s....e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.d.d.d.d.f.d.e.d.e.d.e.d.e.e.e.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e...d.e.e.j.d.f...d.e.d.e.d.e.e.e.g.d.f...d.f...d.e.d.e.f,..f.d.d...Z.dTd e.e...f.d!d"..Z.d#d$..Z...f.d%d&..Z.dUd.e.d.e.f...f.d'd(..Z.d)d*..Z...f.d+d,..Z.dV..f.d.d/..Z.dV..f.d0d1..Z.d2e.d3e.f...f.d4d5..Z.d6d7..Z.dWd9d:..Z.dWd;d<..Z.d=d>..Z.d?e.f.d@dA..Z d?e.f.dBdC..Z!d3e.f.dDdE..Z"dWdFdG..Z#dXd e.d.e.dHe.e.e.f...f.dId
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8990
                                                                                                                                                                                    Entropy (8bit):5.303886856713865
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:G2a7cVO/8z+LYHNWxmgA/a5FvlVjsBYVpBaaAcfk1jAKEouT/hICd1C:G2a7cMdkLza7tVLjAN1jAKEonUo
                                                                                                                                                                                    MD5:B9E17823F06004FA1BBD2083FA8B0481
                                                                                                                                                                                    SHA1:7A3313FBF4F99AD96C08B4C063766ED6A5F6D004
                                                                                                                                                                                    SHA-256:7C5FF706F0F9741721FA5B026DFBD758B0A125C6C6D95B073EBB8EB989F16DC8
                                                                                                                                                                                    SHA-512:6BA6779F8B2ACBB92B267F1EF1A5C2785B3A6BDBE26EBFD8E65EB9045E2EFF0397EA48F30D26CE3036668C85C0E46C95A629F0091F88902AA34D8B491F9F52BD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd#7.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y+......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Optional..Callable)...Literal.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClassc........................s....e.Z.d.Z.d.Z...........................dDd.e.d.e.e...d.e.e...d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.j.d.f...d.e.d.e.d...d.e.d.e.f...f.d.d...Z...f.d.d...Z.dE..f.d.d...Z...f.d.d...Z.dF..f.d.d ..Z.dF..f.d!d"..Z.d#e.d$e.f...f.d%d&..Z.d'd(..Z.dFd)d*..Z.d$e.f.d+d,..Z.d-d...Z.d/d0..Z.d1d2..Z.d3d4..Z.dGd6e.d7e.d8e.e.e.f...f.d9d:..Z.dEd6e.d;e.f.d<d=..Z.d>d?..Z d@dA..Z!dBdC..Z"....Z#S.)H..CTkProgressBarz.. Progressbar with rounded corners, border, variable support,. indeterminate mode, vertical orientation.. For detailed information check out the documentation.. N..t
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11716
                                                                                                                                                                                    Entropy (8bit):5.323604114609769
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:bTFA0nL1lHPdTHjKJO888yU0PPcHzjADeclwTF9kjAbvUK/Zz:bj7HlHh888UAHLTIjAbMK/Zz
                                                                                                                                                                                    MD5:04BF9FFA81AC2C655FDBC38CEAB69314
                                                                                                                                                                                    SHA1:6A8E8D9517A3A71133DBBFEF192B1258C734242F
                                                                                                                                                                                    SHA-256:4C8DF8252301FE21F1868A2A3A483A5BE832A0F9DE25B5C48B9E21DDC2F48BBB
                                                                                                                                                                                    SHA-512:5A1B61143CD5379302E3C9156368111DAF41151136E1C902663DC4B24C4D6978A910224D174EAD50CC9964EA32B76A4C830F8182C8E312C7DBCF898EDA82F1CA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.N.......................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFontc................/.......sd...e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.d.d.f.d.e.d.e.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.e.j.d.f...d.e.e.j.d.f...d.e.e.e.f...d.e.d.e.d.e.e.d.f...f,..f.d.d...Z.dNd e.e...f.d!d"..Z...f.d#d$..Z.dOd.e.d.e.f...f.d%d&..Z.d'd(..Z...f.d)d*..Z.dP..f.d,d-..Z.dP..f.d.d/..Z.d0e.d1e.f...f.d2d3..Z.d4d5..Z.dQd6d7..Z.dQd8d9..Z.d:d;..Z.dQd<d=..Z.dPd>d?..Z.dPd@dA..Z dRd e.d.e.dBe.e.e.f...f.dCdD..Z!dOd e.dEe.f.dFdG..Z"dHdI..Z#dJdK..Z$dLdM..Z%....Z&S.)S..CTkRadioButtonz.. Radiobutton with rounded corners, border, label,
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10607
                                                                                                                                                                                    Entropy (8bit):5.2763769451929505
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Sss4QGSFJwgLqsJTqw2N19NkkWugJVOb9kC4YRe7jDVMZJ9xax5SMkrwm3ELaqY8:VQzbJ2w89owb9WYY7tyY8wm8ayioH
                                                                                                                                                                                    MD5:ED6BB7C3822245FF37E63DFC8EEDCB55
                                                                                                                                                                                    SHA1:83E1330556CDB246A90183EB55C7088911616FD6
                                                                                                                                                                                    SHA-256:166CB68032BA83B0FFCABC1A63D4FC220542829448CE57785F0302D12356B97B
                                                                                                                                                                                    SHA-512:6230C1732A1F89C5F1F9AF8E5CF2E965FF4F13EF85C1395596EB711BB6C99BF40942F1D61B7B84389D0DCEB92E32E70F2CF0FE13D5B6DC66E23A540859B72CFE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.;.......................@...s....d.d.l.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y!......d.d.l.m.Z...Y.n.w.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......)...Union..Tuple..Optional)...LiteralN.....)...CTkFrame)...CTkScrollbar)...CTkAppearanceModeBaseClass)...CTkScalingBaseClass)...CTkBaseClass)...CTkLabel)...CTkFont)...ThemeManagerc................$.......s....e.Z.d.Z.................................dLd.e.d.e.d.e.d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.d.e.d...f"d.d...Z.d.d...Z.d.d...Z...f.d.d ..Z...f.d!d"..Z.dMd#d$..Z.d%d&..Z.d'e.f.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.d@dA..Z.dBdC..Z dDdE..Z!dFdG..Z"dNdHdI..Z#dNdJdK..Z$....
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8685
                                                                                                                                                                                    Entropy (8bit):5.295437931655695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:aIG8/XOcCnruKJFzZCY888Bd2KJrHz1XvWs8n/nInwnOnxnAk7lvt:aIR1CnruK7Z3888RHles8n/InwnOnxnr
                                                                                                                                                                                    MD5:893ABC27FEDFCC29D9CB6027A7A31AEA
                                                                                                                                                                                    SHA1:90D6EB61FBE27140F871D700A09BEF63A757E1E5
                                                                                                                                                                                    SHA-256:A4A09F80F1690DBC9062F755C272890D12EEBD7F4D213F62E895C6EA3F580BED
                                                                                                                                                                                    SHA-512:6B5794220C55E57FC94654D81CC475EA535A2DA039BAB4DD771524EEB732F51CB6712A7714AF64EB1213783409D067C141F205211684833034EC2E217FA8A9EB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd 6.......................@...sd...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClassc........................s....e.Z.d.Z.d.Z.........................dAd.e.d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e...d.e.e...d.e.d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.d.f...d.e.f...f.d.d...Z.dBd.e.e...f.d.d...Z...f.d.d...Z.dC..f.d.d...Z.d.d...Z.dD..f.d d!..Z.dD..f.d"d#..Z.d$e.d%e.f...f.d&d'..Z.dEd)d*..Z.dEd+d,..Z.d-d...Z.dBd/d0..Z.d1e.d2e.f.d3d4..Z.d5d6..Z.dFd7d8..Z.dCd9d:..Z.d;d<..Z.d=d>..Z.d?d@..Z.....Z S.)G..CTkScrollbarz.. Scrollbar with rounded corners, configurable spacing.. Connect to scrollable widget by passing .set() method and set command attribute.. For detailed information check out the documentation.. N.......transparentT..vertical..master..width..heigh
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11898
                                                                                                                                                                                    Entropy (8bit):5.342407793632558
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:JDhfeYnBabRCgYo530cDwc0xnAzFD5iMHZoQLPFNPc7/DSORGUwlgpTWC:JDhVnyRL537DP0xnAzB5iM5xFNoDSGG4
                                                                                                                                                                                    MD5:983856709A3758C7E6295013652F1B0A
                                                                                                                                                                                    SHA1:23627B6045219182631CCF26CE56AD89019ADD93
                                                                                                                                                                                    SHA-256:4F065651687B631DE590A09E9A867B539EA352C16A9C6EABDDED1EDE042EA471
                                                                                                                                                                                    SHA-512:15B777444BFD244712BD210209F186A1A28D2CF4762E6FA3B2305240FFAF07D6A0BAB87CC2CF7ABEB8E96CE1BF1BAFC0D5AA471B8DDA8A57363148295CD589DE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.M.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y/......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..List..Dict..Callable..Optional)...Literal.....)...ThemeManager)...CTkFont)...CTkButton)...CTkFramec................*.......s....e.Z.d.Z.d.Z.......................................dOd.e.d.e.d.e.d.e.e...d.e.d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.e.f...f.....d.f...d.e.e.e.e.f.....d.e.e...d.e.e.j.d.f...d.e.d.e.e.e.g.d.f...d.f...d.e.f(..f.d.d...Z...f.d.d ..Z.dPd.e.d.e.f...f.d!d"..Z.d#d$..Z.d%e.f.d&d'..Z.d(e.f.d)d*..Z.d%e.f.d+d,..Z.d%e.f.d-d...Z.d(e.d%e.d/e.f.d0d1..Z.e.d.e.e...f.d2d3....Z.d4d5..Z.d6d7..Z...f.d8d9..Z d:e.d/e.f...f.d;d<..Z!dQd%e.d>e.d?e.f.d@dA..Z"d/e.f.dBdC..Z#d(e.d%e.f.dDdE..Z$dFe.d%e.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10883
                                                                                                                                                                                    Entropy (8bit):5.301526254765542
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:zlU2gOyvtTYZqrA1hi881yilZ7aOaccrnzVVsFae6gUp4C/39GfywF3sbJGCkYg9:zlU2iFY31g88p/7aOaPrnzVCae6gUp4t
                                                                                                                                                                                    MD5:EB1AB43A9D697E744113B2256FF8A93A
                                                                                                                                                                                    SHA1:475C4271287379625B8F51015F808534C76B615F
                                                                                                                                                                                    SHA-256:C5F5D413B2282D4E4A78519ADFBD294030D8AF51E60B026530B9E53528063403
                                                                                                                                                                                    SHA-512:522ACAC87F214D5261AA446F618287DFA352293279834A0926D90CC70D4B9BBB477A61EEC5D4F1AF8BA2A695EF389B3ED718AACC21C35E0339A808AB72543B6C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.G.......................@...sl...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClassc................+.......sX...e.Z.d.Z.d.Z.........................................dNd.e.d.e.e...d.e.e...d.e.e...d.e.e...d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.d.e.d.e.e.d.f...d.e.d.e.e.e.g.d.f...d.f...d.e.e.j.d.f...d.e.f*..f.d.d...Z.dOd e.e...f.d!d"..Z...f.d#d$..Z.dP..f.d%d&..Z...f.d'd(..Z.d)d*..Z.dQ..f.d,d-..Z.dQ..f.d.d/..Z.d0e.d1e.f...f.d2d3..Z.dOd4d5..Z.dRd6d7..Z.dRd8d9..Z.d1e.f.d:d;..Z.d1e.f.d<d=..Z.dQd>d?..Z.d@dA..Z.dSd e.d.e.dBe.e.e.f...f.dCdD..Z.dPd e.dEe.f.dFdG..Z dHdI..Z!dJdK..Z"dLdM..Z#....Z$S.)T..CTkSliderz.. Slider with rounded corners, border, number of steps, variable support, vertical orienta
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12664
                                                                                                                                                                                    Entropy (8bit):5.3232220015211515
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:XXOMy/8886HGje/dQxXnMpLvzCcIhS2NUR:XXSfHGje1Qx8pLvzCLS22R
                                                                                                                                                                                    MD5:04E2BB805323A26D6F6286438433682D
                                                                                                                                                                                    SHA1:3F0E0A717E387358E21D5F0A6EEC03619AC69BC7
                                                                                                                                                                                    SHA-256:94300EDF142CA8F3C1F09BF4E8FD58E70831316C530F492C659830D136052307
                                                                                                                                                                                    SHA-512:8E68CCD0758ABF0FA5603E907CFE1B9E554CB29DDE0A9D12032DBEAF754790D586A2DC1E6DA82436C840EE1E96F8CAE3B6635BF233CCB18777C60CE017E5C65B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdx[.......................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFontc................3.......s....e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.f.d.e.d.e.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.e.j.d.f...d.e.e.e.f...d.e.e.e.f...d e.e.j.d.f...d!e.d"e.e.d.f...d#e.f2..f.d$d%..Z.dVd&e.e...f.d'd(..Z...f.d)d*..Z.dWd.e.d.e.f...f.d+d,..Z.d-d...Z...f.d/d0..Z.d1d2..Z.dX..f.d4d5..Z.dX..f.d6d7..Z.d8e.d9e.f...f.d:d;..Z.dVd<d=..Z.dXd>d?..Z.dXd@dA..Z.d9e.e.e.f...f.dBdC..Z.dYdDdE..Z.dYdFdG..Z dHdI..Z!dZd&e.d"e.dJe.e.e.f...f.dKdL..Z"dWd&e.dMe.f.dNdO..Z#dPdQ..Z$dRdS..Z%dTdU.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11177
                                                                                                                                                                                    Entropy (8bit):5.301209677395891
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:01M7lhKA5IMOBLFOjz5Qx1U3qBj8YmAFBvd+:0a5IpVFOBg1U6BArAF5U
                                                                                                                                                                                    MD5:2EB15885DB978A5DEA05919BBC626EAF
                                                                                                                                                                                    SHA1:92D46255F3F6C6978657FBF674CC89C5CEC9615A
                                                                                                                                                                                    SHA-256:9BB22C14F8CCDD3B4F63D89FDF8897FD04EA6917A04525C49FA70FD1D84A9686
                                                                                                                                                                                    SHA-512:661A98FA94A075DC12B7DA79722243ACFE2FC0CAE2D053B899A800F3E69599E080EFCD2A9E911E0FB8181EA9DC8D89202736516F11E860924DE85569D7E27587
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd$E.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Dict..List..Callable..Optional.....)...ThemeManager)...CTkFrame)...CTkCanvas)...DrawEngine)...CTkBaseClass)...CTkSegmentedButtonc................$.......s....e.Z.d.Z.U.d.Z.d.Z.e.e.d.<.d.Z.e.e.d.<.d.Z.e.e.d.<.d.Z.e.e.d.<.................................dUd.e.d.e.d.e.d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.d.f...d.e.f"..f.d d!..Z.d"d#..Z.d$e.e...f...f.d%d&..Z...f.d'd(..Z.dV..f.d)d*..Z.d+d,..Z.d-e.f.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d-e.f.d6d7..Z.d8d9..Z.d$e.f.d:d;..Z.dWd=e.f...f.d>d?..Z dW..f.d@dA..Z!dBe.f...f.dCdD..Z"d-e.d$e.f.dEdF..Z#dGe.d-e.d$e.f.dHdI..Z$d-e.d$e.f.dJdK..Z%
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):17512
                                                                                                                                                                                    Entropy (8bit):5.129889606125713
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:YRphBmwLK7NZyz7KAtXD29w6Nqg1Om+cm:YRPBmwO7Nkz+ARENq++v
                                                                                                                                                                                    MD5:1100D5EAE1B8B24A41E2174C59B50A86
                                                                                                                                                                                    SHA1:07E31A4F1AD9E4DABA82A16C3EFCB4FDADE0C649
                                                                                                                                                                                    SHA-256:3B29EC4EF504D679C9FAC3312FEF45ECDC0625B0BC447592485ECECDF9DFA9D8
                                                                                                                                                                                    SHA-512:4CAEE3C30B7A9606CF5C955351F0C577862BD0584C93CD6A3E69E2B17447B8EE5DAD05B82F23437F4130FAD202585D12C303ED83C480FD6F3202A554C26D14A5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd._.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Optional..Callable.....)...CTkCanvas)...CTkScrollbar)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFont)...pop_from_dict_by_set..check_kwargs_emptyc........................sl...e.Z.d.Z.d.Z.d.Z.h.d...Z...........................d.d.e.d.e.d.e.d.e.e...d.e.e...d.e.d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.f...f.d.d...Z.d.d.d...Z.d.d.e.f.d.d...Z...f.d.d...Z.d...f.d d!..Z.d"d#..Z...f.d$d%..Z.d...f.d&d'..Z.d...f.d(d)..Z.d*e.d+e.f...f.d,d-..Z.d.d.e.d/e.d0e.e.e.f...f.d1d2..Z.d.d.e.d3e.f.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z.d.d<d=..Z.d.d>d?..Z d@dA..Z!dBdC..Z"d.dDdE..Z#dFdG..Z$d.dHdI..Z%dJdK..Z&dLdM..Z'dNdO..Z(dPdQ..Z)dRdS..Z*dTdU..Z+dVdW..Z,dXdY..Z-dZd[..Z.d.d\d]..Z/d^d_..Z0d`d
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):172
                                                                                                                                                                                    Entropy (8bit):4.237925918709482
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:1LEV/hGsEWdNKBuXEka2yDXTxEV/hG6URXRvEUkaOEoUJEkaOEoGMfqyGwn:1LBlWdYBu6DDxBtwEREsswn
                                                                                                                                                                                    MD5:C0058EFA13153B77549D7F3B4D2A6B39
                                                                                                                                                                                    SHA1:5AE6A50E71CC7F459DAF59C6897168DEC7F54346
                                                                                                                                                                                    SHA-256:7CA28AD1F5541C58AA992670D0664563418A809183B3C039397BD20440B7A928
                                                                                                                                                                                    SHA-512:830B5F2F886C92ACA4704307F2B363E6DE5061F6BAAAEBF4D997255D72D38FB9FD3FC0C719556EE5ECAAF55EA91FE3F3E872E413BE713DA6C6DCE804C823FC18
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from .appearance_mode_base_class import CTkAppearanceModeBaseClass.from .appearance_mode_tracker import AppearanceModeTracker..AppearanceModeTracker.init_appearance_mode().
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):401
                                                                                                                                                                                    Entropy (8bit):5.080024107576398
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/WI/8eCkAaLlIa/VErUEylWdXnw3jM8su6yxn23d6ZUArsNNJSSEhUtcDk+:CSeCTy/WrUaNaMM0I2JNEhrD3
                                                                                                                                                                                    MD5:DBE6123F4B4B7BD20F00FBE86A6660C5
                                                                                                                                                                                    SHA1:E4E9BF0B833213D4410E438BAAB245B7B1DECF22
                                                                                                                                                                                    SHA-256:4883A5671C6D20C2832F8E9F27E7E813E1E305633CAB801F6723F7011A62B6CC
                                                                                                                                                                                    SHA-512:445FA2E734357D7220CFD8234BD8FCA2BB97F75E3C10FF0C4FE648DFD60AADBE434DEEFCE882AA1A94FA6DCBF6FDE3BCBAA50A193A46458220D7B1A15BC3FA11
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...s$...d.d.l.m.Z...d.d.l.m.Z...e.......d.S.)......)...CTkAppearanceModeBaseClass)...AppearanceModeTrackerN).Z.appearance_mode_base_classr....Z.appearance_mode_trackerr....Z.init_appearance_mode..r....r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/appearance_mode/__init__.py..<module>....s..........
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3113
                                                                                                                                                                                    Entropy (8bit):5.215459808919251
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:hzMoU5Yvq985aDdDN59aed+p/spwYvWqpolqbR71T9fMm8gyjiKGIQzk:nvE8mtN59zW0WRl+nR2gyjiPIp
                                                                                                                                                                                    MD5:EF78C4F424F30C216F062D07394C25EF
                                                                                                                                                                                    SHA1:F150C42BACB4460D32EA58880A9891ED57C81513
                                                                                                                                                                                    SHA-256:0183C43E7EDBF2627AEEC1BE2B52CBFE1B823E8FEBCDC1F59C37CAA5B2C09648
                                                                                                                                                                                    SHA-512:A10C924A584356861161E3C3FBA715FF3DE1F7F0ED3D8B95A3240041B762AC760E04500ABE20808AF5AC478F2B2C8A96E1123C4CA345C678D8A21E57874DE9D4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd*........................@...s2...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.S.)......)...Union..Tuple..List.....)...AppearanceModeTrackerc....................@...s|...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.e.e.e.e.f...e.e...f...d.e.f.d.d...Z.e.d.d.e.d.e.f.d.d.....Z.d.S.)...CTkAppearanceModeBaseClassa..... Super-class that manages the appearance mode. Methods:.. - destroy() must be called when sub-class is destroyed. - _set_appearance_mode() abstractmethod, gets called when appearance mode changes, must be overridden. - _apply_appearance_mode() to convert tuple color.. c....................C...s....t...|.j.|.....t.....|._.d.S...N).r......add.._set_appearance_modeZ.get_mode.,_CTkAppearanceModeBaseClass__appearance_mode....self..r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/appearance_mode/appearance_mode_base_class.py..__init__....s........z#CTkAppearanceModeBaseClass.__i
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3692
                                                                                                                                                                                    Entropy (8bit):5.168436321099557
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/jOI9uI73QchZPhM84k7Ik8DIv3zDBjM3nE:/BuIjJ5M84sMD03xMnE
                                                                                                                                                                                    MD5:50508426A53E9DF087F1AC93F9499E7F
                                                                                                                                                                                    SHA1:8EEBACE6481042BD976096202BF7B13FB09693F1
                                                                                                                                                                                    SHA-256:950EDA6EAF809428963D19876CB85B1E7B3D3A61CD15DE307A82E421F414EF65
                                                                                                                                                                                    SHA-512:5ECD958364AF7EE2A1FFAC77625C7C706751C836FE80CF6C9286096D46C22E75F22232DF8108BEADECFEE22669220DF47446FB6BFA9380CC6303D946B91F3430
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.e.e.j...e.d...k.r0e.j...d.....e.j.d.k.r0e.....W.n...e.y?..Z...z.e...d.Z.[.w...e.yM......e.j...d.....Y.n.w.G.d.d...d...Z.d.S.)......N)...StrictVersion)...Callablez.0.3.1zWWARNING: You have to upgrade the darkdetect library: pip3 install --upgrade darkdetect...darwinzJcustomtkinter.appearance_mode_tracker warning: failed to import darkdetectc....................@...s....e.Z.d.Z.g.Z.g.Z.d.Z.d.Z.d.Z.d.Z.e.d.d.....Z.e.d.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.d.S.)...AppearanceModeTrackerF.......systemr....c....................C...s6...|.j.d.k.r.|.....}.|.|.j.k.r.|.|._.|.......d.S.d.S.d.S.).Nr....)...appearance_mode_set_by..detect_appearance_mode..appearance_mode..update_callbacks)...cls..new_appearance_mode..r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widg
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2602
                                                                                                                                                                                    Entropy (8bit):4.448769718641291
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:EVsVU5YvqcLRvhivqcJbwCJZwbgGUKAP3:hvnOrJ5Zw0
                                                                                                                                                                                    MD5:99F22B7548474E5476120CFE4154410C
                                                                                                                                                                                    SHA1:EBBA924D5585EA2A6D869331890FC939422BDABC
                                                                                                                                                                                    SHA-256:9D35C90B8BE9C23AE00A268EBF7576D3156FB64C4A47DA5527290892158A173F
                                                                                                                                                                                    SHA-512:8A5E7C54B92571BD0B7DA188822DE70547D9625557BB261C85F76F1438B597632CC1C1525AC247E7C364FF16CB568607B67D5D9BE587AFA3F33E3D8B003C2128
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from typing import Union, Tuple, List..from .appearance_mode_tracker import AppearanceModeTracker...class CTkAppearanceModeBaseClass:. """. Super-class that manages the appearance mode. Methods:.. - destroy() must be called when sub-class is destroyed. - _set_appearance_mode() abstractmethod, gets called when appearance mode changes, must be overridden. - _apply_appearance_mode() to convert tuple color.. """. def __init__(self):. AppearanceModeTracker.add(self._set_appearance_mode, self). self.__appearance_mode = AppearanceModeTracker.get_mode() # 0: "Light" 1: "Dark".. def destroy(self):. AppearanceModeTracker.remove(self._set_appearance_mode).. def _set_appearance_mode(self, mode_string: str):. """ can be overridden but super method must be called at the beginning """. if mode_string.lower() == "dark":. self.__appearance_mode = 1. elif mode_string.lower() == "light":. self.__appearance_mode =
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4097
                                                                                                                                                                                    Entropy (8bit):4.234256662609932
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:klPwnHYseYCf8WjLhFqE6vmGKt59XPnV8WjjIujEO235MjIR5tjIkc:k6nHvmVUEIna9/fjIujES86
                                                                                                                                                                                    MD5:F73BAA1DD90A746399B0D5F10D606F73
                                                                                                                                                                                    SHA1:59A51C07C7869FA3F492224F89DA6D3EBBA6ECD9
                                                                                                                                                                                    SHA-256:57BAFD80A1ACFEB55001C79A5EDDC5463F1661D8DF7A860BD737A5B79F0DB490
                                                                                                                                                                                    SHA-512:24CCD856C16EBE23B12F1CE506A9D571A2E87A6D7A6C0DF1D9F02451702C2BFF3C19CE41C647D13DDF165F7D2FE0C72C1398E922071CB80D0CD874E5B7E64741
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import sys.import tkinter.from distutils.version import StrictVersion as Version.from typing import Callable..try:. import darkdetect.. if Version(darkdetect.__version__) < Version("0.3.1"):. sys.stderr.write("WARNING: You have to upgrade the darkdetect library: pip3 install --upgrade darkdetect\n"). if sys.platform != "darwin":. exit().except ImportError as err:. raise err.except Exception:. sys.stderr.write("customtkinter.appearance_mode_tracker warning: failed to import darkdetect")...class AppearanceModeTracker:.. callback_list = []. app_list = []. update_loop_running = False. update_loop_interval = 30 # milliseconds.. appearance_mode_set_by = "system". appearance_mode = 0 # Light (standard).. @classmethod. def init_appearance_mode(cls):. if cls.appearance_mode_set_by == "system":. new_appearance_mode = cls.detect_appearance_mode().. if new_appearance_mode != cls.appearance_mode:.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                                    Entropy (8bit):4.667512219684699
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:kyBH3BBv2JQzFWbwd6v4eyKAvF9sUF6FK++MOxq5xnxMOxq+:kyZ3Pzcbwd6v4ejCGUAeTq5xxTq+
                                                                                                                                                                                    MD5:6E29C0BB8DA48237606D6163301FDB0B
                                                                                                                                                                                    SHA1:FA8DBE60E0E26A2BA080F3EB6F90A5D2F1A9FCEA
                                                                                                                                                                                    SHA-256:DB5D9635843DD3FE1863F401EB1D04FB10AAAA6517B167A034F43855E5D228ED
                                                                                                                                                                                    SHA-512:31654FAA84A5689A26D7F9FEA8A04E73FDF5613409FE42220726B5D490CB620C85388798DE53D62F901B6E19ACBDC543D085C6359EB814511238FE29922EF275
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import sys..from .ctk_canvas import CTkCanvas.from .draw_engine import DrawEngine..CTkCanvas.init_font_character_mapping()..# determine draw method based on current platform.if sys.platform == "darwin":. DrawEngine.preferred_drawing_method = "polygon_shapes".else:. DrawEngine.preferred_drawing_method = "font_shapes".
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):476
                                                                                                                                                                                    Entropy (8bit):5.278015574566511
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:CS82Z0XrfPaV/uznR7zNupnk9qQqAI2JN5cDv:/eXDSsR7zNupnoqQqADn58
                                                                                                                                                                                    MD5:AEA164924D4E57DEBC0A0CDAABA995D5
                                                                                                                                                                                    SHA1:B94A55055202ABB6E0EB9EBEF0A9DB97DC3DD3AE
                                                                                                                                                                                    SHA-256:624D6E5067C3918B4348E91BFB46170039FCFD9672B8F59A96E29BB0D5EA08A9
                                                                                                                                                                                    SHA-512:CA704C9E6E496367E27778F7E2599E42B59AE4257FE8DD8355F5EDEC707182548DEECA9D69B39AD3E1E1487D89D93D39BE181200B092C2A9326AB11AB3F53245
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdD........................@...sF...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.......e.j.d.k.r.d.e._.d.S.d.e._.d.S.)......N.....)...CTkCanvas)...DrawEngine..darwinZ.polygon_shapesZ.font_shapes)...sysZ.ctk_canvasr....Z.draw_enginer....Z.init_font_character_mapping..platformZ.preferred_drawing_method..r....r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/core_rendering/__init__.py..<module>....s..................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5067
                                                                                                                                                                                    Entropy (8bit):5.496797393428799
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:apbDE6dB3jkTzByTCI5XcanYHkaYHhv1f5FcjkP9HqhqhqsHUEjEP8uNnCt09y4K:i3dBjSK9BYHkrt5btPpPuNCt0p4OYjsY
                                                                                                                                                                                    MD5:3DA2C36F4DB43E478C544CC3859596CC
                                                                                                                                                                                    SHA1:AD3AB794A03BC4A9AD18C4CC26D12AD756D24793
                                                                                                                                                                                    SHA-256:5714BD6B1B32E372B4721A087AB8D082C3B170111DB50E13205BD9384A8F3F92
                                                                                                                                                                                    SHA-512:D72247BDF6FCD1347F9B064B0C3F086B1000BBEFDB63F76CB775D2386259D87BE0F707E3D6965DA073964C74483732209426AB95884FDBCD7561BF5642AB5F5F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...s6...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...G.d.d...d.e.j...Z.d.S.)......N)...Union..Tuplec........................s....e.Z.d.Z.U.d.Z.d.Z.e.e.d.<...f.d.d...Z.e.d.d.....Z.d.e.d.e.f.d.d...Z.d.d.d.e.j.f.d.e.d.e.d.e.d.e.d.e.d.e.e.e.e.d.f...f...d.e.d.e.f.d.d...Z...f.d.d...Z...f.d.d...Z.....Z.S.)...CTkCanvasa..... Canvas with additional functionality to draw antialiased circles on Windows/Linux... Call .init_font_character_mapping() at program start to load the correct character. dictionary according to the operating system. Characters (circle sizes) are optimised. to look best for rendering CustomTkinter shapes on the different operating systems... - .create_aa_circle() creates antialiased circle and returns int identifier.. - .coords() is modified to support the aa-circle shapes correctly like you would expect.. - .itemconfig() is also modified to support aa-cricle shapes... The aa-circles are created by choosing a character from th
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32373
                                                                                                                                                                                    Entropy (8bit):5.299031656090363
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:sZNFbY8T/Pn4z57sxa5ijq76lO+Vo/ES7t/Z7KtV29RYC7xQft9AV/FNtYb:cz/P8Tij8qS7RBaCVhy
                                                                                                                                                                                    MD5:2DFD6E4483B2125297C5D48EA750FF0B
                                                                                                                                                                                    SHA1:5F987D2865C7522BAF081DA76408C8709F3AF4A4
                                                                                                                                                                                    SHA-256:99F9CCE3884412AD87BB5E899D1E547EABA666966F7B97D84655AB2764A5E61A
                                                                                                                                                                                    SHA-512:89ECEA656A52F2FBC0BC5108697762F7FBF6C1256D5238F949080B103F1EA1FF3A622060D98BCDA9CEBE17031958886640A1D8FDBACF00AADDDEDE55804B5F16
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.c.......................@...sV...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...e.r"d.d.l.m.Z...G.d.d...d...Z.d.S.)......)...annotationsN)...Union..TYPE_CHECKING.....)...CTkCanvasc....................@...s....e.Z.d.Z.U.d.Z.d.Z.d.e.d.<.dRd.d...Z.dSdTd.d...Z.dUd.d...Z.dVd.d...Z...dWdXd.d...Z.dYd.d ..Z.dZd#d$..Z.dYd%d&..Z.d[d(d)..Z.d\d*d+..Z.d]d,d-..Z.d^d2d3..Z.d_d4d5..Z.d_d6d7..Z.d`d;d<..Z.dad=d>..Z.dad?d@..Z.dbdDdE..Z.dcdFdG..Z.dcdHdI..Z.dddLdM..Z.dedPdQ..Z.d.S.)f..DrawEnginea..... This is the core of the CustomTkinter library where all the drawing on the tkinter.Canvas happens.. A year of experimenting and trying out different drawing methods have led to the current state of this. class, and I don't think there's much I can do to make the rendering look better than this with the. limited capabilities the tkinter.Canvas offers... Functions:. - draw_rounded_rect_with_border(). - draw_rounded_rect_with_border_vertical_split(). - draw_rounded_pr
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5894
                                                                                                                                                                                    Entropy (8bit):4.513679204304723
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:E8dB3jkTzByTCI5XcaefSFcYnkqcxpAUpqRtJ6yX9OZFqEgKyGv:E2BjSK9Nb7oN25NDKyGv
                                                                                                                                                                                    MD5:ED6548CC15069DFE7AC5F12A36C46155
                                                                                                                                                                                    SHA1:C67ED2C78CC67674F1238187B5D5D5113B559BBF
                                                                                                                                                                                    SHA-256:B971D8A9D4E7B352C0A7619869DC810DC2ADE4FA4D50791AFFB978695D63AAA8
                                                                                                                                                                                    SHA-512:3503648EB81CB50B40F15671E92070645655E1EFBC97922DD3163CB6B6AEE990D9CDE02950D2D424004594EA697521234634F44B22141150F5CEBC116A9148F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.from typing import Union, Tuple...class CTkCanvas(tkinter.Canvas):. """. Canvas with additional functionality to draw antialiased circles on Windows/Linux... Call .init_font_character_mapping() at program start to load the correct character. dictionary according to the operating system. Characters (circle sizes) are optimised. to look best for rendering CustomTkinter shapes on the different operating systems... - .create_aa_circle() creates antialiased circle and returns int identifier.. - .coords() is modified to support the aa-circle shapes correctly like you would expect.. - .itemconfig() is also modified to support aa-cricle shapes... The aa-circles are created by choosing a character from the custom created and loaded. font 'CustomTkinter_shapes_font'. It contains circle shapes with different sizes filling. either the whole character space or just pert of it (characters A to R). Circles with a smaller. radius need a sma
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):91030
                                                                                                                                                                                    Entropy (8bit):4.3562559710133195
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:mtDeqviV56G1Q6cW+rflSKGz3y/PDcW+owW5wZeijbcW+o9koXiqS7uXW+W9diAx:msRw/PVvijNLJS7VbV5lmbgAbO/Pd
                                                                                                                                                                                    MD5:84D73BF36E7BF87252871310AB2D8333
                                                                                                                                                                                    SHA1:A2366E6155E30A422070BB28856A20E6833508DD
                                                                                                                                                                                    SHA-256:79E5E9B188820CEA94428E4FCF99C11C342A83DF5DAEDE100E33839AB75E7BCC
                                                                                                                                                                                    SHA-512:445CF4DC93E591FD009025F495FD85563A333846257B2DFD7A08F332C3AC01EC72519A33A16CFFF76CDE47811DA7833CD0A4469B0CD72774C3EA4DE577F644D2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from __future__ import annotations.import sys.import math.import tkinter.from typing import Union, TYPE_CHECKING..if TYPE_CHECKING:. from ..core_rendering import CTkCanvas...class DrawEngine:. """. This is the core of the CustomTkinter library where all the drawing on the tkinter.Canvas happens.. A year of experimenting and trying out different drawing methods have led to the current state of this. class, and I don't think there's much I can do to make the rendering look better than this with the. limited capabilities the tkinter.Canvas offers... Functions:. - draw_rounded_rect_with_border(). - draw_rounded_rect_with_border_vertical_split(). - draw_rounded_progress_bar_with_border(). - draw_rounded_slider_with_border_and_button(). - draw_rounded_scrollbar(). - draw_checkmark(). - draw_dropdown_arrow().. """.. preferred_drawing_method: str = None # 'polygon_shapes', 'font_shapes', 'circle_shapes'.. def __init__(self, canvas: CTk
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):81
                                                                                                                                                                                    Entropy (8bit):4.507706447404279
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:1LBVSf2oMRzFAo1GnFNKBoWDGn:1LB6Qzb1WYBoVn
                                                                                                                                                                                    MD5:E160B45B56AFCB988FCBCF17CD6BB509
                                                                                                                                                                                    SHA1:6ADE5F2E6DFD5B0A4A21548643809AB5871B1A99
                                                                                                                                                                                    SHA-256:0EC1B7CE8E21CC05267456EDDDA5E07A7D15B3463DFA9A7270A4C87EB1D360C0
                                                                                                                                                                                    SHA-512:BB6095274692CEF8D5B499FDDFDFB35B78FEE690618B1AF8A202E6C21F381E849578F2D8C6F6705F2D8A130940978D31387FF0E06019BA85D60EBC8D6DCB2744
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from .dropdown_menu import DropdownMenu.from .ctk_base_class import CTkBaseClass.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):328
                                                                                                                                                                                    Entropy (8bit):5.084775913254557
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/WIWGte5/QkAGlvlwSgBe78XWWrPuyxn23d6ZUArsNNJSSq3QD6g:CoGtehQTGFlwpBel5I2JNqAD6g
                                                                                                                                                                                    MD5:1B95B61ACD0082BCF59BE905DCD03857
                                                                                                                                                                                    SHA1:739016F0F6CE5FC589DBD5B8C862E00ECF07BB4C
                                                                                                                                                                                    SHA-256:ACC8307E2BFC524CBF1E5C2D39AD2F7C9AC7014DC83FA540B88E4F4B784928CB
                                                                                                                                                                                    SHA-512:E601DDCD8F26310CD947266865A3047958FC351977EFF690AC69FBDC26F7F6B6D663CDE58DE878A2E7F937A7FB4C9B3991155E3F84401262B6914078137ED405
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdQ........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...DropdownMenu)...CTkBaseClassN).Z.dropdown_menur....Z.ctk_base_classr......r....r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/core_widget_classes/__init__.py..<module>....s........
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12643
                                                                                                                                                                                    Entropy (8bit):5.408207029508598
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:YnvbKFWwQLf0E0BkSEfxc9nh6LamI0thoUsDiZe6o:YjKFWHqBaJonh6LHIgBo
                                                                                                                                                                                    MD5:D204EA467B56AF19104E11085ADD8186
                                                                                                                                                                                    SHA1:59A5687C06318FB8B2256C9A77DDFD1D56331ED6
                                                                                                                                                                                    SHA-256:8994FD7C8A0BAC3FE7EF767288DC85BE789A42BDD04EA8C6DEA64371084D64FA
                                                                                                                                                                                    SHA-512:6A1EDB79BA89D2948F39281CA40A3E0F5401DF5D1FB44CA8B172FA7E1666B0FDE38612A48BD39AE11D68FA38DC30765B59CDCF37952FFE531C356D9242D6AE8D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.=.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y3......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......N)...Union..Callable..Tuple)...TypedDict.....)...windows.....)...ThemeManager)...CTkFont)...CTkImage)...CTkAppearanceModeBaseClass)...CTkScalingBaseClass)...pop_from_dict_by_set..check_kwargs_emptyc........................s~...e.Z.d.Z.U.d.Z.d.h.Z.e.e.d.<.d.Z.e.e.d.<.......dAd.e.d.e.d.e.d.e.e.e.e.e.f...f...f...f.d.d...Z.d.d...Z.dBd.e.f.d.d...Z.d.d...Z.dB..f.d.d...Z.d.e.f...f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d ..Z.d!d"..Z.dCd$e.e.e.e.e.f...f...f.d%d&..Z...f.d'd(..Z...f.d)d*..Z.dD..f.d+d,..Z.dEd-d...Z.dDd/d0..Z.d1d2..Z.dEd3d4..Z...f.d5d6..Z...f.d7d8..Z ..f.d9d:..Z!..f.d;d<..Z"..f.d=d>..Z#..f.d?d@..Z$....Z%S.)F..CTkBaseClassz. Base class of every CTk widget, handles the dimensions, bg_color,. appearance_mode changes, sc
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6641
                                                                                                                                                                                    Entropy (8bit):5.338090545728303
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Fa4v+85SV5C816BdCqw5xFvQAevI3+0Z8h1ZA0:F/vl5SV5C8KBwVv7uzh1i0
                                                                                                                                                                                    MD5:C11E0AA6C51A48E5D240F3BDF8AC3A97
                                                                                                                                                                                    SHA1:59790C7CC0891A19EBD873426E9650BDDCB6A9CD
                                                                                                                                                                                    SHA-256:51D6F624EFD0C24E8782922251058E4371158B8054DBDD3B658754C9BE3942CA
                                                                                                                                                                                    SHA-512:8814437A097B9299FC3D596A01D531E737263B85DC7501112AAFAF09B6F74B08C4BC4796AD9EAE344D65EA7217D4E191CBE55877BC1E3E5C3E3DF92E2C7DDE27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdD!.......................@...sv...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......N)...Union..Tuple..Callable..List..Optional.....)...ThemeManager)...CTkFont)...CTkAppearanceModeBaseClass)...CTkScalingBaseClassc........................s>...e.Z.d.Z.d.d.d.d.d.d.d.d...d.e.d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.e.d.f...d.e.e.e.....f.d.d...Z.d.d...Z...f.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.d.e.e.e.f...d.e.e.e.f...f.d.d...Z...f.d.d...Z.d.e.d.e.f...f.d.d ..Z.e.d.e.f.d!d"....Z...f.d#d$..Z...f.d%d&..Z.....Z.S.)'..DropdownMenu.....N)...min_character_width..fg_color..hover_color..text_color..font..command..valuesr....r....r....r....r....r....r....c....................O...s....t.j.j.|.g.|...R.i.|.......t...|.....t.j.|.d.d.....|.|._.|.d.u.r't.j.d...d...n.|...|...|._.|.d.u.r8t.j.d...d...n.|...|...|._.|.d.u.rIt.j.d...d...n.|...|...|._.|.d.u.rVt...n.|...|...|._.t
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15788
                                                                                                                                                                                    Entropy (8bit):4.554041443013056
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:kojXQejXkFd3Pfo24r3c4XL9I0vbYy+t7DYFZjUqDWaqR:kGGuzA8I0sy+tIG7xR
                                                                                                                                                                                    MD5:6B9717A6AC3F538904B120B70E596CD9
                                                                                                                                                                                    SHA1:FAB8617D5C13D3979EB47DDC0EFDD1F39C772B92
                                                                                                                                                                                    SHA-256:45C9AB1D138144795124C8B2338460E9CD7E5A7118A7FBB7C8F736772B57E0F1
                                                                                                                                                                                    SHA-512:70D7E59104C4DAF552F071BD47D66EF3133D4C2918F804DA613D84AFC9F4E07538B80C3DF29886A762FE21DCBB5C42CCC12739AB572E07BEBB24E985082AD347
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import sys.import warnings.import tkinter.import tkinter.ttk as ttk.from typing import Union, Callable, Tuple..try:. from typing import TypedDict.except ImportError:. from typing_extensions import TypedDict..from .... import windows # import windows for isinstance checks..from ..theme import ThemeManager.from ..font import CTkFont.from ..image import CTkImage.from ..appearance_mode import CTkAppearanceModeBaseClass.from ..scaling import CTkScalingBaseClass..from ..utility import pop_from_dict_by_set, check_kwargs_empty...class CTkBaseClass(tkinter.Frame, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. """ Base class of every CTk widget, handles the dimensions, bg_color,. appearance_mode changes, scaling, bg changes of master if master is not a CTk widget """.. # attributes that are passed to and managed by the tkinter frame only:. _valid_tk_frame_attributes: set = {"cursor"}.. _cursor_manipulation_enabled: bool = True.. def __init__(self,.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8516
                                                                                                                                                                                    Entropy (8bit):4.417939578942002
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:E+l+JIJPJWAmA/YBG/0Js11j/auPsqk+peGGAZkQsrGGAb+r6KkkJN1LFOamIGln:EJ2NwY1jymfTMUpefPXUp0q
                                                                                                                                                                                    MD5:676B6D4A0B91C9820801B611825415AB
                                                                                                                                                                                    SHA1:60B0A7C33654A0B0C6862215998D5A345F49F8C9
                                                                                                                                                                                    SHA-256:742FD211693F5D06D7E3B3632C3CA1B0A87C60A3723C59DDA08231A809CE1911
                                                                                                                                                                                    SHA-512:60C2BBC958274FAD8A2C576AF879484A58D4F2C9FDC5EA8D90780A2E321C3AE37327DF1CDA669FFFE0249CBC52053265D22813EFB949BFD83F56167A7250CB16
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.from typing import Union, Tuple, Callable, List, Optional..from ..theme import ThemeManager.from ..font import CTkFont.from ..appearance_mode import CTkAppearanceModeBaseClass.from ..scaling import CTkScalingBaseClass...class DropdownMenu(tkinter.Menu, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. def __init__(self, *args,. min_character_width: int = 18,.. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. hover_color: Optional[Union[str, Tuple[str, str]]] = None,. text_color: Optional[Union[str, Tuple[str, str]]] = None,.. font: Optional[Union[tuple, CTkFont]] = None,. command: Union[Callable, None] = None,. values: Optional[List[str]] = None,. **kwargs):.. # call init methods of super classes. tkinter.Menu.__init__(self, *args, **kwargs). CTkAppearanceModeBaseClass.__init__(self). CTkScaling
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):27663
                                                                                                                                                                                    Entropy (8bit):4.386782780930411
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:ET8O2aN8RXqWVzOSmb5yGEHPAPLKS+4xU2Yo:ETOS+4xUi
                                                                                                                                                                                    MD5:2C9CEA4C3D1EEB63986F74D7C548DB36
                                                                                                                                                                                    SHA1:5C45CBCB7E57FF3EE58B05E49506067B1E6A6378
                                                                                                                                                                                    SHA-256:94ED73C9850E276B415DD3DC6FFD793E5216592E93B735A6839F42D9D45E2515
                                                                                                                                                                                    SHA-512:A84BF40D51F359F774B0D3C10C3043B741D9C145DDC9FC7ED1BCDA3B1B3F26779F8014EC43E9005B1D2A7CBE8ECEC9409E65D00DC2F8FE8DF8AA807959734436
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont.from .image import CTkImage...class CTkButton(CTkBaseClass):. """. Button with rounded corners, border, hover effect, image support, click command and textvariable.. For detailed information check out the documentation.. """.. _image_label_spacing: int = 6.. def __init__(self,. master: any,. width: int = 140,. height: int = 28,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,. border_spacing: int = 2,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. hover_color: Optional[Union[str,
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):22074
                                                                                                                                                                                    Entropy (8bit):4.342559407436691
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:EFp7IJwJIJkJZJPJIRJllCG/Ts73NmYAfzBzxcLB9FvVQYXS3g6qgw/90Bvv2ioL:EAO2aXN8DnMtzz4v/SGMl4nPlsBMQGm
                                                                                                                                                                                    MD5:7E3C22BB90587320A77A2444763B6865
                                                                                                                                                                                    SHA1:2715603B66EF39232BAD070626DE9EA71895CC39
                                                                                                                                                                                    SHA-256:5F491E892EA070F7635456F55A66C32AE37EC934B967DF0A970BF2EB37D1BDCF
                                                                                                                                                                                    SHA-512:E6D35C714223A48FF6BFDB34749ABE30C38538BE8860D672ECE112555BD4E4BBFCE4A7669E2A3F6F40BF5B0873458F9993A7F408357DD91A64EC72A83B00B462
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont...class CTkCheckBox(CTkBaseClass):. """. Checkbox with rounded corners, border, variable support and hover effect.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 100,. height: int = 24,. checkbox_width: int = 24,. checkbox_height: int = 24,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. hover_color: Optional[Union[str, Tuple[str, str]]] = None,.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20598
                                                                                                                                                                                    Entropy (8bit):4.371257409888585
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:ERpOaYXLEzN84ifOFqGOBijdWA3K1+TQWJ0:ERpOaYXLEzN8d11L
                                                                                                                                                                                    MD5:03F03C392CBECD0E743735E8DB23F455
                                                                                                                                                                                    SHA1:F3F3FB0DB22884FE7ED1CCA654143AF2F03EB746
                                                                                                                                                                                    SHA-256:15B2E6C8BD0D18F0DFCAA77DE0BA10102A428294C4040243ABE8246EE44AC4FF
                                                                                                                                                                                    SHA-512:D526AD7FAE010AE5146FD1C39AA6BBE6751B91D8E6EA87D6124A9E295AD626657B73A77E435269A6C98C0FF86CF3B3A54BB8AA27746FE2EB5A17B361B2FCBA86
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.import copy.from typing import Union, Tuple, Callable, List, Optional..from .core_widget_classes import DropdownMenu.from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont...class CTkComboBox(CTkBaseClass):. """. Combobox with dropdown menu, rounded corners, border, variable support.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 140,. height: int = 28,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Optional[Union[str, Tuple[str, str]]] = None,. button_color: Option
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):17893
                                                                                                                                                                                    Entropy (8bit):4.402295132612985
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:evK3yLYFJwJkJPJVJuFNbGf+OqPWbYhaScug8w8bjaBa4kRREJ8Tch/Nch02Eufr:GYJOaNDgFDsa4kyCUkOsymtaJQftyeT
                                                                                                                                                                                    MD5:0FA76A5EC38FD340E932FD88F8899E19
                                                                                                                                                                                    SHA1:1B2F4FC3A5927431553C64AB313BB129B1D7B1DF
                                                                                                                                                                                    SHA-256:CB2B5B1E3529304D9BBFB30233524F75DA31B69A0C5D6C73D6E44E2C1296331A
                                                                                                                                                                                    SHA-512:108BFA543402FBC2771C8CBEAD5C8F5B260743EA165AD5A9C6630B6E078B10AF8AFF6AFDBD50D641FEB2944AFCFBA96DB9F8C2A34F62A6184FD34D18217496B7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.from typing import Union, Tuple, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont.from .utility import pop_from_dict_by_set, check_kwargs_empty...class CTkEntry(CTkBaseClass):. """. Entry with rounded corners, border, textvariable support, focus and placeholder.. For detailed information check out the documentation.. """.. _minimum_x_padding = 6 # minimum padding between tkinter entry and frame border.. # attributes that are passed to and managed by the tkinter entry only:. _valid_tk_entry_attributes = {"exportselection", "insertborderwidth", "insertofftime",. "insertontime", "insertwidth", "justify", "selectborderwidth",. "show", "takefocus", "validate", "validatecommand", "xscrollcommand"}.. def __init__(self,. master: any,.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9510
                                                                                                                                                                                    Entropy (8bit):4.380953602148407
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:q3X7qJwJkJRhJ+0XcG6Fruqirx/xYEi8w8iS8aK8dygj8K8Pqr5sqS5Fd5+u5w8x:lOaRg09LKKyx0Y
                                                                                                                                                                                    MD5:C57AC5E5DE168E3153954D566935D5FC
                                                                                                                                                                                    SHA1:2FB7C3C5A040C759C3D017FA41DC84BD927548AE
                                                                                                                                                                                    SHA-256:A28BC63F0CD5AE940236AB240028774607A61B681D48082C2DF63E4D0106F868
                                                                                                                                                                                    SHA-512:CC904775A60989FCE6DAB7844980FD2FE04794436E4FFDA9A4F2A7E84B2AD46FD4226E33710157401F56F7D5801021318B64A8DFD3A544593C5CE2A07BF979B9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from typing import Union, Tuple, List, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass...class CTkFrame(CTkBaseClass):. """. Frame with rounded corners and border.. Default foreground colors are set according to theme.. To make the frame transparent set fg_color=None.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 200,. height: int = 200,. corner_radius: Optional[Union[int, str]] = None,. border_width: Optional[Union[int, str]] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Optional[Union[str, Tuple[str, str]]] = None,.. background_corner_colors: Union[Tuple[U
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12136
                                                                                                                                                                                    Entropy (8bit):4.367197887783026
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:60E/YaqNJwJPJJLcxGf8IYuWqeqMtErtDRufVirRK8PEx9nuwZfIS8K8vvH33fWg:tooONw4B/ZPyAWq3Sqc2wM
                                                                                                                                                                                    MD5:CD1C2EC3C98D9F04059B35097A854ECC
                                                                                                                                                                                    SHA1:1ED6B070B6DB479E20200AA2B6F33CCD246A8C83
                                                                                                                                                                                    SHA-256:E841983156ED06CDE6E603CD81F8B85EB1852B95338A3F7D9365F84D398A1925
                                                                                                                                                                                    SHA-512:CF785E651C67DC40D032C8A6C58E9A6777586B4C751B072793F881419111EEEC95C2BC60749E3575F8F1AD111D43AD47F0788725B3BF235010E55D50C6735822
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont.from .image import CTkImage.from .utility import pop_from_dict_by_set, check_kwargs_empty...class CTkLabel(CTkBaseClass):. """. Label with rounded corners. Default is fg_color=None (transparent fg_color).. For detailed information check out the documentation... state argument will probably be removed because it has no effect. """.. # attributes that are passed to and managed by the tkinter entry only:. _valid_tk_label_attributes = {"cursor", "justify", "padx", "pady",. "textvariable", "state", "takefocus", "underline"}.. def __init__(self,. master: any,. width: int = 0,. height: int = 28,. corner_radius: Optional[int] = No
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):19456
                                                                                                                                                                                    Entropy (8bit):4.37619608513597
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:okOYXN8LEzVc1pEUc0ChuA3HH+Tdexd46eQGm:okOYXN8LEzVLtHqU
                                                                                                                                                                                    MD5:ACAE83EB3F24E705D20BEF02D68F0CF8
                                                                                                                                                                                    SHA1:65BF6217C14950EFDF7CD3F9C10E3A43A2416141
                                                                                                                                                                                    SHA-256:3DDD89C0E42631DF6AFF948054F49E590A78EB66F69BFEC1B101E287452BCDCC
                                                                                                                                                                                    SHA-512:B675F97DA602B519A805925B4C83516E5B6D6AFE094093EC03B09901CBD4EF2A66434118AC1F7670C8CBFDC2656E0EB48062F6F02A4FFBC0F8BA32160FB795DA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import copy.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .core_widget_classes import DropdownMenu.from .font import CTkFont...class CTkOptionMenu(CTkBaseClass):. """. Optionmenu with rounded corners, dropdown menu, variable support, command.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 140,. height: int = 28,. corner_radius: Optional[Union[int]] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. button_color: Optional[Union[str, Tuple[str, str]]] = None,. button_hover_color: Optional[Union[str, Tuple[str, str]]] = None,.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14115
                                                                                                                                                                                    Entropy (8bit):4.2201127319626455
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:LVy7gJwJkJTJIHWzX8Zw0UKulDGcadYZ5NiN6VgZn3suWLqMKj8DK8KAe/lV8q8O:hOaZatJUEr3WKxo+uJtdNi2I3QR+
                                                                                                                                                                                    MD5:2B822F1F33A2121AEE3DF67466261B12
                                                                                                                                                                                    SHA1:7230903E521F1A23DC448A3963E49151EFCD52C8
                                                                                                                                                                                    SHA-256:0EF3C67E97960AEAF592ABC69F6D2C0C2AA681C05E7A7FE9503E51F5FBC7622E
                                                                                                                                                                                    SHA-512:C1F861AAE7ED2958C99F3B77F2FFF4E765DDF58ECDECD57E5458407FA25A77AE68E24FE9C6D010155F9BC5B43BB154A75AFD3B13A2984FCF2165828051AA26E6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import math.from typing import Union, Tuple, Optional, Callable.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass...class CTkProgressBar(CTkBaseClass):. """. Progressbar with rounded corners, border, variable support,. indeterminate mode, vertical orientation.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: Optional[int] = None,. height: Optional[int] = None,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Optional[Union
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20211
                                                                                                                                                                                    Entropy (8bit):4.364521189856133
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:EFm7sJwJIJkJPJIRJ34G/psZbYpyrRBhQchqGOvVQ8E8TS1P6VwC0BHv2AoedQ8I:EDO2aN83RGOEnHHjsNolW20qewQGm
                                                                                                                                                                                    MD5:B4FEB4B83C68101BA0E93408CD427462
                                                                                                                                                                                    SHA1:5AAF22F95A7B9C8AAE7CAE996D816E72288C89AB
                                                                                                                                                                                    SHA-256:54DB4F49669FE0FEF7DDB7FD14DA83A7D36F2B416030EEC983E86057232EDFF9
                                                                                                                                                                                    SHA-512:82BDE6BD5A3B856577C69C972ADD29A9E46B5D1189CA4316966BC285115A235E9F085FA40B05C2C3A915D993F373398ACB749DC6100AD55225BC627FF898A4CB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont...class CTkRadioButton(CTkBaseClass):. """. Radiobutton with rounded corners, border, label, variable support, command.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 100,. height: int = 22,. radiobutton_width: int = 22,. radiobutton_height: int = 22,. corner_radius: Optional[int] = None,. border_width_unchecked: Optional[int] = None,. border_width_checked: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15116
                                                                                                                                                                                    Entropy (8bit):4.560932084397119
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:/dOakxakYORkNkqgbZ4aOTxoNiTuOD9zKh:/dOakxakYaZpmq
                                                                                                                                                                                    MD5:4AD5FFE06DDAD41EB933DB8990795D53
                                                                                                                                                                                    SHA1:3B0666692EC5E1065484F6422E047D99CD092B1A
                                                                                                                                                                                    SHA-256:BD167E92A7A7D29D7FD8F740D92C2B5719D1D6BA00086DAD7185A8152116E43B
                                                                                                                                                                                    SHA-512:F1747B2B0EED8D8757B37064928CA9D12143EF9BF34C0555C9673717FEE9781E6BE78E6E905BC812B9553B3E1E66675BEE4E648E8C51027EBC2DC7F0DF7BF43D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from typing import Union, Tuple, Optional.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal.import tkinter.import sys..from .ctk_frame import CTkFrame.from .ctk_scrollbar import CTkScrollbar.from .appearance_mode import CTkAppearanceModeBaseClass.from .scaling import CTkScalingBaseClass.from .core_widget_classes import CTkBaseClass.from .ctk_label import CTkLabel.from .font import CTkFont.from .theme import ThemeManager...class CTkScrollableFrame(tkinter.Frame, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. def __init__(self,. master: any,. width: int = 200,. height: int = 200,. corner_radius: Optional[Union[int, str]] = None,. border_width: Optional[Union[int, str]] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Opti
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):13856
                                                                                                                                                                                    Entropy (8bit):4.368884054796356
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:kFfO47NdJwJuJtJMpXiRGMUxg2Y2QEr8w8ABr28DK8owkwGBibDDB+M8u8BvBxFZ:kNNOYXCp6IHXAuWtDLjh3Yw
                                                                                                                                                                                    MD5:83F92CE68C240053894C74EF2D4C5B59
                                                                                                                                                                                    SHA1:F52634DD2252642F1859DF2E9A8F7180140C4B2F
                                                                                                                                                                                    SHA-256:92AD12A65A8CEF8C6C06A5F5E76B3DFFBB7C6986029A394AA4727241089C600F
                                                                                                                                                                                    SHA-512:FEB75FD00E39CECE478D77BFE042AD2D8A11A4C54461AE5481DB50223CF6552C1E768D5EC11B8CFA472E2687CEB5DA26BF22367609543B246EFEB2AE514B2AE7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass...class CTkScrollbar(CTkBaseClass):. """. Scrollbar with rounded corners, configurable spacing.. Connect to scrollable widget by passing .set() method and set command attribute.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: Optional[Union[int, str]] = None,. height: Optional[Union[int, str]] = None,. corner_radius: Optional[int] = None,. border_spacing: Optional[int] = None,. minimum_pixel_length: int = 20,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. button_color: Optional[Union[str, Tu
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):19712
                                                                                                                                                                                    Entropy (8bit):4.422200952233737
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:4Ovgm1N8P5k7DGzJCzYBYX1yHMgYJEzwR:4Ovgm1N8PAOyOW1yH0v
                                                                                                                                                                                    MD5:0608AA71F7C0D88702060415359A29E4
                                                                                                                                                                                    SHA1:6F88BD8DA1738E89BC4D1DF54F3238A1F1305AF0
                                                                                                                                                                                    SHA-256:1E39596CFA08472C0BA89ABBA0D0715487FAAE1D4EC3D07D92D042F98FA4733C
                                                                                                                                                                                    SHA-512:F5C118ABBA968AFDF0F1859954DEE97CA26DCF3669B55C61279D2C92BE5C7E42DD34A9D21D7CD05774ADC5230311FF600FE4AF15EA125672F3C168D80539A002
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import copy.from typing import Union, Tuple, List, Dict, Callable, Optional.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal..from .theme import ThemeManager.from .font import CTkFont.from .ctk_button import CTkButton.from .ctk_frame import CTkFrame...class CTkSegmentedButton(CTkFrame):. """. Segmented button with corner radius, border width, variable support.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 140,. height: int = 28,. corner_radius: Optional[int] = None,. border_width: int = 3,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. selected_color: Optional[Union[str, Tuple[str, str]]] = None,. selected_hover_color: Optional[Union[str,
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):18308
                                                                                                                                                                                    Entropy (8bit):4.323410791193899
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:EFh7KJwJZJEJuJtJEI2X0iw1EGc1Jo1Fx152Y1XY1P1x1WcvQqMEfDBK8DK8c115:E+OjCYXKEnW+xnwNLBV8gWJGQujRo
                                                                                                                                                                                    MD5:8C74C3085C6DF7B7D414279DB39BE9F8
                                                                                                                                                                                    SHA1:65497FA74918AA227A0A5410856F6C73CBF0C34F
                                                                                                                                                                                    SHA-256:D7D96DE8711CA82935B96C1BCB78FAB81A6550EF6AD60DE04C6D4045B63735E6
                                                                                                                                                                                    SHA-512:C264253D66659DD611435D70DC6F8062140D2B371A88B60F93B54F04A69A9C9F67545C9ACF228D2D3F61E12B13A4A3850A6FD92730C0B719C96CAEE6BF7BDA85
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass...class CTkSlider(CTkBaseClass):. """. Slider with rounded corners, border, number of steps, variable support, vertical orientation.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: Optional[int] = None,. height: Optional[int] = None,. corner_radius: Optional[int] = None,. button_corner_radius: Optional[int] = None,. border_width: Optional[int] = None,. button_length: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Union[str, Tupl
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):23416
                                                                                                                                                                                    Entropy (8bit):4.2892154097672615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:EuOjCYXN84ciSBv7L1/1GllIni/MvWueQGm:EuOjCYXN8N1/1GlpU
                                                                                                                                                                                    MD5:A7D1C05E2E551C8AFE083C675BAFA5D8
                                                                                                                                                                                    SHA1:53A622DCB79119C34817F9E5C32FDA83E8E5D772
                                                                                                                                                                                    SHA-256:50FE57164ADB3E5B67E9E6372252A128B10CE49AAB230C964E5CE950E82A10AF
                                                                                                                                                                                    SHA-512:1FA868B4731428C343ADAFA36123703EE3AE948F3C5F68071F46C6D6625A87B2F941725A6125FA6427F00E6E593AFD7841CD02FCAFB4FB9F58C6B0B1E638CC8C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont...class CTkSwitch(CTkBaseClass):. """. Switch with rounded corners, border, label, command, variable support.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 100,. height: int = 24,. switch_width: int = 36,. switch_height: int = 18,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,. button_length: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Union[str, Tu
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):17700
                                                                                                                                                                                    Entropy (8bit):4.336974833536321
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ES8hcJwJkJrJfJwJ2JlJBJIRJXXcGuruqipYEAcMCIYunDKjR8EK8w23GKCyTp+q:fOaVR6Uz38zXH4t3e8pBC
                                                                                                                                                                                    MD5:66BE61C1AE0F854DE5D8AE0890A1EAAA
                                                                                                                                                                                    SHA1:13FE9C090160793AF59F85014ED7E57E3475F6B5
                                                                                                                                                                                    SHA-256:9F1AE7E68A319DD707196152EC4469C7E2BB3C46B8D7BD621A34BC707258CEC8
                                                                                                                                                                                    SHA-512:4AB5C4EB40A6478B4796A4ACB687A397B2804224C48B6EC43FE1A93F28501B8D3503170DEDB2E1875ED11DEACB6BD8DA199C0F83690723805DA39B434F72129C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.from typing import Union, Tuple, Dict, List, Callable, Optional..from .theme import ThemeManager.from .ctk_frame import CTkFrame.from .core_rendering import CTkCanvas.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .ctk_segmented_button import CTkSegmentedButton...class CTkTabview(CTkBaseClass):. """. Tabview.... For detailed information check out the documentation.. """.. _top_spacing: int = 10 # px on top of the buttons. _top_button_overhang: int = 8 # px. _button_height: int = 26. _segmented_button_border_width: int = 3.. def __init__(self,. master: any,. width: int = 300,. height: int = 250,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24566
                                                                                                                                                                                    Entropy (8bit):4.443682403341899
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:ScphOaNYyFIT0SI08+/H+NP3EEp4mFDTe3mVFIIhu6m4:frOaNYydqex35lta3mV2Ihuy
                                                                                                                                                                                    MD5:E296A878640A08951903328EE82AF3B6
                                                                                                                                                                                    SHA1:6878368DDF3222F23C220B3F3A3E9207FD8BCC41
                                                                                                                                                                                    SHA-256:FC39AB015BCF0B5C0BB815E961AE7289556E9285CC2492AC065CF5F9F8041C73
                                                                                                                                                                                    SHA-512:81AA47FFBE5F40B679967F860A8C51B64C71491565E675D9D9B4F5115915C4C844D27F8F41995CCAA7555CD68D6628015860A5BCC182B822EF00ADC5ECB20BEB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.from typing import Union, Tuple, Optional, Callable..from .core_rendering import CTkCanvas.from .ctk_scrollbar import CTkScrollbar.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont.from .utility import pop_from_dict_by_set, check_kwargs_empty...class CTkTextbox(CTkBaseClass):. """. Textbox with x and y scrollbars, rounded corners, and all text features of tkinter.Text widget.. Scrollbars only appear when they are needed. Text is wrapped on line end by default,. set wrap='none' to disable automatic line wrapping.. For detailed information check out the documentation... Detailed methods and parameters of the underlaying tkinter.Text widget can be found here:. https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html. (most of them are implemented here too). """.. _scrollbar_update_time = 200 # interval in ms, to check if scrollbars are needed..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1302
                                                                                                                                                                                    Entropy (8bit):4.72180420551579
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:ZWdFq6YCyGZga9i+a7c+azEWp+axbqKUddEZTF9y6h3iTqT:ZDgyGZga9ZizbWgeWlox90eT
                                                                                                                                                                                    MD5:1217381B00226D289C9087B60D89020B
                                                                                                                                                                                    SHA1:33B904549147621E3009DBA7F2D5FF4963D939AF
                                                                                                                                                                                    SHA-256:CD8952B091FEF2B2FBEEDEDD933D2F5CEA1F1E1F0D76222E3102B857C99F20D3
                                                                                                                                                                                    SHA-512:73C65C0BD0F2C1C2C21C8D04EB8D1DC7D4252B9D4D626373930DADCE9143063EC5082A7CB99D62B4A2EC25BAFBF4A05BE79375F134BFFD944C0F7EC4E10FF901
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import os.import sys..from .ctk_font import CTkFont.from .font_manager import FontManager..# import DrawEngine to set preferred_drawing_method if loading shapes font fails.from ..core_rendering import DrawEngine..FontManager.init_font_manager()..# load Roboto fonts (used on Windows/Linux).customtkinter_directory = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))).FontManager.load_font(os.path.join(customtkinter_directory, "assets", "fonts", "Roboto", "Roboto-Regular.ttf")).FontManager.load_font(os.path.join(customtkinter_directory, "assets", "fonts", "Roboto", "Roboto-Medium.ttf"))..# load font necessary for rendering the widgets (used on Windows/Linux).if FontManager.load_font(os.path.join(customtkinter_directory, "assets", "fonts", "CustomTkinter_shapes_font.otf")) is False:. # change draw method if font loading failed. if DrawEngine.preferred_drawing_method == "font_shapes":. sys.stderr.write("customtkinter.windows.widgets.fon
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1044
                                                                                                                                                                                    Entropy (8bit):5.526979451028274
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:T482pn2OOfuQR5eZ+mxrJddEZ2F9ybhuiLxMX9ZptqulvDnJbh:faou+5eZ+Gr1ow9HExMtZpoqvDJbh
                                                                                                                                                                                    MD5:A83EF756B9512630A175F9B60AB35343
                                                                                                                                                                                    SHA1:C3117AB8B8A71400920DAE3BECCF76EE7C1DBB23
                                                                                                                                                                                    SHA-256:0591277541DE1798D14CA984C519E874FEE3C08DA2B3DFF4A0B7926AE999FAA9
                                                                                                                                                                                    SHA-512:EE7F342D9CF80E3814E43B160F5C96BF701CD0B9DB9E3DEEE75945E2ADE16862D6E44B85E415DD9D004750C70593809D4B1651ACFE4B7255135B2AED06716C18
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.......e.j...e.j...e.j...e.j...e.j...e...........Z.e...e.j...e.d.d.d.d.......e...e.j...e.d.d.d.d.......e...e.j...e.d.d.d.....d.u.rle.j.d.k.rne.j...d.....d.e._.d.S.d.S.d.S.)......N.....)...CTkFont)...FontManager.....)...DrawEngineZ.assetsZ.fontsZ.Robotoz.Roboto-Regular.ttfz.Roboto-Medium.ttfz.CustomTkinter_shapes_font.otfFZ.font_shapesz.customtkinter.windows.widgets.font warning: Preferred drawing method 'font_shapes' can not be used because the font file could not be loaded..Using 'circle_shapes' instead. The rendering quality will be bad!.Z.circle_shapes)...os..sysZ.ctk_fontr....Z.font_managerr....Z.core_renderingr....Z.init_font_manager..path..dirname..abspath..__file__Z.customtkinter_directoryZ.load_font..joinZ.preferred_drawing_method..stderr..write..r....r.....wC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/font/__init__.py..<mo
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3874
                                                                                                                                                                                    Entropy (8bit):5.3527610764973454
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:eHJCcNlKLc4jKtqoiu5UJD1cQYD4t4n4LaeY6GL9YLOhmPsxvad7/PH:eHJCgKY0ciukD1mf4QPxYLOgPsSxPH
                                                                                                                                                                                    MD5:657895DE104E1DFE5CA64AE846DF6810
                                                                                                                                                                                    SHA1:D2A4EA0C2234375574A51162763AB9C1F55D1A47
                                                                                                                                                                                    SHA-256:7ED1C62E10E1D64AECEA297D204DF1568D99A4554E240D21E200609E7538FC29
                                                                                                                                                                                    SHA-512:D286236F21145173D6B46B09A5D3BDDFEB29FDF2F2C44826A5D4E0EEF4FBEA1ACD0BA7BDFD7ED4FC20A37C92C381861E4BF4E8D8CA35839373AC60E8F06D226E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...s|...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y-......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...FontN)...List..Callable..Tuple..Optional)...Literal.....)...ThemeManagerc........................s....e.Z.d.Z.d.Z.............d!d.e.e...d.e.e...d.e.d...d.e.d...d.e.d.e.f...f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.d.e.e.e.e.f...f.d.d...Z.d.d...Z...f.d.d...Z.d.e.d.e.f...f.d.d...Z.d"d.d ..Z.....Z.S.)#..CTkFonta..... Font object with size in pixel, independent of scaling.. To get scaled tuple representation use create_scaled_tuple() method... family.The font family name as a string.. size.The font height as an integer in pixel.. weight.'bold' for boldface, 'normal' for regular weight.. slant.'italic' for italic, 'roman' for unslanted.. underline.1 for underlined text, 0 for normal.. overstrike.1 for overstruck text, 0 for normal... Tkinter Font: https://anzeljg.github.io/rin2/book2/24
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2219
                                                                                                                                                                                    Entropy (8bit):5.494873760795154
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:vrNy9IcId+Yc7pGDHhAKM1hZ2ZaGgl6RWumDshvdRNRZQ9V8dt:J+YHBA11bQ9Rdm4hvrN8D8dt
                                                                                                                                                                                    MD5:3E928465EC07ACC145F18C37418D23DF
                                                                                                                                                                                    SHA1:B3ED9DE2867A8AA3E74F18450E35CC1E7723DEAF
                                                                                                                                                                                    SHA-256:14C5D1F44880B2475F2C331C034BCFEC002CF9025DFEBE6C0294A9000778F7FB
                                                                                                                                                                                    SHA-512:6003859C6C8B23332569C608C566D8092F1B817CB211427C9A2880732E26C41822DC157F405EA1A8DB012B0B262A212646F2BC57A34507681302C2E733C9FC16
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...s6...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.d.S.)......N)...Unionc....................@...sZ...e.Z.d.Z.d.Z.e.d.d.....Z.e.d.d.e.e.e.f...d.e.d.e.d.e.f.d.d.....Z.e.d.e.d.e.f.d.d.....Z.d.S.)...FontManagerz.~/.fonts/c....................C...s....t.j...d...r>z.t.j...t.j...|.j.....s.t...t.j...|.j.......W.d.S...t.y=..}...z.t.j...d.t.|.....d.......W.Y.d.}.~.d.S.d.}.~.w.w.d.S.).N..linuxT..FontManager error: ...F)...sys..platform..startswith..os..path..isdir..expanduser..linux_font_path..mkdir..Exception..stderr..write..str)...cls..err..r.....{C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/font/font_manager.py..init_font_manager....s..........................z.FontManager.init_font_managerTF..font_path..private..enumerable..returnc....................C...s....d.d.l.m.}.m.}.m.}.m.}...d.}.d.}.t.|.t...r.|.|...}.|.j.j.}.n.t.|.t...r,|.|...}.|.j.j.}.n.t.d.....|.r4|.n.d.|.s9|.n.d.B.}.|.|.|...|.d..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3764
                                                                                                                                                                                    Entropy (8bit):4.6136808628861585
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YzcYbLHLqLGw2mkGFkbFfbhN0VlGSDb3Tu1:AbriGw27Gib9UHGSDb3Tu1
                                                                                                                                                                                    MD5:8D7B56F87315A79919D6E4DF5E046672
                                                                                                                                                                                    SHA1:820AC45EB8E11D2527BC326EAF954DD71384B7CF
                                                                                                                                                                                    SHA-256:88C87D369CC1979571A6DFB705423AAA7DCA11EE8E53941E1CE38D76FD3A2F1B
                                                                                                                                                                                    SHA-512:62EE9013AF66BEFCC6A023D4599B1BF9B04A5ABED413F82A9496036B41D5704CDF108526C56AC8611F16AE5E8507CDEE5F46DB28018D796A4D61DD973EE3FE87
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from tkinter.font import Font.import copy.from typing import List, Callable, Tuple, Optional.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal..from ..theme import ThemeManager...class CTkFont(Font):. """. Font object with size in pixel, independent of scaling.. To get scaled tuple representation use create_scaled_tuple() method... family.The font family name as a string.. size.The font height as an integer in pixel.. weight.'bold' for boldface, 'normal' for regular weight.. slant.'italic' for italic, 'roman' for unslanted.. underline.1 for underlined text, 0 for normal.. overstrike.1 for overstruck text, 0 for normal... Tkinter Font: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html. """.. def __init__(self,. family: Optional[str] = None,. size: Optional[int] = None,. weight: Literal["normal", "bold"] = None,. slant: Litera
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2268
                                                                                                                                                                                    Entropy (8bit):4.554633557295692
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:k7ovB8Sx68Fdt1rH22ZaGg8JKqBzE16ykAgyevuKfpgQSCprFdJP:k+B8T8J1rH2QAqBo1PPCuKBgQd5x
                                                                                                                                                                                    MD5:6D903A86D2C8D5E27DA5CA8592EF6507
                                                                                                                                                                                    SHA1:1E219345E695FD811615C5FD7F37438BFC5191CB
                                                                                                                                                                                    SHA-256:8F0A6EEB5674D27A2AD1459C15A1DFB40311BD78262901C4990883ABE0ABA8DC
                                                                                                                                                                                    SHA-512:E78FA637B1F7EB3BD15DDBD5F7E6BFD2DE5928D61A02FD15ED8781C4F362D830695FEE2A59ECEE5ADEB8077A16D1863AC63E667C9F6E92248408619AF723D770
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import sys.import os.import shutil.from typing import Union...class FontManager:.. linux_font_path = "~/.fonts/".. @classmethod. def init_font_manager(cls):. # Linux. if sys.platform.startswith("linux"):. try:. if not os.path.isdir(os.path.expanduser(cls.linux_font_path)):. os.mkdir(os.path.expanduser(cls.linux_font_path)). return True. except Exception as err:. sys.stderr.write("FontManager error: " + str(err) + "\n"). return False.. # other platforms. else:. return True.. @classmethod. def windows_load_font(cls, font_path: Union[str, bytes], private: bool = True, enumerable: bool = False) -> bool:. """ Function taken from: https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309#30631309 """.. from ctypes import windll, byref, create_unicode_buffer, create_string_buffer.. FR_PRIVATE =
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32
                                                                                                                                                                                    Entropy (8bit):4.101409765557392
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:1LGJj+CKn:1Lm9Kn
                                                                                                                                                                                    MD5:F5FFADF6FB333AD7009300C683004912
                                                                                                                                                                                    SHA1:9BBF3490BBFD69F815D1043085E0639AD385CA47
                                                                                                                                                                                    SHA-256:A736F0948015E0E13E0A4771248AE5D442DC460EEF6D02A40BA1DA1CB183348F
                                                                                                                                                                                    SHA-512:F5DD84862DEB63F5DDA9FA5441EF9745C82E5B9F916FFEB9B39FC15EE3037791E8A3AFAE65F7E30458AA4896A30BDBE29C2DDF663D22C6213D6659B1C70C9E99
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from .ctk_image import CTkImage.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):255
                                                                                                                                                                                    Entropy (8bit):4.983746669617539
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/WIr0e1/QCFOMgNyxn23d6ZUArsNNJSS5D0:C+e9QYMI2JN5D0
                                                                                                                                                                                    MD5:D883460756422CFA5580540F5BAEA075
                                                                                                                                                                                    SHA1:7A91603D4FD29FBF9501761CC342F7315933FD40
                                                                                                                                                                                    SHA-256:0D33788BDC9652F9275C83C49EC63278E13C2D20A594A425B5C0C07092A9B8A3
                                                                                                                                                                                    SHA-512:E6968DC08B9D0B6EE129D12F8F9AF6151319D780E035664BE0A8DC518462D9C02C744A085639D4AC78E49902935DA5493A02F2D7B210A34C1CC527B90980FC6E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd ........................@...s....d.d.l.m.Z...d.S.)......)...CTkImageN).Z.ctk_imager......r....r.....xC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/image/__init__.py..<module>....s......
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4462
                                                                                                                                                                                    Entropy (8bit):5.312049882788875
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aUJ5M0XlGWt4yG/rE1yG5yqzDxBGWufIuRxtuR+iGQInfQ4fT7G3TG2tuTxXLwVc:a65rXlGqLurIv5F3xXQULGoITRgPtUR
                                                                                                                                                                                    MD5:D1722B989F56E1D2EF83F2F883335819
                                                                                                                                                                                    SHA1:0EA297B062FBA5B2583D1487DADB32875F1B8FE1
                                                                                                                                                                                    SHA-256:2D6A7B9E6B63E27D400577B1EDEE1EF4C8A481299FF0E5FCC89240B0C197FC5D
                                                                                                                                                                                    SHA-512:730A3652C6C0A887CD1A1993B037079B3597E69541159698DFD7D60EAF652095DFCC307053A58ED43687330019DCB28776706675B4E90ADB4A73E91F2B36E65C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...sR...d.d.l.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z.m.Z...W.n...e.y.......Y.n.w.G.d.d...d...Z.d.S.)......)...Tuple..Dict..Callable..List)...Image..ImageTkc....................@...s....e.Z.d.Z.d.Z.d.Z.......d&d.d.d.d.d.e.e.e.f...f.d.d...Z.e.d.d.....Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.d...Z.d.e.d.e.f.d.d...Z.d.d...Z.d.e.d.e.e.e.f...f.d.d...Z.d.e.e.e.f...d.d.f.d.d ..Z.d.e.e.e.f...d.d.f.d!d"..Z.d.e.d#e.d.d.f.d$d%..Z.d.S.)'..CTkImageaY.... Class to store one or two PIl.Image.Image objects and display size independent of scaling:.. light_image: PIL.Image.Image for light mode. dark_image: PIL.Image.Image for dark mode. size: tuple (<width>, <height>) with display size for both images.. One of the two images can be None and will be replaced by the other image.. FN.......r......light_imagez.Image.Image..dark_image..sizec....................C...s>...|.j.s.|.......|.|._.|.|._.|.......|.|._.g.|._.i.|._.i.|._.d.S...N)..._checked_PIL_import.._check_pil_imp
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5306
                                                                                                                                                                                    Entropy (8bit):4.5619072078694565
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:3JBLur+hdR7FqVFf97bISTEEhA3hLLXUV:Ms7kVhJTErh8
                                                                                                                                                                                    MD5:4BC2952539F8DFB4B35BBE26565AF2A1
                                                                                                                                                                                    SHA1:CA21C9A364609BB34A93DE732D82E5A1B63162FB
                                                                                                                                                                                    SHA-256:B8BFE826B96AF19D77E2A8E28A2E382E0D37BAD11349FEEB049EA480F1DE6339
                                                                                                                                                                                    SHA-512:6C490C3772D8BF106BDAE17B2CAF205322CDEF05F148A959F2E19407E53025BD15F9DA2F141F51E72215C9A93331219562E66137224D5356B7CC6465F1629FD2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from typing import Tuple, Dict, Callable, List.try:. from PIL import Image, ImageTk.except ImportError:. pass...class CTkImage:. """. Class to store one or two PIl.Image.Image objects and display size independent of scaling:.. light_image: PIL.Image.Image for light mode. dark_image: PIL.Image.Image for dark mode. size: tuple (<width>, <height>) with display size for both images.. One of the two images can be None and will be replaced by the other image.. """.. _checked_PIL_import = False.. def __init__(self,. light_image: "Image.Image" = None,. dark_image: "Image.Image" = None,. size: Tuple[int, int] = (20, 20)):.. if not self._checked_PIL_import:. self._check_pil_import().. self._light_image = light_image. self._dark_image = dark_image. self._check_images(). self._size = size.. self._configure_callback_list: List[Callable] = []. self._scaled_ligh
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):287
                                                                                                                                                                                    Entropy (8bit):4.778729031604742
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:kyByUI6YBLA6DDxyC6H8UZuewRAcc2cDfosPAKOLUvGUZeawfrov:kyYZtL3DIC6cqz1bD4K8gwfra
                                                                                                                                                                                    MD5:F8FF5F614E2A57680C5B09CBB1EFE99A
                                                                                                                                                                                    SHA1:9E99B989470C8182B65F32857823AB7A4B5E410C
                                                                                                                                                                                    SHA-256:D868DE1B6FC0E20ABC83BA5138A3F0E904769881FB6FA8910D0BD3DBAAB3F11E
                                                                                                                                                                                    SHA-512:4E558E7B1D38CD1CF5D6117CC6021B710649841197DFC3801594FDD4655BB5938EC0B603FCB81A17C914CBD24BBF975CFBC3C49C2B6D78848A7E26C125C0806B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import sys..from .scaling_base_class import CTkScalingBaseClass.from .scaling_tracker import ScalingTracker..if sys.platform.startswith("win") and sys.getwindowsversion().build < 9000: # No automatic scaling on Windows < 8.1. ScalingTracker.deactivate_automatic_dpi_awareness = True.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):492
                                                                                                                                                                                    Entropy (8bit):5.3314015173990175
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:C262Z011rySV/SJ5HyOmssiPKZ6swfgWzI2JNMcDh:le11DkJ5SI1SZ6sYg2DnMC
                                                                                                                                                                                    MD5:80C6A0D81611C82826AF9DFE13213595
                                                                                                                                                                                    SHA1:6D1A7DADDF9ABB82F062EE02032017357DF7BFE4
                                                                                                                                                                                    SHA-256:C1362EBBAE9B7FD03D0E80F80B7D83540C47FEFB4B039C4E5C49946862441288
                                                                                                                                                                                    SHA-512:3C75D7112A2783C98DC0A96B5B12826DB140A6FBDEEE9419825BAC9D1CD360438E801CCEA69F72593EFEA19D2537B4E2108B5FD3B26684C2955126DC70918E5D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...sL...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j...d...r"e.....j.d.k.r$d.e._.d.S.d.S.d.S.)......N.....)...CTkScalingBaseClass)...ScalingTracker..wini(#..T)...sysZ.scaling_base_classr....Z.scaling_trackerr......platform..startswith..getwindowsversion..buildZ"deactivate_automatic_dpi_awareness..r....r.....zC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/scaling/__init__.py..<module>....s................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6440
                                                                                                                                                                                    Entropy (8bit):5.382925465632151
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:yJIyP84paoddkbH6R0iQNJjgBesVlnGD1nEDC8buXGPIbHFtbH4bHpgSDXLisvJV:G84pE5NJjh8AvRDyqSnme+s
                                                                                                                                                                                    MD5:A5765AEC4C666F3B4E5C2AC873AC7855
                                                                                                                                                                                    SHA1:FC63BC2BCED6FDC1208E1B6F3EE0DB093905E3F7
                                                                                                                                                                                    SHA-256:BB0410D2796AC438C2B89651A3BAA124CFBA418480FB7F086AABC3CE7E0AB32B
                                                                                                                                                                                    SHA-512:C6A5AA698C83C95F14073AD78F411575362C4FF2291DFD8C3CC551BE486451F3422DBE5E3ECA28853FA4BF9E74D686E4E1C4AF98FCF99E48A2B04FAD6999061B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...sz...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y'......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.S.)......)...Union..TupleN)...Literal.....)...ScalingTracker.....)...CTkFontc....................@...s&...e.Z.d.Z.d.Z.d)d.e.d...f.d.d...Z.d.d...Z.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.e.e.f...d.e.e...f.d.d...Z.d.e.e.e.f...d.e.e...f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.e.d e.d.e.f.d!d"....Z.d e.d.e.f.d#d$..Z.d%e.d.e.f.d&d'..Z.d(S.)*..CTkScalingBaseClassaa.... Super-class that manages the scaling values and callbacks.. Works for widgets and windows, type must be set in init method with. scaling_type attribute. Methods:.. - _set_scaling() abstractmethod, gets called when scaling changes, must be overridden. - destroy() must be called when sub-class is destroyed. - _apply_widget_scaling(). - _reverse_widget_scaling(). - _apply_window_s
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5312
                                                                                                                                                                                    Entropy (8bit):5.283382581037849
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:3F7rL4SPZuw+DLrtyXmcyF5e50Hg7M83ZYMT7HayfEI+uoCbLGknMRPJIUo592K9:ZzZZQpbtHgwsZh9fmRCGkna1iOAN83le
                                                                                                                                                                                    MD5:5C83864413CD623C2B58F10AA1E926AA
                                                                                                                                                                                    SHA1:2AF5E377D34ACA5E5FDB3766329749FE1494CEE6
                                                                                                                                                                                    SHA-256:D0565A759E0D7A6A1DA4183EDBC69DE7348AB774B30D6A0630594F9C1F549EEF
                                                                                                                                                                                    SHA-512:64652E1E8AD4A3055A57856793A0D05A832AB96DD7AA387403EDECEFCB7EEDF8B073E148758155EC0DC002748616BAB79F42E4E901D1F7D878B2E31408DB2296
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd)".......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.d.S.)......N)...Callablec....................@...s....e.Z.d.Z.d.Z.i.Z.i.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.e.f.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d ....Z.e.d.e.f.d!d"....Z.e.d#d$....Z.d%S.)&..ScalingTrackerF......d...i......returnc....................C........|...|...}.|.j.|...|.j...S...N)...get_window_root_of_widget..window_dpi_scaling_dict..widget_scaling)...cls..widget..window_root..r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/scaling/scaling_tracker.py..get_widget_scaling.............z!ScalingTracker.get_widget_scalingc....................C...r....r....).r....r......window_scaling).r......windowr....r....r....r......get_window_scaling....r....z!ScalingTracker.get_window_scaling..widget_scaling_factorc...................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7060
                                                                                                                                                                                    Entropy (8bit):4.665375963721016
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:OEaoddkbH69gRWkSpWVj6i8RpiDzGbHu8L6xiOfu8EvJ71Sj7vVAvZR8vkRlP:BEn0V3J71cxaft
                                                                                                                                                                                    MD5:121A95D8CDC15C00C91404FC96855B34
                                                                                                                                                                                    SHA1:80BA7033362304FDC22F3B5B1D624F0E9C0FC626
                                                                                                                                                                                    SHA-256:55BCF303D18FBA33986C42630EC4119EFA18EAFED14A2B59C2BDFB95902493FF
                                                                                                                                                                                    SHA-512:6A0D7EF54D9AF4D5A466E9F813E6BA07F6DD8C65AFB11C6D6A9477DEFAFB63246665D3403FC10DD3B9FD7D156ABFB0C5FF1B2A640466ECC8AD190E4F9E86DE6E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from typing import Union, Tuple.import copy.import re.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal..from .scaling_tracker import ScalingTracker.from ..font import CTkFont...class CTkScalingBaseClass:. """. Super-class that manages the scaling values and callbacks.. Works for widgets and windows, type must be set in init method with. scaling_type attribute. Methods:.. - _set_scaling() abstractmethod, gets called when scaling changes, must be overridden. - destroy() must be called when sub-class is destroyed. - _apply_widget_scaling(). - _reverse_widget_scaling(). - _apply_window_scaling(). - _reverse_window_scaling(). - _apply_font_scaling(). - _apply_argument_scaling(). - _apply_geometry_scaling(). - _reverse_geometry_scaling(). - _parse_geometry_string().. """. def __init__(self, scaling_type: Literal["widget", "window"] = "widget"):. self.__scaling_type = scaling_type..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8745
                                                                                                                                                                                    Entropy (8bit):4.46611971013542
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ED5H48qEo5nWSG6UfGQXkSRydC1RbnmNej2u8LAtN0YzUlzktIuDEBIEB:El3cHUf7XkddARbW08LAttzUlBuwBVB
                                                                                                                                                                                    MD5:5ADAC9A94E921B8D2729FF3FDB9C5340
                                                                                                                                                                                    SHA1:B10940AAFEFE204ADA7DE8D34F471470288B011C
                                                                                                                                                                                    SHA-256:72E8A55C47924CECA580344D7F6921F9E0D04A1BA9FA2D8D73BA0E70BA3756DC
                                                                                                                                                                                    SHA-512:915493CAFCCD77041B13F3F3507EF2CAA24FEB98A9F6DB377DB67AA3A66C83E12A02015E90CED69EF421B319A0A05D0AF72678393E8BFAAD027B8C2BF700B880
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import tkinter.import sys.from typing import Callable...class ScalingTracker:. deactivate_automatic_dpi_awareness = False.. window_widgets_dict = {} # contains window objects as keys with list of widget callbacks as elements. window_dpi_scaling_dict = {} # contains window objects as keys and corresponding scaling factors.. widget_scaling = 1 # user values which multiply to detected window scaling factor. window_scaling = 1.. update_loop_running = False. update_loop_interval = 100 # ms. loop_pause_after_new_scaling = 1500 # ms.. @classmethod. def get_widget_scaling(cls, widget) -> float:. window_root = cls.get_window_root_of_widget(widget). return cls.window_dpi_scaling_dict[window_root] * cls.widget_scaling.. @classmethod. def get_window_scaling(cls, window) -> float:. window_root = cls.get_window_root_of_widget(window). return cls.window_dpi_scaling_dict[window_root] * cls.window_scaling.. @classmethod. def set
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):471
                                                                                                                                                                                    Entropy (8bit):4.662469420102873
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:1XB9iJkTi+72Mj5C0Tx0uvHKVOXFCNUqormAOXX:12u2LYPTx0uc43tqA4X
                                                                                                                                                                                    MD5:2084248A69E54AEBB11565EA3A962262
                                                                                                                                                                                    SHA1:0A20ABD2C4274E5C6FC3CA4066580F74943EB9A7
                                                                                                                                                                                    SHA-256:899E93E8EFAFDFD84E2DF4CBB8D6D32EDD1703FADA098B71C069E6A8D0762E69
                                                                                                                                                                                    SHA-512:B613F37D583AAA72B76820EC740FEE47CA0EE5DF0AEE33E490C717F25E903BB4FAC03B7D786423F3FF9EC2CF91D79280652EB6E60C720FA796EAD1F32775A950
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:from .theme_manager import ThemeManager..# load default blue theme.try:. ThemeManager.load_theme("blue").except FileNotFoundError as err:. raise FileNotFoundError(f"{err}\nThe .json theme file for CustomTkinter could not be found.\n" +. f"If packaging with pyinstaller was used, have a look at the wiki:\n" +. f"https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exe").
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):612
                                                                                                                                                                                    Entropy (8bit):5.535745356249021
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:CaE6EWTrkF+3GxcJ/KVOXFCNcxormAOXuLUUo+dzI2JN96LQD4ArL:JA+3GxcJM4XmqA4U62Dn6qrL
                                                                                                                                                                                    MD5:C2595C1C3D022A53595F245D6B95737E
                                                                                                                                                                                    SHA1:5E42F833748FCB311F5C638F04CB26FFF32C7E90
                                                                                                                                                                                    SHA-256:E25189D884434695546338D2DB4F6CBE728375BE06607290F6E76EFF27E55F05
                                                                                                                                                                                    SHA-512:5CCA21224890D8FD29BA853277874C0B02114090558A7B9F04485A8558B98D93F3030DD2F8FBDEF217FA5A87E8EBB51D0914D5AEE6E4A12FE157C32DE11D7A50
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...sL...d.d.l.m.Z...z.e...d.....W.d.S...e.y%..Z...z.e.e...d...d...d.......d.Z.[.w.w.)......)...ThemeManager..bluez<.The .json theme file for CustomTkinter could not be found..zAIf packaging with pyinstaller was used, have a look at the wiki:.z`https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exeN).Z.theme_managerr....Z.load_theme..FileNotFoundError..err..r....r.....xC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/theme/__init__.py..<module>....s..........................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1838
                                                                                                                                                                                    Entropy (8bit):5.411080646904243
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:zawwdKNgSfzbZ8lxKDsXDQ5MBiL1vMP0sgbXb:TwY7wxjQ5Hy0fr
                                                                                                                                                                                    MD5:64A61F884FE7977468E90EE4081E583C
                                                                                                                                                                                    SHA1:27DE0BB1FE08894951B8AA7105F00FD96BB3791B
                                                                                                                                                                                    SHA-256:4C29FB8D19F4663B6F3CDAB94931A614AEFB925D39C0797D01A14BF8B30B74E7
                                                                                                                                                                                    SHA-512:08548711BCBAEDCAB22133A78629B02F9075531992B6C4B70B7EA5C036462BD67CCBBC60E51DE3E7C73B84D1971F7C46F56F0D1B8DD9630E099FC3EC0BE2AF79
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdr........................@...sB...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...G.d.d...d...Z.d.S.)......N)...List..Unionc....................@...s`...e.Z.d.Z.U.i.Z.e.e.d.<.g.d...Z.e.e...e.d.<.d.Z.e.e.d.f...e.d.<.e.d.e.f.d.d.....Z.e.d.d.....Z.d.S.)...ThemeManager..theme)...blue..greenz.dark-blueZ.sweetkind.._built_in_themesN.._currently_loaded_theme..theme_name_or_pathc....................C...s2...t.j...t.j...t.....}.|.|.j.v.r=t...|...j.j.j.}.t.t.j...|.d.d.|...d.....d.....}.t...|...|._.W.d.........n.1.s7w.......Y...n.t.|.d.....}.t...|...|._.W.d.........n.1.sSw.......Y...|.|._.|.j.....D.]6}.d.|.j.|.......v.r.t.j.d.k.r{|.j.|...d...|.j.|.<.q`t.j...d...r.|.j.|...d...|.j.|.<.q`|.j.|...d...|.j.|.<.q`d.S.).NZ.assets..themesz..json..r..macOS..darwin..win..Windows..Linux)...os..path..dirname..abspath..__file__r......pathlib..Path..parent..open..join..json..loadr....r......keys..sys..platform..startswith)...clsr....Z.script_directoryZ.customtkinter_path..f..key..r%....}C:\Users\dat
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1906
                                                                                                                                                                                    Entropy (8bit):4.384053703612958
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:k9xlrll+gSOEoN9AJ0UnySg/pFKztgN+ASVS9jS58Siw:k9/rllAO0nf8KBgN+dAIviw
                                                                                                                                                                                    MD5:EBE003D8A30B03A8A287DAF28BE7B64A
                                                                                                                                                                                    SHA1:B228C656868988412964395368AE6A745ECF3D35
                                                                                                                                                                                    SHA-256:EDCE6FF8A32B8C9DC00E21BA420E9283641F65973BE1CC09209377E688A46614
                                                                                                                                                                                    SHA-512:421678401C731EDF8E0143C31E32B11FAFD52EA1F6742D2BCBB957B1964435F51AEFF0DD3F59318D1C15DAA44FFF765C94440C2D24AEF8B49DEEC2CD1B562269
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:import sys.import os.import pathlib.import json.from typing import List, Union...class ThemeManager:.. theme: dict = {} # contains all the theme data. _built_in_themes: List[str] = ["blue", "green", "dark-blue", "sweetkind"]. _currently_loaded_theme: Union[str, None] = None.. @classmethod. def load_theme(cls, theme_name_or_path: str):. script_directory = os.path.dirname(os.path.abspath(__file__)).. if theme_name_or_path in cls._built_in_themes:. customtkinter_path = pathlib.Path(script_directory).parent.parent.parent. with open(os.path.join(customtkinter_path, "assets", "themes", f"{theme_name_or_path}.json"), "r") as f:. cls.theme = json.load(f). else:. with open(theme_name_or_path, "r") as f:. cls.theme = json.load(f).. # store theme path for saving. cls._currently_loaded_theme = theme_name_or_path.. # filter theme values for platform. for key in cls.theme.k
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, ASCII text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):72
                                                                                                                                                                                    Entropy (8bit):4.398511114409896
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:1LQRMC6ZNMXBSVo2MGR6Dz6Ao6v:1LA66Bmgan6v
                                                                                                                                                                                    MD5:2BCBAB49EADEC63DE47AF34806EFA7EA
                                                                                                                                                                                    SHA1:E5887D011B676349D15BEB6DB80BA58B58F48F37
                                                                                                                                                                                    SHA-256:493B20390BD3840A146AB57DA2F33A338D1AADA4140CD53F4269876F231A471D
                                                                                                                                                                                    SHA-512:B76A52096170EF9712F2539178C5BB432DCD61E81519C4AFB42B1766586A123CD50FCBBD2F616524F75C3BD097889EFD05689D07EF3D1B89A73AFF64DEE5CF67
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:from .utility_functions import pop_from_dict_by_set, check_kwargs_empty.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):306
                                                                                                                                                                                    Entropy (8bit):5.037235333176978
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/WIol/ex4ZvhgxQn6L/Ev3q+uyxn23d6ZUArsNNJSS0ciDo:CSteyYQCEUI2JN0Do
                                                                                                                                                                                    MD5:23E7D921F2554376D277E3F77397AE3E
                                                                                                                                                                                    SHA1:95821CFA6D9BD4991000631DB38A590B24CCF195
                                                                                                                                                                                    SHA-256:8E16F9A5E751D581FC1605FEF1EE171F8FD936B808F5C7E6A46EC0558333418A
                                                                                                                                                                                    SHA-512:C574ADECE47287114C3B2BD2E4132FC4B53DC8C2D909E0F62F61DFA4D2EDE780FAA36F5218D5FAE76FC76D72501476FF7ADF27BB9186C2592C417F9380060234
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xdH........................@...s....d.d.l.m.Z.m.Z...d.S.)......)...pop_from_dict_by_set..check_kwargs_emptyN).Z.utility_functionsr....r......r....r.....zC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/utility/__init__.py..<module>....s......
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):975
                                                                                                                                                                                    Entropy (8bit):5.235090033577134
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:GsqiHdSZLBZDn9uQBoGVeBcQm38wAYhe0IhWV:HqmAZnD9u/8eBcQmsOvn
                                                                                                                                                                                    MD5:CA35193A6596590871E07F50EF2C70DA
                                                                                                                                                                                    SHA1:1E02AECE9BCEFF272AE6743EA5C7F24568E2218E
                                                                                                                                                                                    SHA-256:C7E4AA8B15F9A10D84FA5365638E31E66BCA89B797154ECB78C85A955DF817D8
                                                                                                                                                                                    SHA-512:6B3AA9CC49E7DABEFD85E831F7B24540A9B76E1D1251560E88F7A90D5EFDF03BA446D9F11B601E486A2F5A01B5A54125B71F11A4A750449C33E3E9C3EDDDD32D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o.......).xd.........................@...s*...d.e.d.e.d.e.f.d.d...Z.d.d.e.f.d.d...Z.d.S.)...dictionary..valid_keys..returnc....................C...s0...i.}.t.|.......D.].}.|.|.v.r.|...|...|.|.<.q.|.S.).z[ remove and create new dict with key value pairs of dictionary, where key is in valid_keys )...list..keys..pop).r....r....Z.new_dictionary..key..r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/utility/utility_functions.py..pop_from_dict_by_set....s................r....Fc....................C...s....t.|...d.k.r.|.r.t.t.|.........d.......d.S.d.S.).zN returns True if kwargs are empty, False otherwise, raises error if not empty .....zP are not supported arguments. Look at the documentation for supported arguments.TF)...len..ValueErrorr....r....).Z.kwargs_dictZ.raise_errorr....r....r......check_kwargs_empty....s..............r....N).F)...dict..setr......boolr....r....r....r....r......<module>....s........
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):766
                                                                                                                                                                                    Entropy (8bit):4.463169082971207
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:8Mf8ujS53n2yKfdTfOq5syKGDVHQwK5MDB+jpNQAe648wjBPMjUUX6gBlm36uX/m:8YSZZIdjOqiy3DCw8GAVeBbTUKgnm3ve
                                                                                                                                                                                    MD5:63C5279B2AFA10D8416E96ABD788B6A5
                                                                                                                                                                                    SHA1:51DF4126B656806C4AF168CCC048B3B3A7B87EAD
                                                                                                                                                                                    SHA-256:7745A3E408A8C616F7AAD0B4213B8D6478F07C51DE8147CAF9B7E40D7AEBB9F9
                                                                                                                                                                                    SHA-512:C5D6BB05DD0C14C8ED47F4B7CBC4ADCD622F55389C669940A5ED11706CDA3E42536542B5E900E16E39A5708BE3122DEA1151D0E188CD161CD97FB5D110452A28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.def pop_from_dict_by_set(dictionary: dict, valid_keys: set) -> dict:. """ remove and create new dict with key value pairs of dictionary, where key is in valid_keys """. new_dictionary = {}.. for key in list(dictionary.keys()):. if key in valid_keys:. new_dictionary[key] = dictionary.pop(key).. return new_dictionary...def check_kwargs_empty(kwargs_dict, raise_error=False) -> bool:. """ returns True if kwargs are empty, False otherwise, raises error if not empty """.. if len(kwargs_dict) > 0:. if raise_error:. raise ValueError(f"{list(kwargs_dict.keys())} are not supported arguments. Look at the documentation for supported arguments."). else:. return True. else:. return False.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, Unicode text, UTF-8 text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2108
                                                                                                                                                                                    Entropy (8bit):4.798329477412705
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:SISbAyExGGp4upe3+xAUMsu8OTJ+gBjtV:8bgLieAUMsu8OTogBRV
                                                                                                                                                                                    MD5:9EBBF9F5410C89AE4BDC310E907CBC5D
                                                                                                                                                                                    SHA1:318BE19377FC67196427FDBBF458EF2FA1713FA2
                                                                                                                                                                                    SHA-256:C8E2B76AEF6862992334ECA1CC88B319B70DB64DC9A391EA41C55A675C1FC20D
                                                                                                                                                                                    SHA-512:5DD8B9406235C030AC57FF86F2A4118DABCC723539C2A71E37B378353BFD93B7D4620EFA721AE54126F57FEDB7F83179437994B5AED1334B8550EC01CFC647BC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>...import os.import sys...def backend():. """Returns the backend module.. """. def dummy():. from . import _dummy as backend; return backend. def appindicator():. from . import _appindicator as backend; return backend. def darwin():. from . impor
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2069
                                                                                                                                                                                    Entropy (8bit):5.09970733841883
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Aao6VQkFYf2Ux+SyUgMiIUQKUy3UQ7d7E7H3a5Bj4bO2Ob6xwC:Aao6VQklUx+hUcIUQKUy3UQ7dsHwBcS8
                                                                                                                                                                                    MD5:91E21E563506E891F6C690634C41C38D
                                                                                                                                                                                    SHA1:4C16AC062858DC52DB4E2A5F5ABFF9155CCB3A46
                                                                                                                                                                                    SHA-256:471B1D4C4394ABD48F209C5CACB2B381D003E77B63535A8F9410EF56EDB29DFE
                                                                                                                                                                                    SHA-512:9850BB2138A18E89C12BDC92987C482077BABDCB980BD448E40CF14AED3B3BFC0E2440DFDFD1185B39197826C6BE35ED25FEBCFD3108C3548A137AF4790A2B77
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.d<........................@...s6...d.d.l.Z.d.d.l.Z.d.d...Z.e...j.Z.[.d.d.l.m.Z.m.Z...d.S.)......Nc....................C...s&...d.d...}.d.d...}.d.d...}.d.d...}.d.d...}.d.d...}.d.d...|.|.|.|.|.|.f.D...}.t.j...d.d...}.|.rIz.|.|...g.}.W.n*..t.yH..}...z.t.d...|.......d.}.~.w.w.t.j.d.k.rR|.g.}.n.t.j.d.k.r[|.g.}.n.|.|.|.g.}.g.}.|.D.].}.z.|...W.....S...t.y...}...z.|...|.....W.Y.d.}.~.qdd.}.~.w.w.t.d...d...d.d...|.D...........).z Returns the backend module.. c....................S........d.d.l.m.}...|.S.).N.....)..._dummy)...r........backend..r.....\C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\pystray/__init__.py..dummy...........z.backend.<locals>.dummyc....................S...r....).Nr....)..._appindicator).r....r....r....r....r....r......appindicator....r....z.backend.<locals>.appindicatorc....................S...r....).Nr....)..._darwin).r....r....r....r....r....r......darwin....r....z.backend.<locals>.darwinc....................S...r....).Nr....)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3048
                                                                                                                                                                                    Entropy (8bit):5.14062572299841
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:BIMrxtJ+SeOyhaYfeenSNbFfWvAWdAyW13MUzgpWk7W9QWSdGtjoscsKv7:938SeD3nubMYaUzgJUssXDKz
                                                                                                                                                                                    MD5:939BD69E4B6373A292CEA269EBDB205C
                                                                                                                                                                                    SHA1:C018414437BD899417A389E229117F1A5593ADDE
                                                                                                                                                                                    SHA-256:F05A7C6E71C188CC183350E4182B5044644F79F3F284E584E9726E00EEF46D0C
                                                                                                                                                                                    SHA-512:4C18C25A4E9B0180DB9B43909C1DEF9640F1BAE6A66D483B499CDB29F84DACBC9A46E8F29D0147780CCA712D123465693036D8839F3CD5AA58E7594BF9D6AA26
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.dS........................@...s....d.d.l.Z.e...d.d.....d.d.l.m.Z...z.e...d.d.....d.d.l.m.Z...W.n...e.y3......e...d.d.....d.d.l.m.Z...Y.n.w.d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N..Gtkz.3.0).r......AppIndicator3z.0.1).r......AyatanaAppIndicator3).r.........)...GtkIcon..mainloop)..._basec........................sp...e.Z.d.Z.d.Z...f.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z...f.d.d...Z.d.d...Z.....Z.S.)...IconFc........................s2...t.t.|...j.|.i.|.......d.|._.|.j.r.|.......d.S.d.S...N)...superr......__init__.._appindicator..icon.._update_icon)...self..args..kwargs....__class__...aC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\pystray/_appindicator.pyr....&...s..............z.Icon.__init__c....................C...s^...t.j...|.j.d.t.j.j...|._.|.j...t.j.j.....|.j...|.j.....|.j...|.j.p$|.........|.j...|.j.....d.S.).N..)...AppIndicatorZ.Indicator..new..nameZ.IndicatorCategoryZ.APPLICATION_STATUSr....Z.set_s
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):21967
                                                                                                                                                                                    Entropy (8bit):5.0959778641739115
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:GxCBFk01mFdKplXXFadyVB0Tw1WgoeOqCBIRjDTugjC:Gk6ImFdKpli0CTGbCBIFTumC
                                                                                                                                                                                    MD5:CFF78386886CA8A1910B79BDF9A5C574
                                                                                                                                                                                    SHA1:E80E295841350EAAEB603C874E84B739ADA44192
                                                                                                                                                                                    SHA-256:79775F4FDDBA52057C67E7000F937F7A4600C7A46D5B48A8E090B5164CF5B231
                                                                                                                                                                                    SHA-512:A32EC90E2346DF0C171429405570B49575D2355BE09F909CA640673F25A5CD68B51562D47F880441FFF4D2C2557BD08059C2EB8FF82B2094EF9A330A8F5BC4CF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.d.Q.......................@...sh...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...queuec....................@...sT...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z...d?d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.j.d.d.....Z.e.d.d.....Z.e.j.d.d.....Z.e.d.d.....Z.e.j.d.d.....Z.e.d.d.....Z.e.j.d.d.....Z.d@d.d...Z.d@d.d...Z.d.d...Z.d.d ..Z.d@d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.d)d*..Z.d+d,..Z.d-d...Z.d/d0..Z.d1d2..Z.d3d4..Z d5d6..Z!d7d8..Z"d9d:..Z#d@d;d<..Z$d=d>..Z%d.S.)A..Icona*...A representation of a system tray icon... The icon is initially hidden. Set :attr:`visible` to ``True`` to show it... :param str name: The name of the icon. This is used by the system to. identify the icon... :param icon: The icon to use. If this is specified, it must be a. :class:`PIL.Image.Image` instance... :param str title: A short title for the icon... :param menu: A menu to use as popup menu. This can be either
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7133
                                                                                                                                                                                    Entropy (8bit):5.424945576521654
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:kBPb20IGOTeQ+QvyK/2lAmGH11sS0bSRSGBdjJtAE:MbBBOTeQ+Q6KYGYSPjJl
                                                                                                                                                                                    MD5:9942F229671AB521AFE0361547E0D74A
                                                                                                                                                                                    SHA1:ECA71A8A5C560BACDAE9A44C62122E6E10DDD0F9
                                                                                                                                                                                    SHA-256:23B4271EA884CAADC0A3A5B04534CBF6C2B4F4FA82CCA74B8A763A968704937C
                                                                                                                                                                                    SHA-512:E0A95BB9B224F0157538F2CA2E53CAA9C5AB1C197C7CAA879B3D7736152A9680977A2FAA7061BC842AA29D3DE3E369CF0DEBD9205E71EE47C77633CF86654F75
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.d.".......................@...st...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.)......N.....)..._basec........................s....e.Z.d.Z.d.Z.d.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.....Z.S.)"..Icons....activate:senders....activateMenuItem:senderFc........................s....t.t.|...j.|.i.|.......d.|._.d.|.j.v.r.|.j.d...n.t.j.....|._.t.........|._.|.|.j._.t.j.....|._.|.j...t.j...|._.|.j.......|.j.....|.j.......|.j.....d.S.).NZ.nsapplication)...superr......__init__.._icon_image.._options..AppKitZ.NSApplicationZ.sharedApplication.._app..IconDelegate..alloc..init.._delegate..iconZ.NSStatusBarZ.systemStatusBar.._status_barZ.statusItemWithLength_Z.NSVariableStatusItemLength.._status_item..button..setTarget_..setAction_.._ACTION_SELECTOR)...self..args..kwargs....__class__...[C:\Users\datun\AppData\Local\Programs\Python\
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):348
                                                                                                                                                                                    Entropy (8bit):5.172668404839888
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/u7lexGBL/YERnVhA6Kbu8u2Qj1VtKEy/Q/4yxn23d6ZUArPx1hAx26P:Cu7MwB75N7trKEy/bIBx1N6P
                                                                                                                                                                                    MD5:A589E6CA27EACECC643EA4C3146AC17A
                                                                                                                                                                                    SHA1:A6932BC4521962031C75F375903AD16DFCA78FC8
                                                                                                                                                                                    SHA-256:CAFB04F238745C5DA3D5CA1F5E45310F33B25D4515B1B9D8511C24C81BF0FB27
                                                                                                                                                                                    SHA-512:184DBA961490B8FD3E5B0E5024F6EEEB3370DE0FEADB412CBF32A90E03C0A90DD1A751B354B467A68A553F11378997BF63821CAB9A2AEDB6F0FD445C57A664AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.db........................@...s....d.Z.d.d.l.m.Z...d.S.).zr.This module contains a dummy implementation...It cannot be used, but importing it will not raise any exceptions.......)...IconN)...__doc__.._baser......r....r.....ZC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\pystray/_dummy.py..<module>....s........
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2380
                                                                                                                                                                                    Entropy (8bit):5.064013544872722
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/YhNohVYf2g3sxGR26Ai9kbMLyyLhWviyZTDmqz+t5:wLo9gewmi9hLyy06yZ3mu2
                                                                                                                                                                                    MD5:01A779E1C40DE9EB7E4FBDEE600CD0FB
                                                                                                                                                                                    SHA1:DAFA82B11F009B9D3584BE8F4CB905B4D8314EF5
                                                                                                                                                                                    SHA-256:CBE99EA298E16BE6E02E110F01E731FA98106024CBA13AD9EBF690364F444D52
                                                                                                                                                                                    SHA-512:0C44CF9B4DCE2EE1E677AB05CCC739E677B765389BF6B4FCCF62F0C121FE59F138E17823B04E48B44D94A20708D0847B93F1E954806570B5F4BA6518D3BCE259
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.d8........................@...sD...d.d.l.Z.e...d.d.....d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......N..Gtkz.3.0).r.........)...GtkIcon..mainloopc........................sh...e.Z.d.Z...f.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.....Z.S.)...Iconc........................sX...t.t.|...j.|.i.|.......t.j.....|._.|.j...d.|.j.....|.j...d.|.j.....|.j.r*|.......d.S.d.S.).N..activatez.popup-menu)...superr......__init__r......StatusIcon..new.._status_icon..connect.._on_status_icon_activate.._on_status_icon_popup_menu..icon.._update_icon)...self..args..kwargs....__class__...XC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\pystray/_gtk.pyr........s..........................z.Icon.__init__c....................C........|.j...d.....d.S.).NT..r....Z.set_visible..r....r....r....r......_show&..........z.Icon._showc....................C...r....).NFr....r....r....r....r......_hide*...r....z.Icon._hidec...................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):249
                                                                                                                                                                                    Entropy (8bit):5.012844712001645
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/uHqepzqswnv2Vs/umSgRpuyxn23d6ZUArPx1hnd6J:CuKeIs4v2Vs/mgTYIBx1f6J
                                                                                                                                                                                    MD5:775A2F9A4BC34E8E746121AF25B83874
                                                                                                                                                                                    SHA1:7CD415EA2E5F181496C9DE836F815E6BB403A8E9
                                                                                                                                                                                    SHA-256:B8C60DB5A360925D7FA1FF76159D493C4440A52C33FB9F5F67F2D7AB3C354110
                                                                                                                                                                                    SHA-512:54760C6D420A5B03EB6109ED7D1816D9789AAE7B83467FA97138A13FE092168D7A0F141D193A4A6EA7499F0898BA22D68C1EBF9482A0ED588A57EEA707E985AB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.d.........................@...s....d.Z.d.Z.d.S.).u....Moses Palm.r)................N)...__author__..__version__..r....r.....YC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\pystray/_info.py..<module>....s........
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11065
                                                                                                                                                                                    Entropy (8bit):5.459782534278983
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:4YBp60B5mvkVgwg6iL64lr81jjJgWPHYEaWCL0JqtNPZ3vKbUqth8e/NHf/p6bST:4oBkvkiv/RRYXJsWy0BLZWI
                                                                                                                                                                                    MD5:0C0BFA20E68FABD97F52319F1E13B20E
                                                                                                                                                                                    SHA1:B283269C66627DC7309B891907E168B87B136B95
                                                                                                                                                                                    SHA-256:CDE3850E0E9D5D90E742FD6F9A2C567A7B5CFB20B911B0C7447853EBAB591F77
                                                                                                                                                                                    SHA-512:97E9996D4A3E065E17FD54434D69F9BE72BAC5361D4693F5CF501AFDA06D5CC968E0CBEB4CBB4AE21D21245E0EE88A9D6F855E273676BEDC92EAC117ED376CB7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.d<3.......................@...sh...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.e.j.d.d.....Z.d.S.)......N)...wintypes)...queue.....)...serialized_image..win32)..._basec........................s....e.Z.d.Z.i.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d2d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.....Z.S.)3..Iconc........................sd...t.t.|...j.|.i.|.......|.....|._.d.|._.d.|._.d.|._.d.|._.t.j.|.j.t.j.|.j.t.j.|.j.i.|._.t.....|._.d.S...N)...superr......__init__.._register_class.._atom.._icon_handle.._hwnd.._menu_hwndZ._hmenur......WM_STOP.._on_stop..WM_NOTIFY.._on_notify..WM_TASKBARCREATED.._on_taskbarcreated.._message_handlersr......Queue.._queue)...self..args..kwargs....__class__...ZC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\pystray/_win32.pyr........s..........................z.Icon.__ini
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):13098
                                                                                                                                                                                    Entropy (8bit):5.3229174805680355
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:+50yZbt+fSvzm+g1ZYv/H/ez+SZ4Ik/8CdSc2qg15Cz6fTjlvzyJ/K6nhOgByiti:VyZbt+fSvz9MZYv/H/ezlZ4L/8CdSc2t
                                                                                                                                                                                    MD5:23E00EE590966A48549C502EBAAE446E
                                                                                                                                                                                    SHA1:5A492BE9BF804BF0A838226A9AAF725E1C4562A4
                                                                                                                                                                                    SHA-256:CE5082694E2048F3A45CE667A9036B7DB32AD91D17F09C12B09DBCB2CB6E4C1C
                                                                                                                                                                                    SHA-512:D51A870C90EE36E2EBDA9D8013D01F6E2B388482CA778DB690A68D8294B6310FF10B1CB8E9389A2AB7D49C097561AC8232F7B58BFDEAD3F97CECEBBA150E837F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.d.;.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.....Z.e.......[.G.d.d...d.e...Z.e.j.d.d.....Z.G.d.d...d.e.j...Z.d.S.)......N)...queue.....)..._basec....................@...s....e.Z.d.Z.d.Z.d.S.)...XErrorzzAn error that is thrown at the end of a code block managed by a. :func:`display_manager` if an *X* error occurred.. N)...__name__..__module__..__qualname__..__doc__..r....r.....YC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\pystray/_xorg.pyr....)...s..........r....c....................#...sV.....g.....f.d.d...}.|...|...}.z.d.V...|.......W.|...|.....n.|...|.....w...r)t.......d.S.).z.Traps *X* errors and raises an :class:`XError` at the end if any. error occurred... This handler also ensures that the :class:`Xlib.display.Display` being. managed is sync'd... :param Xlib.display.Display display: The *X* display.. c.......................
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, Unicode text, UTF-8 text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3155
                                                                                                                                                                                    Entropy (8bit):4.732056320656289
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:SISbAyExGwcEUw41d0TdEd3Bgp/MrecUz9:8bgDUj1dOdCgVMrA
                                                                                                                                                                                    MD5:BC5837A6F2A4CA7B67184B58C976AA56
                                                                                                                                                                                    SHA1:AA67A56D20BCF0C68888222A0DA5D6413C120F18
                                                                                                                                                                                    SHA-256:B82CE5BDC0856416E6BA51BB1D2C5F09A4A5A7E9D14ABB3EE7D90A6834D964D4
                                                                                                                                                                                    SHA-512:291FE9E44C60BF324686A7E4F9C13FB05F0475717EAA086B3870A73FF9F62061C3F207ED715BB61F8D405B4DA2CB2103EA724F96BDF4F90B8A85524F1450710B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>...import gi.gi.require_version('Gtk', '3.0').from gi.repository import Gtk..try:. gi.require_version('AppIndicator3', '0.1'). from gi.repository import AppIndicator3 as AppIndicator.except ValueError:. gi.require_version('AyatanaAppIndicator3', '0.1'). from gi.reposito
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, Unicode text, UTF-8 text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20907
                                                                                                                                                                                    Entropy (8bit):4.3282246648095875
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:8MexVQxnCizqnlcAFwdzlffe+FKpKpne2lAFadoiOMaGIDa1IlK89gm2AbuKZMJg:8Mexco2FUKplaFadxOMvIzgx8rc9TW
                                                                                                                                                                                    MD5:66FCEAF738FA96E8AA266CFFE498B23F
                                                                                                                                                                                    SHA1:6C38B19A45E1F394D978B330C45046DFD091CC28
                                                                                                                                                                                    SHA-256:BEA220D8F54BFBF71B21D5A910CAFE4A2D10684A7E04D302090CD008B176E699
                                                                                                                                                                                    SHA-512:858310CDED2883D7C27289C02E9382E9545C12FA0E98953F5D49189E70C09E07C746EAF4B3ED4AFCA1E8FE55B6F7ED8FFB8B0E763CF2E2C9F31BA6DD2BF780B1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>...import functools.import inspect.import itertools.import logging.import threading..from six.moves import queue...class Icon(object):. """A representation of a system tray icon... The icon is initially hidden. Set :attr:`visible` to ``True`` to show it... :param str name:
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, Unicode text, UTF-8 text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8901
                                                                                                                                                                                    Entropy (8bit):4.518212533820006
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:8bgUq9HccYtb4pLQtfnHXRxwQ/twDltGHjJQsGybSxrtPPr:8MUq98DtbUEtf8Q/KTGHqsGybSlt3r
                                                                                                                                                                                    MD5:582BADEFED1CC20F92FCCDEE4DC55B19
                                                                                                                                                                                    SHA1:4B2137B13D25C3E6AD9AC836130DEB05B1326D21
                                                                                                                                                                                    SHA-256:BBC3873E428E5487F5F4952408CE9DE1D4717BBE6DD76AD30C8AB50B289888C4
                                                                                                                                                                                    SHA-512:4327FC79E635E1EA29A48C03BFBDAEC1A8B3149FCA3F0F4344181936E2535A6C8D80FC419B102F7B30867F631BC2E40879206ED57866E6441858CADF3C4B8E6C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>...import io.import signal.import subprocess..import AppKit.import Foundation.import objc.import PIL.import PyObjCTools.MachSignals..from . import _base...class Icon(_base.Icon):. #: The selector for the button action. _ACTION_SELECTOR = b'activate:sender'.. #: The select
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, Unicode text, UTF-8 text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):866
                                                                                                                                                                                    Entropy (8bit):4.9710787569634505
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:WGO6vj9JKAAlQMALkp4WTGTyEUM+kIAttxqTbVPA12CTd8wf5N7tqvk:bO6vj9SbhKyE+kfqTbVt2y4Jr
                                                                                                                                                                                    MD5:C960AF8FAE83ED5D66E84E7EAC1F2F89
                                                                                                                                                                                    SHA1:ADD84425973ECA83D4FDD80A1528E73AF6D6FBC2
                                                                                                                                                                                    SHA-256:61CF5FC0F443692D9E29A6368D4B320757FB4A6A0601BE5F46BCB9D06CA20F0C
                                                                                                                                                                                    SHA-512:C27C5C05C1781416425E3652C3FF1818E79CB34F72329903002B99C8F1D45041CA841E1BB28D5542EEB020DBD0EF25D1813FEFA9B7E2FB7A34E0C39D5C357339
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>..""".This module contains a dummy implementation...It cannot be used, but importing it will not raise any exceptions.."""..from ._base import Icon.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script, Unicode text, UTF-8 text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2360
                                                                                                                                                                                    Entropy (8bit):4.740907816308172
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:bO6vj9SbhKyE+kfqTbVt2yTsuyaARqEj6R5EBCAUR1I5IcLkUQ8Zhedp567M6Q8H:SISbAyExGXlR5E1OqIwhCk4sZf
                                                                                                                                                                                    MD5:23DD47673E2A01D70BE2768EF0AC5149
                                                                                                                                                                                    SHA1:D75B0B2A46937504EB3D7AFF8C77BC985CE25848
                                                                                                                                                                                    SHA-256:A38D619AD380BFD0DFE35ED4DCF946E2DE2FE09264617FDDCA8088F2C5426060
                                                                                                                                                                                    SHA-512:8A2042198FE9A80713465AECCC247D6163571866B28245ED1244934E42A1FBE1BCAD431E76226151410DD2D493B88FEDD989DE40E84DD8108E81BDFA918A0F2E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>...import gi.gi.require_version('Gtk', '3.0').from gi.repository import Gtk..from ._util.gtk import GtkIcon, mainloop...class Icon(GtkIcon):. def __init__(self, *args, **kwargs):. super(Icon, self).__init__(*args, **kwargs).. self._status_icon = Gtk.StatusIcon.new(
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Unicode text, UTF-8 text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):776
                                                                                                                                                                                    Entropy (8bit):5.064298781110305
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:WGO6vj9JKAAlQMALkp4WTGTyEUM+kIAttxqTbVPA12CTd8wRe5Lsz:bO6vj9SbhKyE+kfqTbVt2yNhsz
                                                                                                                                                                                    MD5:AAB3CCF674F79763412EC51F23B1C961
                                                                                                                                                                                    SHA1:5C06B1130DC6FEBBCFD2422B790D6BF0E2D7E9CC
                                                                                                                                                                                    SHA-256:30F0527D4DD94521906C8D2DF13C128963EA4039362A6F9C6D324637DC9E6104
                                                                                                                                                                                    SHA-512:7DF335C3CE0A6B1D1260A28AD3B1BEB35331327C8C398A22F0CF60DEDC525A7ABC1CEE2273546DF1C0351455134DA931574E5C958EF156013FCC44AC9963D4CA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>...__author__ = u'Moses Palm.r'.__version__ = (0, 19, 4).
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Python script text executable Python script, Unicode text, UTF-8 text executable
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1589
                                                                                                                                                                                    Entropy (8bit):4.810134504355005
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:bO6vj9SbhKyE+kfqTbVt2yX1yQRLBeWBQ6wxxOioF48Eh6:SISbAyExGH1ZRLEWmv2iw4i
                                                                                                                                                                                    MD5:AE0242E6CF459B0621835A740FA72BF5
                                                                                                                                                                                    SHA1:90C8426589E875393434438B7D6C01124C760BA4
                                                                                                                                                                                    SHA-256:441F5B187D0CE1A6FC1F25F26CF384835688C3763F4DFA2E1753D65737FF84C6
                                                                                                                                                                                    SHA-512:3C19A78F4CEAAA37713E69070FFFB5E0E4FEAA33516234D5071B1E7E8C664D532402B7A03A673A3EE601C137AABFFED4555EB077F70015FD69448C907448456C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>...import contextlib.import os.import tempfile...@contextlib.contextmanager.def serialized_image(image, format, extension=None):. """Creates an image file from a :class:`PIL.Image.Image`... This function is a context manager that yields a temporary file name. The. file is
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1122
                                                                                                                                                                                    Entropy (8bit):5.378468784830536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:6iq1Sr/4QTLQRLBeWBQ6wVAKP5Yx1bAB51RL:6iyYQQT8RLEWmvqK5YfbABbN
                                                                                                                                                                                    MD5:EA5E1884ADD716ADB825C0823797D172
                                                                                                                                                                                    SHA1:315392FB0B03440E34EC346596BA0AFA56C364A2
                                                                                                                                                                                    SHA-256:D075BCB1C32EAC5F51ACBF43B9DB3CCDA7903A68A5FC56E762C05CE2BD09BF5A
                                                                                                                                                                                    SHA-512:3881AE608CE23F98F365CA24E21534502C3F5E706A9D6F1CCD54E20F62D4E0CC630F94C232429C259CA875CEA3E7AE8F2C83B75FEB7B52B229CA3465D4209620
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:o........,.d5........................@...s,...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.d.d.....Z.d.S.)......Nc....................c...s......t...d.|.p.|.........\.}.}.z.t...|.d.....}.|.j.|.|.d.....W.d.........n.1.s'w.......Y...|.V...W.z.t...|.....W.d.S.........z.t...|.....W.w.........).a....Creates an image file from a :class:`PIL.Image.Image`... This function is a context manager that yields a temporary file name. The. file is removed when the block is exited... :param PIL.Image.Image image: The in-memory image... :param str format: The format of the image. This format must be handled by. *Pillow*... :param extension: The file extension. This defaults to ``format``. lowercased.. :type extensions: str or None. z..%s..wb)...formatN)...tempfile..mkstemp..lower..os..fdopen..save..unlink)...imager......extension..fd..path..f..r.....bC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\pystray/_util/__init__.py..serialized_image....s..............
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):93330
                                                                                                                                                                                    Entropy (8bit):3.319807723045599
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:aAHU3LIkZlmXrd/uQ0ao98ggKSTEvZPHb6qRL5NpiadDp0ZBFR6YR/fW:aVduBGf9PgFMT6q95GDRBfW
                                                                                                                                                                                    MD5:1D84B025DAB127F2073947D764D307B6
                                                                                                                                                                                    SHA1:4E3D3CBD96D084836F1FE6F2AA497E3FAA463B9B
                                                                                                                                                                                    SHA-256:F80E05533D1A1494C32F9412E9AD2D9C11FAF9AE0668A6F9D1FA5CEEDC6870E2
                                                                                                                                                                                    SHA-512:188D649F9717F20524AFF47F85C3B23AEC3E7825BF54975285D06C17587D581DC24A3F6A7CAB1703DE7AD5521FE2FE2572DE627A81E6A48049A47BB219ED4AF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: cp950, multi-byte..M..003F 0 88..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1113
                                                                                                                                                                                    Entropy (8bit):3.7780987266961663
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:vJMHkUlJvRjmf9RCsUBOdXsCbbNviANpk3m1XFAoE4xSF5HrBPkdn:vKvlA9RCs6CXrViAN51XFA9eSvdPKn
                                                                                                                                                                                    MD5:90FE0C57BBC6C2D8A3324DEB7FD45F3D
                                                                                                                                                                                    SHA1:06B95BE43E4C859A0F1B01384EDD26500C6C1F9E
                                                                                                                                                                                    SHA-256:EB9B262E4D179268E6F017C0D4EF0E7034E31A5B4893595D150640CA1F6A1C45
                                                                                                                                                                                    SHA-512:6A5E67D9F3EC6046C42793E1437B8A6E50EBD72D8EC67FEFEB6DAD6FAB6A5B5C74F939363587D5A6529E217AF54FB8A9CF0F768E114DD931C57887451CACE56E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: dingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A327A
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1073
                                                                                                                                                                                    Entropy (8bit):3.0039861897954805
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:XXBcIhJZDgEoQkNCGz0Jyh9lZk3Vmd2QhZLXPiALV3d:dTcNCJEhfZk3Vzox/iqVN
                                                                                                                                                                                    MD5:F7B3771D43BDE6AFF897683BED2FE6AD
                                                                                                                                                                                    SHA1:E70C2C0902413536CB6163752D70F3AE4AF6A967
                                                                                                                                                                                    SHA-256:165BE658AB7D61FFC3DF1E2F1438C2F9FCEE6808A756316302157F44E6D3ACD7
                                                                                                                                                                                    SHA-512:F87DC718EB2DD95237B144FDA090BB636121B9479E492AC94E4F7EBDD88171F070B9E9F6165BDA7B7E2BA2A3E6188B1108D8F91AA5F142CCCFDAD317628DD941
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:S..006F 0 1..00..0000000100020003008500090086007F0087008D008E000B000C000D000E000F..0010001100120013008F000A0008009700180019009C009D001C001D001E001F..0080008100820083008400920017001B00880089008A008B008C000500060007..0090009100160093009400950096000400980099009A009B00140015009E001A..002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C..002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F..002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F..00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022..00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1..00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4..00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE..00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7..00F900410042004300440045004600470048004900AD00F400F600F200F300F5..00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF..00D900F70053005400550056005700580059005A00B200D400D600D200D
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):86971
                                                                                                                                                                                    Entropy (8bit):2.3925661740847697
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
                                                                                                                                                                                    MD5:C5AA0D11439E0F7682DAE39445F5DAB4
                                                                                                                                                                                    SHA1:73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
                                                                                                                                                                                    SHA-256:1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
                                                                                                                                                                                    SHA-512:EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):83890
                                                                                                                                                                                    Entropy (8bit):2.350315390677456
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:2GhX8nuQ635vlHptHzh0abNQPQA0OMS2HhFV3:2GikvRpMuNQ4P73
                                                                                                                                                                                    MD5:F2DE0AE66A4E5DD51CC64B08D3709AAB
                                                                                                                                                                                    SHA1:97558A51A6DD6C56FC7A42A4204141A5639021FD
                                                                                                                                                                                    SHA-256:A3C916BA16BCAC9FAA5A1CCC62ACA61452D581CD8BA3EE07EC39122C697274C9
                                                                                                                                                                                    SHA-512:0EAA90100527FF150D2653D7BB57647D69E592BE53B714DDD867114CFCC71E3A76882772F4FAECE040DF09FA8971D1C22DECC497E589B4CA827A6890497A48D9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: euc-jp, multi-byte..M..003F 0 79..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D0000008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):95451
                                                                                                                                                                                    Entropy (8bit):2.4080588863614136
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:4/vO7UlClqAd8XfpUqv+mCoKRuLbtMjnIxz0DY:4nO4N9fpv+ngLbiyEY
                                                                                                                                                                                    MD5:103843B3A57168BD574F6CACC550D439
                                                                                                                                                                                    SHA1:982652EA2B0DCFBB55970E019A4EDFBFCFAF9C24
                                                                                                                                                                                    SHA-256:5448643398685456A11CBB93AF2321F70B8659E2FFF3CCC534B4D53BD2F38C89
                                                                                                                                                                                    SHA-512:27A8DE6F97DB4A96E5D0132692A32A99DAB8A6C98973A0C4E50A219F2D2F364E63D657E5E8478B2706CA33C45C376F55B5BFCC9459E06AEA88BFCD4F0E32525C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: euc-kr, multi-byte..M..003F 0 90..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):88033
                                                                                                                                                                                    Entropy (8bit):2.3790651802316996
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:o4Is/C+0IwpRK1CkinIKUyNiNBzxOC4T/:LIsR0/RKckiIgNiDtOxT
                                                                                                                                                                                    MD5:1A8E55DEA98B6D5EAC731ED233D3AD7C
                                                                                                                                                                                    SHA1:1335FC0FC2AAE7E7F5EC42AC17A4168368B4A64D
                                                                                                                                                                                    SHA-256:B4894AEDD2D5B5AE54B6D2840F7C89A88E9308EFD288F179E65936E172EF4B0D
                                                                                                                                                                                    SHA-512:9DDCE366BA1196EB9FB913ACFDE8516BC9BB8D51894866D2E7E8CB313DC4D6C6D33C5A9E78142E83594DC423D10DA6F8DE211E69844B939198BC7DB9AED808F0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: gb12345, double-byte..D..233F 0 83..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1111
                                                                                                                                                                                    Entropy (8bit):3.270324851474969
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:qrmHVBUlJvRj76OVbusZhAMiZyi77qN8VmKfkiJt0RMFS:qSMlZVnrAMiwMmNPYPFS
                                                                                                                                                                                    MD5:D06664ACAA478BDEB42B63941109A4E3
                                                                                                                                                                                    SHA1:4A6196FCC1BDE988C1A23EAA69745A9979F1AEFF
                                                                                                                                                                                    SHA-256:ACD50951F81566C8D823670F9957B2479102EB5AE4CF558453E1D8436A9E31FF
                                                                                                                                                                                    SHA-512:CB51A36B851FFDB5C6F9B9D0333EEA6A14CEF3796E0A60530198C16999D64E638047E873333630360299C9126F79CEDDA2D9F169028CED1FC04B1D3C55FFFC5B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: gb1988, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..002000210022002300A500250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..000000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):85912
                                                                                                                                                                                    Entropy (8bit):2.3945751552930936
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:D47/S+i8vdx3Tz+hpHcBrQqKtrebjMIGCx8jE:0c873T6DHcBrbKtrVlE
                                                                                                                                                                                    MD5:9357E05C74D6A124825F46A42B280C14
                                                                                                                                                                                    SHA1:E5106ABE12D991AFE514F41E3B9E239202A4ADFE
                                                                                                                                                                                    SHA-256:C445E4C9F676AE997D2DDA2BBC107B746F3547D85F39479951C56F46275EE355
                                                                                                                                                                                    SHA-512:B2187D70A92FB38572BA46F3C3443233BEED1A4ABBFBA1B860F4BBAE6B3D8C16B8C9F52A20DAA12B2B8B40972E52F816860427B743530177E4CF0D8BA34EF381
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: gb2312, double-byte..D..233F 0 81..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):86971
                                                                                                                                                                                    Entropy (8bit):2.3925661740847697
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
                                                                                                                                                                                    MD5:C5AA0D11439E0F7682DAE39445F5DAB4
                                                                                                                                                                                    SHA1:73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
                                                                                                                                                                                    SHA-256:1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
                                                                                                                                                                                    SHA-512:EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):4.949409835601965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SOd5MNXVSVLqRIBXS4ovLE9sDXMVyXK9ow1Deq9Ts5dRPMSXcRA0kcR4X9cL+TXI:SVNFS0oyisLMsXK9okTw/BDSVKNw
                                                                                                                                                                                    MD5:D3AC33390D31705FA4486D0B455247DF
                                                                                                                                                                                    SHA1:2EE8613DC04A6FA84AB38FD5F3A2AA3FE330625B
                                                                                                                                                                                    SHA-256:98074C85650A420A095ADA9138DA3A8A0AA4027BE47EA1E97A596F319EB084E9
                                                                                                                                                                                    SHA-512:CB265B753C84968E2D1D6E706906DA9A7BB796D08F626290BCCA8F089771AFD176A9DC912773E8BA390D2AEC08592AD535C7D254E1DF92CF04848601481D4EFE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso2022-jp, escape-driven..E..name..iso2022-jp..init..{}..final..{}..ascii..\x1b(B..jis0201..\x1b(J..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):122
                                                                                                                                                                                    Entropy (8bit):4.978693690727393
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SOd5MNXVTEXIBXS4ovLE9sDXNvdwUHEQwqc6XWxVUNOov:SVNFSoyisL/Zzc6mYNHv
                                                                                                                                                                                    MD5:057CB0AA9872AC3910184F67AC6621BC
                                                                                                                                                                                    SHA1:BBA47F9D76B6690C282724C3423BD94E2C320A04
                                                                                                                                                                                    SHA-256:234811FC8B0F8FF2B847D9CC3982F1699DF1D21A43C74DCE45BA855D22520007
                                                                                                                                                                                    SHA-512:019F187D2D16FB51BF627ACB7E67778857E56D4C160E0E5ACA6ABC05EC5FDB624CE2715CB9E0DAD73BFF9D697982BE0D539BC55BCCD368FC7C8EE0FFC04E9F61
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso2022-kr, escape-driven..E..name..iso2022-kr..init..\x1b$)C..final..{}..iso8859-1.\x0f..ksc5601..\x0e..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):240
                                                                                                                                                                                    Entropy (8bit):4.95909788984399
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SVNFUXoyisLNcs9ozc6W4Twk0sRBDSVKN6tWIHRy:oUYcLNcTzczbwRYRy
                                                                                                                                                                                    MD5:BB186D4BE3FA67DD3E2DEE82DD8BD628
                                                                                                                                                                                    SHA1:93CE8627038780CFFF8C06E746DD5FB2B041115C
                                                                                                                                                                                    SHA-256:741B4C842557EED2952936204D0AE9C35FA3A0F02F826D94C50C46976291797C
                                                                                                                                                                                    SHA-512:4921E7AA3DB8E33609603FE129B97275DFF80CFB06648D2068FA7950246C67B9B530B74827638F69F4DFB8F55CDD4AA952EA72EAEB6ABB527D52F20C6B46FB51
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso2022, escape-driven..E..name..iso2022..init..{}..final..{}..iso8859-1.\x1b(B..jis0201..\x1b(J..gb1988..\x1b(T..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..jis0208..\x1b&@\x1b$B..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):3.236046263464657
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:iyHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkL+rSMH+tKv:iyMlBVnrAMiwMmTmokLz0
                                                                                                                                                                                    MD5:3538A970CD098BF5CE59005FE87B6626
                                                                                                                                                                                    SHA1:285A96CC40D7CCE104FB4B407C7F0C400AA8F9CB
                                                                                                                                                                                    SHA-256:A9CB4F4CA111608F882729BC5EB1C2F15530C515EF02DD2CA62F2D8DC5A210CF
                                                                                                                                                                                    SHA-512:A6A6F2D8B5C22E240D195D168A604887062508FF3340D24E13BFCBD6C2E687347F2CFE724FA2ED12F36915B55EE2CFD901EC3F08E2B0A2FFD3BC2A98BBD12A50
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-1, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.319750415373386
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:jHVBUlJvRj7SOVbusZhAMiZyi77qimXG2yM6q7KytC:jMlBVnrAMiwMmTXG2gytC
                                                                                                                                                                                    MD5:CBDE40170FECD2496A9DA3CF770FAB7B
                                                                                                                                                                                    SHA1:3E1D74DF6AFEB6CDE8ECBDAC8F81F2F9C64150DE
                                                                                                                                                                                    SHA-256:48F4A239C25354F0E9F83A39F15D4632BB18A9C33E60C671C67307159917ECED
                                                                                                                                                                                    SHA-512:A26B56A4CFE29E5A0A0B3A55283A7767397693388E2DEEC342C69B6F718FAE2407EB8D5ADE538FAE6947CBB8B052943C3A52F2D046ABAC7A3DAA86D730DC293F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-10, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A..00B0010501130123012B0129013700B7013C011101610167017E2015016B014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF..00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF..010100E100E200E30
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.3206399689840476
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:6HVBUlJvRj7SOVbusZhAMiZyi77qimwHmEU4AyqU+TWwdd:6MlBVnrAMiwMmTf4AyqUSd
                                                                                                                                                                                    MD5:E2A0BCB83BFC3F435CDCFC20D5CF2E0C
                                                                                                                                                                                    SHA1:CFD18B5B5DB4EE46E63D912B8FD66D513C4C8D39
                                                                                                                                                                                    SHA-256:21E769C5A66E4D12D6E7DB24022E92AF1EC0D0331FE3C8C605654F239C0F3640
                                                                                                                                                                                    SHA-512:C86F9180F2F4A177F1EA10E26B0903ABEAFDDE0317C332A48F8D1BB586DAC91C68800E2E4FA2CD739C435419B106CBA4BEFC049F2BCD720E9FC2C0AE8436CFAC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-11, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.338879965076632
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:olHVBUlJvRj7SOVbusZhAMiZyi77qim2w4kBUioGnd2:olMlBVnrAMiwMmT/WNI2
                                                                                                                                                                                    MD5:21CEBB723D47B1450A7FB21A82470B97
                                                                                                                                                                                    SHA1:A40FD3AFE1ECE89E3F682D527D281BC563DB3892
                                                                                                                                                                                    SHA-256:3271D39D7B4DCD841E8E5D5153D1B8837718B88FEFEC73DC37D314816EEFE5E5
                                                                                                                                                                                    SHA-512:3A0E033A4D93C679215F672C6C4FE425D63E1DE157AA671E7400639165EC3EB498E4EEB030D6FB8FF8BE2FD8C986D341036A8CED9FA094D092CF2822D5DC065B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-13, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F010101070
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.3670559016263915
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:vHVBUlJvRj7SOVbusZhAMiZyi77qimhw6COlk1fKMH+tiH:vMlBVnrAMiwMmT/tlkQz0
                                                                                                                                                                                    MD5:FDAA88946DE4EB4E6D37F2B6AFCF6CAF
                                                                                                                                                                                    SHA1:56FC4773941E7457EA04EDA92C883642DE45D100
                                                                                                                                                                                    SHA-256:F0A5675027FB1CA34B4E4128D24C2968CD275890569A32A86AFA4994CE4983E0
                                                                                                                                                                                    SHA-512:92658A6FEB42A41B3CFFC377C4A9A3F6780A79FC596D3FEDBA6D3B3D75A9F40E859A2CE8DC579A278BAEEDEEFA2408E2B7853D99D5C2D14AACF63C521FE2BB86
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-14, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178..1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF..00E000E100E200E30
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.260398494526282
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:mHVBUlJvRj7SOVbusZhAMiZyi77qimmRf4kL+rSMH+tKv:mMlBVnrAMiwMmTmCkLz0
                                                                                                                                                                                    MD5:D779D5E2A0083C616A226B2D82ABF0EB
                                                                                                                                                                                    SHA1:D1657DB5E2989EBA80BAB98A1E1217CFFFBB19DB
                                                                                                                                                                                    SHA-256:C74E8E23A0FF0D5DEA7C318CA20DC817DA4E57B0DD61B3361FC0D5098A9316FE
                                                                                                                                                                                    SHA-512:26E62BE8AE793ED3B725BF0D1BABF4D6ED63A6F3772ABD48955FC4394BDE5A47614D1FF89A21A828676BF1302F3C9361B557B0FBF0DF8561FB7E66542FE94CDC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-15, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF..00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E30
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.3065938185320918
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:dHVBUlJvRj7SOVbusZhAMiZyi77qim0SmmPkYTtyL:dMlBVnrAMiwMmTttPkYpyL
                                                                                                                                                                                    MD5:74FDEDDAF670023DA7751FB321E345A0
                                                                                                                                                                                    SHA1:0677FED67C1333A9A74D50642E5214701A57E2AF
                                                                                                                                                                                    SHA-256:640D977EC1D22B555C5075798DA009E3523E8F55F29BE22A3050CD1B4EF7B80E
                                                                                                                                                                                    SHA-512:AC02FD95159A856A9DDEF4E6A8216B958DC07311B553FF39403DC5B77E1AFF2A2C4C03F5F26A2BB7AD5DB6800BEE03E895554556DBBFBE89426286796ADE55AC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-16, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B..00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C..00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF..0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF..00E000E100E201030
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):3.340505173539446
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:UHVBUlJvRj7SOVbusZhAMiZyi77qim/ssm5VO6ys2K:UMlBVnrAMiwMmT/ssYTys2K
                                                                                                                                                                                    MD5:9B87850646FFE79F3C8001CBCB5BB3A1
                                                                                                                                                                                    SHA1:8F97576F3FB3B5DBEF71DC2C9314AB5E530974D6
                                                                                                                                                                                    SHA-256:76949B03F57041B07F41902BD7505AB3594D79AA8F7BDEED5F0481004B10CBC3
                                                                                                                                                                                    SHA-512:101A28AF0799E7E0A5723E5DD76D5EF0FEEF584AC479A88F499CB3B7D2AA93767D72F8E51C76F7547F08FF8DD3CBBA7FF444BD07F99A92755526E75C596109EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-2, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B..00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C..015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E..01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF..015500E100E2010300
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):3.2507537230559977
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:tHVBUlJvRj7SOVbusZhAMiZyi77qimw2g0kgTJMkFtoD:tMlBVnrAMiwMmTo0kgTJDoD
                                                                                                                                                                                    MD5:CBD0B9CDCD9BC3D5F2429A760CF98D2F
                                                                                                                                                                                    SHA1:6DEF0343E0357E0671002A5D2F0BFC2E00C8BCF9
                                                                                                                                                                                    SHA-256:1F51E7BDA64D466C16FEE9A120BBE3353A10CEB9DAB119FFA326779BA78D8C5D
                                                                                                                                                                                    SHA-512:88DB6D23B53F4A78133C794ED42FA3F29A4ABAD35DE4B022040FA187AA59B00664CC13F47AFF4507D72F4CB2166F026144213EE760AB0FD67CDD2FA5906F434A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-3, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B..00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C..00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF..000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF..00E000E100E2000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):3.3413832766873073
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:KHVBUlJvRj7SOVbusZhAMiZyi77qimX4AsD/njR7Ky8hA:KMlBVnrAMiwMmTXBs3EyuA
                                                                                                                                                                                    MD5:8B620EDECAC2DF15A024C2CE15FB64A5
                                                                                                                                                                                    SHA1:65C5EE5D08964E37393E6A78ABA0DB16D51240E2
                                                                                                                                                                                    SHA-256:66B3CF994F0B5E0103D13E812958320AFB555C91E3F81B579D4CBF231E6A0805
                                                                                                                                                                                    SHA-512:93391325405D3AEA0A913F5EA8EA0391920D10F234C26AB1DA70992702889A3AF7B85E11A1FCA554690942B238CE313DD460798E59C5B1F4069036E7B0F24F44
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-4, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF..00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A..01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF..010100E100E200E300
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):3.342721205983665
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:zHVBUlJvRj7SOVbusZhAMiZyi77qimq5+SAJlz9aRme3cJbx:zMlBVnrAMiwMmTqeYnsJbx
                                                                                                                                                                                    MD5:6FBEFDC3DEC612B7B2CC903D8C53F45B
                                                                                                                                                                                    SHA1:14EC3C166DC411149C32C262DBE8E327F6186669
                                                                                                                                                                                    SHA-256:3130BF26DA0C840C1E02203A90C3B1C38966FB203130E2FBB3DD7CB3865A3539
                                                                                                                                                                                    SHA-512:F3F15AD8B6C9D9B4C9C994FE3235B4463E59BE7DCE79CF3F7AA77905D6F4DC2C4AABB79B440767DB13D357B13F09EA34983FCA7BC92D0AFA15FB6CBEDDD04E38
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-5, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0040104020403040404050406040704080409040A040B040C00AD040E040F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..044004410442044304
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):2.992219341429816
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:YHVBUlJvRj7SOVbusZhAMiZyi77qimEZjyG/KE:YMlBVnrAMiwMmTEs6KE
                                                                                                                                                                                    MD5:52F025D943A45EE840D9C3DFD06E4D79
                                                                                                                                                                                    SHA1:571EA14B49FA6150BFD2ABA79E52799955D9FA10
                                                                                                                                                                                    SHA-256:CB71909BF01A3A7A4C7396359DA06D206B58A42AD68192CE37169D6640D46E13
                                                                                                                                                                                    SHA-512:77FF9DC785A63CA59A7D58BB25C7D2C16F364E525F9B939177385EF80F7DE37734C8774F1BC829CF0270FD66257A4D31689654C8037DB0A86A0291FFDE637B90
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-6, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000000000000000A40000000000000000000000000000060C00AD00000000..00000000000000000000000000000000000000000000061B000000000000061F..0000062106220623062406250626062706280629062A062B062C062D062E062F..0630063106320633063406350636063706380639063A00000000000000000000..064006410642064306
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):3.393893260854861
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:TMyHVBUlJvRj7SOVbusZhAMiZyi77qim2OBHK9QQSqiWeIDDdn:TlMlBVnrAMiwMmT1hKyQSqiWeIVn
                                                                                                                                                                                    MD5:4BFB0A35D971A9D4C5EA8D8099E93C37
                                                                                                                                                                                    SHA1:8FED2CBB1343E5B4442748242B5F89A76110592D
                                                                                                                                                                                    SHA-256:76F6BC85FC9CB89BC3F94D36275AB23C740BA17FD36EC8907479DA3A885415EA
                                                                                                                                                                                    SHA-512:C9CE1E9EA57A1DEF62BBC60A115C06325C6EE8F92021695459E1ADAF1193A559BC5F0229191BFC2E344296DC137583ED4A9A61A65890F99F4CF97B3864C7AF0F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-7, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A02018201900A320AC20AF00A600A700A800A9037A00AB00AC00AD00002015..00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):3.0494739426493567
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:uHVBUlJvRj7SOVbusZhAMiZyi77qimieGlnvs26Kcv:uMlBVnrAMiwMmTirv87
                                                                                                                                                                                    MD5:5F69EAF54E7A1E8AC81C9E734DBE90D8
                                                                                                                                                                                    SHA1:BA509C88A4FC03922EF5CDC887FAA7B594A9BC5A
                                                                                                                                                                                    SHA-256:865E3665743B5FABA3E1AD6AA55515A666BD05DA6266879D9B66C98905DAFF3C
                                                                                                                                                                                    SHA-512:D9924FBE59CB571AF721CA602DBE58CAD0D9310610EDF544F8FC0FBF3D1CE4E99597D0198E4E7C802107012786346FE4C1B9C6C3A76D5F60B9A83981B0EDA24D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-8, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000002017..05D005D105D205D305
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1114
                                                                                                                                                                                    Entropy (8bit):3.2591070910715714
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:XHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkBSMH+tA/b:XMlBVnrAMiwMmTmokgzAD
                                                                                                                                                                                    MD5:0B99E605E73B7D8DEFD8D643F5729748
                                                                                                                                                                                    SHA1:F30E7CCBCD9C539126E8D6CA0886E4B2BD54E05D
                                                                                                                                                                                    SHA-256:CF51E867DDE2F19553D98FEEC45A075C4B4F480FB1EDADB3D8DAD1EBEA9299F3
                                                                                                                                                                                    SHA-512:DA0487CD7F2143195E80697C17FFDB61AFD464C888DDF84813B2B5D1BAB24D96466DA7A7F77C8E4A9D0D53F34D72928923380AFC1B92A96C0A3BFF46006A4E19
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: iso8859-9, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1112
                                                                                                                                                                                    Entropy (8bit):3.2708615484795676
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:zBHVBUlJvRj7SOVbusZhAMiZyi77qN8VmKfkiJt0RMFS:zBMlBVnrAMiwMmNPYPFS
                                                                                                                                                                                    MD5:4E21F24F8D9CC5DF16B29CACD997AC69
                                                                                                                                                                                    SHA1:064E723EFB82EF1C303E5267496304288821E404
                                                                                                                                                                                    SHA-256:61B14A7C312366F79BB45F02C6B7EE362E6F51CBAD5E479E563C7F7E785DB654
                                                                                                                                                                                    SHA-512:AF8FAEB47EFB51F2537139F7C4254ABED119E477FD2B5E83B90B7A903B43C4E02DDF43A7DDB044A0A9601E9F9ADE91B02EE7C0EC87FF5DDCF9951B9601A90435
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: jis0201, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..00000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):81772
                                                                                                                                                                                    Entropy (8bit):2.3571626869060776
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:AigXM6CwL/9pV7Hl6+Yko9gZxErA3/MS/8xqg8:AZ/tp1Hl2KZxUfr8
                                                                                                                                                                                    MD5:F0661E22C7455994AA1F6EC1EDA401B4
                                                                                                                                                                                    SHA1:928B2AC46A9FDE61A81F56BE225E6138B40C22E5
                                                                                                                                                                                    SHA-256:F6B1C6AC5F5FC4E990A7A1AAC16A406012040936431BEFE7D2B6CD1DA9E422C4
                                                                                                                                                                                    SHA-512:917CC58678A9E9F5CBE860D30828846ABA4EA8CDFAB7DD1AE6A66C47ECBB85CF67DD97BC3E6F95341DD30F4E757B2CEA571708D5B4CED18A29F19904C3138AE0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: jis0208, double-byte..D..2129 0 77..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8..FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F..FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D..FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7..00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5..FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):72133
                                                                                                                                                                                    Entropy (8bit):2.3455261548208055
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:9F/D7CH2puD5CdzU3nAkP5dHn7s391fmOarFaVQ:H/D7CHbozU3nAk3H7sXm3FgQ
                                                                                                                                                                                    MD5:07CE2C135BE17DBAFA558AA5949A53DB
                                                                                                                                                                                    SHA1:5D9DBEFCCB44E76C1A4E61360C6FCED8DCC8EF4D
                                                                                                                                                                                    SHA-256:785CFC5F5D9CB06DB8061730AB0016A0F70D0B59F6787D2A3CBB8D5779C99706
                                                                                                                                                                                    SHA-512:E954D7198D58ACEDEB4C8E5F466107767C3DA43763A5F6CDDFCF567226F9B22B4C2DE27564F28CD125D7F1BA7CB9C6DE6DEC4065EC2676572C793BE458FDDD9D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: jis0212, double-byte..D..2244 0 68..22..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000000000000000000000000000000000000000000002D8..02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000..0000000000A100A600BF00000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000BA00AA00A900AE2122..00A4211600000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1111
                                                                                                                                                                                    Entropy (8bit):3.531149521168141
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:KcJ5mHVBUlJvRj7SOVbusZhAMiZyi77qpSzIa9qVRS3YcEchJh3MAxSl:KmmMlBVnrAMiwMmAzIxVgBE6cAxQ
                                                                                                                                                                                    MD5:96F54CC639ACA8E466FB8058144C9350
                                                                                                                                                                                    SHA1:0B9530D6080F2BAACABD5AA0D48BFF316FCCEF64
                                                                                                                                                                                    SHA-256:0E43244BFC4F33FACB844B9E00270A1A4C24DC59B8A9B95104E2D788BB2F59FD
                                                                                                                                                                                    SHA-512:5B7859325E5E34C9D4558B1198795BB9C6A8EF783EB97193EA80BA76C38AFE9BDD1B526B77401DF5456B7A0E85E942191FFD4B4F2B9F0C8168A7093EE452802E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: koi8-r, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204512553255425552556255725582559255A255B255C255D255E..255F25602561040125622563256425652566256725682569256A256B256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1111
                                                                                                                                                                                    Entropy (8bit):3.5076564572101714
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:K+HVBUlJvRj7SOVbusZhAMiZyi77qpSzIaU3dmVRS3YcEchJh3MAxSl:K+MlBVnrAMiwMmAzI/EVgBE6cAxQ
                                                                                                                                                                                    MD5:4B755EF2288DFC4009759F8935479D68
                                                                                                                                                                                    SHA1:C3BDF0D9DF316DE8919DAA4329275C5AA81D61B4
                                                                                                                                                                                    SHA-256:ED04D5B977B8C8944D8760B713FF061292DA5634BCBB67CDFB1C3A6FF5378C81
                                                                                                                                                                                    SHA-512:3F1E1CC47327054FB9C54157ED10514230F10BFCD4BD9FDAFA02D7B238137DC7442CA2661B0739D8EEA3181E187D3B639A2C8118A0DE272C96000908121B6CFB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: koi8-u, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204510454255404560457255725582559255A255B0491255D255E..255F25602561040104032563040604072566256725682569256A0490256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):94393
                                                                                                                                                                                    Entropy (8bit):2.4104200953565513
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:XbjO7Uw6uKdosXRxps9a+ut/BmZPwkpT9A0T03o:XfO4ZBRxpV+4wPwKloo
                                                                                                                                                                                    MD5:366C09E4A4CC10006E593F5B3F3461D7
                                                                                                                                                                                    SHA1:A0DABFBEEB66E26FB342844EA41772D7A1D19C24
                                                                                                                                                                                    SHA-256:9B27FE7E7054F36E279993F19E52E18AC03360D117AE80C42B4E984A97C590AA
                                                                                                                                                                                    SHA-512:670F32D698C7992038E736D3AD40098D8589C0C5A1379E32A0F02A02FAF251B1312CAD131DDADC3F80B23A3821A91689F2E310309028BDDDF227D532EB505A20
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: ksc5601, double-byte..D..233F 0 89..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300200B72025202600A8300300AD20152225FF3C223C20182019..201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7..00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640..222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6..25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D..221D2235222B222C2208220B2286228722822283222A222922272228FFE20000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1116
                                                                                                                                                                                    Entropy (8bit):3.4295694929963667
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8jHVBUlJvRj7SOVbusZhAMiZyi77qHVPJSf2FcVDu1LEe4qPPMl2J89:8jMlBVnrAMiwMmHEmJ4IMgi9
                                                                                                                                                                                    MD5:10850BCFB943318284D6191494EBD7D5
                                                                                                                                                                                    SHA1:237D5DDF7969A422991F17021244D13A2BB0DE92
                                                                                                                                                                                    SHA-256:81ECA6840B87F2DEF9FCDD171A55C2D71A49386D88401CE927AE57D7DDD7AAAA
                                                                                                                                                                                    SHA-512:D797781C228B70D2D83DB8ABA08F840CE49846C9473CC89A2E316900D9E08A63142E68AD9ABBB2EF67BF9F1D392772FAB36CCC09632022A1437AE27C11F2284F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macCentEuro, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179..017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC..202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E..012F012A22642265012B0136220222110142013B013C013D013E0139013A0145..0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C..20132014201C201D2018201900F725CA014D0154015501582039203A01590156..01570160201A201E
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1116
                                                                                                                                                                                    Entropy (8bit):3.3992482002374516
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8ULyHVBUlJvRj7SOVbusZhAMiZyi77qsTMdKxOZwwL+KR5D/jlJy6QWky:8ULyMlBVnrAMiwMmOsL+KR5DblE85
                                                                                                                                                                                    MD5:A60FBDE33D13C732095713D1AB6713AB
                                                                                                                                                                                    SHA1:4B0EB443F2D0E4B8DB7D0435F9311E5F9A625123
                                                                                                                                                                                    SHA-256:BBE6F5EBB5EAB08C91DF7D524FAF39B03AA8B9F84C67ABA0553A84EC56668CB9
                                                                                                                                                                                    SHA-512:3EEBA6BA3FCD875AFBD5DF41EDC21E872416A48D03343232904CC99CAF913045DAF7B1A1ACD0949EF794AD7B6C9AE8F93808423FFC4B67718E732B2FF5D9B6D7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macCroatian, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8..221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8..00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153..01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB..201300B7201A201E
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1116
                                                                                                                                                                                    Entropy (8bit):3.4178221849964903
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8dHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJY:8dMlBVnrAMiwMm8Y6zUk+UVsJY
                                                                                                                                                                                    MD5:C390D66441AC61CCF0A685CA5EE0BC1C
                                                                                                                                                                                    SHA1:FCAE825B54400B9D736EF22A613E359E3F0FA6C2
                                                                                                                                                                                    SHA-256:76EFE571ADDA7AED467F146CB0BD3A2351F2A720508EA0642C419F5347789CAA
                                                                                                                                                                                    SHA-512:C891DB15E0F600965885DE6745EDD2A4E3A6A20CA30A9AAE89CBD8C429F8455C4AF7F2FC053FB3D730D8544AB6A6E78E769DB93DAD7B29868B746FA10373F021
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macCyrillic, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..0430043104320433
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1116
                                                                                                                                                                                    Entropy (8bit):3.870022681111701
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:87JMHkUlJvRjmf9RCsUBOdXsCbbNviANpkDP1XFAoE4xSF5HrBPkdn:87KvlA9RCs6CXrViANUP1XFA9eSvdPKn
                                                                                                                                                                                    MD5:DCE78527E3A7B7CB1DE9EE5FAF12AFC6
                                                                                                                                                                                    SHA1:20F4A3F4DB6B3422C04EBB6B21A568E4C173F9C1
                                                                                                                                                                                    SHA-256:062E31D48DC33160999074E49205E08C3655DFF91C2C87F254522E6EBCE2DD96
                                                                                                                                                                                    SHA-512:627F5FD2F12B341F2D7EE9032946FE057C4AC74D99687178CEA98B3E150307BB6AA2495B0FA46400760D467E2BF589BE31E998E25CE1D1E8465DA61F22047345
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macDingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A3
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1113
                                                                                                                                                                                    Entropy (8bit):3.4954458011071323
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8dOHVBUlJvRj7SOVbusZhAMiZyi77qJlbaBMD2aSY5us36Ekp1ysOSU2imR:8kMlBVnrAMiwMm7aKPVusqx1ysOJjmR
                                                                                                                                                                                    MD5:0CC92F685A4132BE4B030006670D81CE
                                                                                                                                                                                    SHA1:13B1074A90055E9EA061A6206A9C004DA29967A9
                                                                                                                                                                                    SHA-256:1AABE561B5C944ABD11C293D4ACAC0F3A4A5A9E84A0342D066F4E3E992348895
                                                                                                                                                                                    SHA-512:E1AF3D47D681CD68B6063DEC1241631CABE86FE835232FA73D855AC74D0175540D46511282BE7198A67A37970A5D05CDECF55C10424ED9C1413C108F116094D9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macGreek, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8..00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC..2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7..039100B12264226500A503920395039603970399039A039C03A603AB03A803A9..03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153..20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F..03CD03B103B203C803B
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.3991839018654573
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8KHVBUlJvRj7SOVbusZhAMiZyi77qscqMVmOZmk/LYRldjY/g4JyMWG:8KMlBVnrAMiwMmzqi/LYRlYBEXG
                                                                                                                                                                                    MD5:747ADBE54D6992467415E322326FA1B9
                                                                                                                                                                                    SHA1:5E3967B5DDF3A6DBF07E90ED6B9B9C2F3F3F35FE
                                                                                                                                                                                    SHA-256:6FD08CE6FBA521D51E8058DE5C2DBD6583B80306A8BE7D015361F76314E70A35
                                                                                                                                                                                    SHA-512:A04B946993985BF1F8FBA3A7A9AD3838F43F8F27F69B1FB1015D9DC8612AAFCE24E30CBC1FCABBDFB359FD487D51F70F18DA0CDA4A87749A2C82309CEB054849
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macIceland, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE..00FD00B7201A201E2
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):48813
                                                                                                                                                                                    Entropy (8bit):3.3767502114972077
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:K/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSJi:KVUidzJCurDGSk
                                                                                                                                                                                    MD5:3DCD22325E0194AAD4959C939B1DE24D
                                                                                                                                                                                    SHA1:ABEF1372FBDA83714CE29E015D9A198D4B37B21C
                                                                                                                                                                                    SHA-256:47007D9EBF4D34C6CE3599E50AFC7C1CF8129B88994DE2C2A857C09003F9CD2B
                                                                                                                                                                                    SHA-512:B8ADFD2315EA38E5F7D4DED219759380069AAB539F1B5AAA5626CE32428CBBEB5E8215AD8351E023BCF72FA4DC30AB40CF59D6D45E33B6D1A6B41BEBFD4BD4C2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macJapan, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1113
                                                                                                                                                                                    Entropy (8bit):3.4060725247347516
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8THVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldjBpmg4JyMWG:8TMlBVnrAMiwMmOi/LYRlTsBEXG
                                                                                                                                                                                    MD5:34691FADC788B85D98F63159640C7DD0
                                                                                                                                                                                    SHA1:C8B3D084D3E831EFF6ECEF71B2029545F214C3D4
                                                                                                                                                                                    SHA-256:C83D971D6BC0284EF323C197896E38C57A5FF44784E451EC2997EDA70C0DD85C
                                                                                                                                                                                    SHA-512:77D5676F9B7AF7FD1D612A1C426889D8F2C0191887E180B78C4AA42202928A1B3078B76BD3C5F5ABB2A5CE1AE913E3CA6EFDE0483D2A2B0EFC173EF25EAE1D67
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macRoman, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02..202100B7201A201E203
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.412326247178521
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8tHVBUlJvRj7SOVbusZhAMiZyi77qsTMVZ5OZwYRldj/T9g4JyMWG:8tMlBVnrAMiwMmOA7YRlFT9BEXG
                                                                                                                                                                                    MD5:04E25073BFB0019D8381B72F7B433F00
                                                                                                                                                                                    SHA1:B63B0AD9F10A44B0DDD12A3BDBCDEB2992D6D385
                                                                                                                                                                                    SHA-256:0B805DAF21D37D702617A8C72C7345F857695108D905FF378791F291CEA150F0
                                                                                                                                                                                    SHA-512:0514EC054676C15C65B01B02747CDBAD79BC89FD1A24A17797A8729752FB748FEDBE920E7BBFF41A6DA4BA99002E3B8DB674D53E30485DC36F6BF737EAF11702
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macRomania, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E..221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163..202100B7201A201E2
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1112
                                                                                                                                                                                    Entropy (8bit):3.6062142626989004
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:88HVBUlJvRj7SOVbusZhAMiZyi77qqJipJwHmEU4AyqU+TpH:88MlBVnrAMiwMmqJ8Jf4AyqUe
                                                                                                                                                                                    MD5:06DC6BA6E4A75CD7FF2D7A4248912C61
                                                                                                                                                                                    SHA1:23FB16763A8F11EF48E805E4F453C2F812D48FC4
                                                                                                                                                                                    SHA-256:A1802A2FEB01B255EC7C17425EEE4525372DF8CE226F4047D149172EB438F913
                                                                                                                                                                                    SHA-512:41A487EC5C36C17B2746C5DC770882A836E6E75CF6A14C31595EB211022F0476BD3B953497C447F21554769F127C3A56E5B6EF8FB3C20A8AFF8C67E0CC94359D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macThai, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899..FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F..0E400E410E420E430E44
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.422718883614008
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8QjHVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldD8g4JyS:88MlBVnrAMiwMmOi/LYRlWBES
                                                                                                                                                                                    MD5:4EA94A0DB35BED2081A2CC9D627A8180
                                                                                                                                                                                    SHA1:AB2AC3ADA19F3F656780FF876D5B536A8DCE92C6
                                                                                                                                                                                    SHA-256:AFB66138EBE9B87D8B070FE3B6E7D1A05ED508571E9E5B166C3314069D59B4E4
                                                                                                                                                                                    SHA-512:7888F560D3728732BE1B7DCE49ECB61F3399CEF11191F4116C891E1D147B2A90ED8FB4A5E7B51904A001C47750BD9EB1B15EA5BA5B4EC5D69CDE7704B69529AD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macTurkish, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F..202100B7201A201E2
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1115
                                                                                                                                                                                    Entropy (8bit):3.4157626428238723
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8TzHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJd:8PMlBVnrAMiwMm8Y6zUk+UVsJd
                                                                                                                                                                                    MD5:A5B48D6F2678579CBE6EA094A4655071
                                                                                                                                                                                    SHA1:A13A41D530B21CE8443AFD7E811286537C5BA9C7
                                                                                                                                                                                    SHA-256:F7E11736C9FF30102B31EC72272754110193B347433F4B364921E8F131C92BF0
                                                                                                                                                                                    SHA-512:612F9D528CE940B5CA9E67CB127013A104655207511F4CF39C8696A127E6A8F4867F5603DCFB78C25A55668C6EE70F2997A8D1626F6F1DD44B19260967F17097
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: macUkraine, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..04300431043204330
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42552
                                                                                                                                                                                    Entropy (8bit):3.5565924983274857
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:w/RPrUHiJrwWkyY/W2wHiwWnwWOORY+gutSX:wVUid5JCurDGSX
                                                                                                                                                                                    MD5:EEB45AF9D7104872FE290D1EC18AB169
                                                                                                                                                                                    SHA1:A80CF4EA46301F0B8B4F0BC306270D7103753871
                                                                                                                                                                                    SHA-256:4A15ED210126BCDAE32543F60EB1A0677F985F32D49FCE923B9FAE8C5BCF3DA4
                                                                                                                                                                                    SHA-512:C359042B04441AA50E536B23EEA0C6C7B2C1893DFB9CDB5459D3B46945D3BB50FD7A32A4F4E26A83622E76D3D2BB0DBBC3D1F3FB87AAF40520A243165B82AB34
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: shiftjis, multi-byte..M..003F 0 40..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086008700000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1111
                                                                                                                                                                                    Entropy (8bit):3.73983895892791
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:SdHkUlJvRjvRV7ZQsoRmSds2AsSemxUs+Jw1Viv6ObTXyn:avlJV7ZQsoRmosGSPxU/JOm6wTXyn
                                                                                                                                                                                    MD5:D59E748D863A5FAEF0CEEC2564E041A3
                                                                                                                                                                                    SHA1:4FFF3BE37F50C090FFC581F1C7769E20281E90C3
                                                                                                                                                                                    SHA-256:9660537A7B62996478555C6F57C1962C78FB3972F19370B2E395C44842818A1F
                                                                                                                                                                                    SHA-512:BF8FD0CF1CC55564C46976F53F441B26819ADBA7AB7BB04FF3FF5A313366FC3049DF29A839CCCB05EDEF4A7ECBB49FFCA62518EDA90AF2D7781874A8435073AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: symbol, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002122000023220300250026220D002800292217002B002C2212002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..22450391039203A70394039503A603930397039903D1039A039B039C039D039F..03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F..F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF..03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..000003D2203222642044221E0192266326662665266021942190219121922193..00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5..21352111211C21182297229522052229222A2283228722842282228622082209..2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3..22C42329F8E8F8E9F8EA2
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1112
                                                                                                                                                                                    Entropy (8bit):3.0553142874336943
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:ZlHVBUlJvRj7SOVbusZhAMiZyi77qsDHmEU4AyqU+TWwdd:PMlBVnrAMiwMmss4AyqUSd
                                                                                                                                                                                    MD5:467A67DE6809B796B914F5BFF98EF46D
                                                                                                                                                                                    SHA1:C62418071A6C9CB0DCE3F67E130BFD2FB7AB0B58
                                                                                                                                                                                    SHA-256:50B62381D6EDD4219F4292BFDC365954491B23360DE7C08033E7218A3D29C970
                                                                                                                                                                                    SHA-512:BF98305AA7D759A087B9EABDC404714D8DC6B4F1BEED4ED0E1FFE646641E1AECA307673D64CF95FD09546D977B3409D6C04F56DCCA1D6332B0D9B6DD460B77A9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Encoding file: tis-620, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E44
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8235
                                                                                                                                                                                    Entropy (8bit):4.855903177272536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Hf8PxPu7pUHBpqyzmY5rEk/fvs+AokFlTGHts1H/tsEGZPBtsLIVn++G:H6Pu7ELJTtyli8Ozz+L
                                                                                                                                                                                    MD5:8609B624CD3EC63DD02DBF89455C3A9B
                                                                                                                                                                                    SHA1:B3E1843E34C38AA668FFDDF435A1A65D55449CA0
                                                                                                                                                                                    SHA-256:5123DB837EADF45712EA7D449BC40BFD3E8E16D3D71E7D0CE9A32F164973D767
                                                                                                                                                                                    SHA-512:B20B75473F34209888F38EE570B8A96061760E88466DFC2EC55C814968DC7F67D92D255E8635188B60455B88F2D1D517747613AD0F366D60412D2D6ECE231B0E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# history.tcl --..#..# Implementation of the history command...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.....# The tcl::history array holds the history list and some additional..# bookkeeping variables...#..# nextid.the index used for the next history list item...# keep..the max size of the history list..# oldest.the index of the oldest item in the history.....namespace eval ::tcl {.. variable history.. if {![info exists history]} {...array set history {... nextid.0... keep.20... oldest.-20...}.. }.... namespace ensemble create -command ::tcl::history -map {...add.::tcl::HistAdd...change.::tcl::HistChange...clear.::tcl::HistClear...event.::tcl::HistEvent...info.::tcl::HistInfo...keep.::tcl::HistKeep...nextid.::tcl::HistNextID...redo.::tcl::HistRedo.. }..}.....# history --..#..#.This is the main history command. See the
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10066
                                                                                                                                                                                    Entropy (8bit):4.806771544139381
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:kipkqA3KsZMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsZ8kGJ4kIWPaDFzTd
                                                                                                                                                                                    MD5:C2092F8CA2D761DFA8C461076D956374
                                                                                                                                                                                    SHA1:90B4648B3BC81C30465B0BE83A5DB4127A1392FB
                                                                                                                                                                                    SHA-256:8C474095A3ABA7DF5B488F3D35240D6DE729E57153980C2A898728B8C407A727
                                                                                                                                                                                    SHA-512:09CE408886E2CEADDF70786A15D63AF9A930E70CAC4286AC9DDD2094C8EDCF97A2ADC2D3D2659B123F88719340D3B00D9F96E9BC7C8B55192735C290E7D24683
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# http.tcl..# Client-side HTTP for GET, POST, and HEAD commands...# These routines can be used in untrusted code that uses the Safesock..# security policy...# These procedures use a callback interface to avoid using vwait,..# which is not defined in the safe base...#..# See the http.n man page for documentation....package provide http 1.0....array set http {.. -accept */*.. -proxyhost {}.. -proxyport {}.. -useragent {Tcl http client package 1.0}.. -proxyfilter httpProxyRequired..}..proc http_config {args} {.. global http.. set options [lsort [array names http -*]].. set usage [join $options ", "].. if {[llength $args] == 0} {...set result {}...foreach name $options {... lappend result $name $http($name)...}...return $result.. }.. regsub -all -- - $options {} options.. set pat ^-([join $options |])$.. if {[llength $args] == 1} {...set flag [lindex $args 0]...if {[regexp -- $pat $flag]} {... return $http($flag)...} else {... return -code er
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):746
                                                                                                                                                                                    Entropy (8bit):4.711041943572035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:jHx5XRsLzhjJS42wbGlTULuUAZb3KykszLl7+HkuRz20JSv6C3l5kMn:bHRsRJS42wbGlTUcZ+yk2Lli1z2jxXkM
                                                                                                                                                                                    MD5:A387908E2FE9D84704C2E47A7F6E9BC5
                                                                                                                                                                                    SHA1:F3C08B3540033A54A59CB3B207E351303C9E29C6
                                                                                                                                                                                    SHA-256:77265723959C092897C2449C5B7768CA72D0EFCD8C505BDDBB7A84F6AA401339
                                                                                                                                                                                    SHA-512:7AC804D23E72E40E7B5532332B4A8D8446C6447BB79B4FE32402B13836079D348998EA0659802AB0065896D4F3C06F5866C6B0D90BF448F53E803D8C243BBC63
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Tcl package index file, version 1.0..# This file is generated by the "pkg_mkIndex" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}]..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):25633
                                                                                                                                                                                    Entropy (8bit):4.8854383645737895
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
                                                                                                                                                                                    MD5:982EAE7A49263817D83F744FFCD00C0E
                                                                                                                                                                                    SHA1:81723DFEA5576A0916ABEFF639DEBE04CE1D2C83
                                                                                                                                                                                    SHA-256:331BCF0F9F635BD57C3384F2237260D074708B0975C700CFCBDB285F5F59AB1F
                                                                                                                                                                                    SHA-512:31370D8390C4608E7A727EED9EE7F4C568ECB913AE50184B6F105DA9C030F3B9F4B5F17968D8975B2F60DF1B0C5E278512E74267C935FE4EC28F689AC6A97129
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# init.tcl --..#..# Default system startup file for Tcl-based applications. Defines..# "unknown" procedure and auto-load facilities...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2004 Kevin B. Kenny. All rights reserved...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# This test intentionally written in pre-7.5 Tcl..if {[info commands package] == ""} {.. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]"..}..package require -exact Tcl 8.6.12....# Compute the auto path to use in this interpreter...# The values on the path come from several locations:..#..# The environment variable TCLLIBPATH..#..# tcl_library, which is the directory containing this init.tcl script...# [t
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1038
                                                                                                                                                                                    Entropy (8bit):4.10054496357204
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:4EnLB383Hcm0hH9BncmtR7tK9dUVxMmALfpKIdzVJLd3xfjTuLM+vzkHWZ6tH9H0:4aR838HH9ekCkMmEfpK2xx2jiWZ0VbY
                                                                                                                                                                                    MD5:DA8BA1C3041998F5644382A329C3C867
                                                                                                                                                                                    SHA1:CA0BD787A51AD9EDC02EDD679EEEEB3A2932E189
                                                                                                                                                                                    SHA-256:A1EACA556BC0CFBD219376287C72D9DBBFAB76ECF9BF204FD02D40D341BAF7DA
                                                                                                                                                                                    SHA-512:4F086396405FDFE7FBDA7614D143DE9DB41F75BDBD3DB18B1EE9517C3DCCED238DD240B4B64829FD04E50F602DBF371D42A321D04C4C48E4B8B2A067CA1BAF2E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Ma"\.. "Di"\.. "Wo"\.. "Do"\.. "Vr"\.. "Sa"].. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \.. "Sondag"\.. "Maandag"\.. "Dinsdag"\.. "Woensdag"\.. "Donderdag"\.. "Vrydag"\.. "Saterdag"].. ::msgcat::mcset af MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset af MONTHS_FULL [list \.. "Januarie"\.. "Februarie"\.. "Maart"\.. "April"\.. "Mei"\.. "Junie"\.. "Julie"\.. "Augustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""].. ::msgcat::mcset af AM "VM
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.925537696653838
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xouFygMouFqF3v6ay/5ouFy9+3vR6HyFvn:4EnLB383RAgeYF3v6ay/RAI3voSVn
                                                                                                                                                                                    MD5:1B9DCD1C6FCDDC95AE820EA8DA5E15B8
                                                                                                                                                                                    SHA1:E8160353FD415BAB9FD5ACCA14E087C5E6AE836E
                                                                                                                                                                                    SHA-256:1548988458BBF0DFCCC23B7487CEC0E9C64E4CC8E045723E50BEC37C454A8C81
                                                                                                                                                                                    SHA-512:532AF060B95AED5E381B161BE56BC88D91A8F3DF2ACFD835491991F99FE752ADB4A3F93AB6D4E68F7042C28A3C1DD87A6312DFD9FFFAFD6ECE3F1B76837C5B7F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y".. ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2018
                                                                                                                                                                                    Entropy (8bit):4.477377447232708
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83gr/fsS/Sm8p4M/n1KsPktE30AiJcAxi9CEzdEvSCHvMSV:43UkiSm8p3nX0EzdCSCPV
                                                                                                                                                                                    MD5:D264D01B46D96455715114CAEDF9F05E
                                                                                                                                                                                    SHA1:A3F68A4C6E69433BD53E52B73041575F3B3AC3F2
                                                                                                                                                                                    SHA-256:B69D0061A728D59F89FF8621312789CD9F540BF2E2ED297804D22F6278561D85
                                                                                                                                                                                    SHA-512:A4163DAA6821B293EADD5D499E0641A8B7C93180C710D6B364AE8681A8FF6F35EC948C8DDBE960A8466AF1ACABC15B0D465A08B084617E8005D708459F7E74D3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \.. "\u062d"\.. "\u0646"\.. "\u062b"\.. "\u0631"\.. "\u062e"\.. "\u062c"\.. "\u0633"].. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar MONTHS_ABBREV [list \.. "\u064a\u0646\u0627"\.. "\u0641\u0628\u0631"\.. "\u0645\u0627\u0631"\.. "\u0623\u0628\u0631"\.. "\u0645\u0627\u064a"\.. "\u064a\u0648\u0646"\.. "\u064a\u0648\u0644"\.. "\u0623\u063a\u0633"\.. "\u0633\u0628\u062a"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):265
                                                                                                                                                                                    Entropy (8bit):4.872222510420193
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoKNvfcoKU3v6xyFjoKNo+3vfXM68vn:4EnLB3831vfD3v6g9F3vfc6+n
                                                                                                                                                                                    MD5:430498B4AB1E77C86BC1311A49747581
                                                                                                                                                                                    SHA1:684EAD965D9010C2A6E73DCACB2224FDE585F9FF
                                                                                                                                                                                    SHA-256:2E04B96DA002519D28125918A22FF2BB9659A668A7BCAD34D85DDDECEC8DC0B4
                                                                                                                                                                                    SHA-512:9F85A88A383DCFC54DAA6253D94C307A14B1CC91D5C97AF817B8122AF98025AB2430D0B2D656EBED09E78FB854D1F9CF99F3B791A6ECB7834112012739140126
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y".. ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1851
                                                                                                                                                                                    Entropy (8bit):4.08645484776227
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83sxS/Sm819+es/Ii/R91bpH0+U0c+es/Ii/R91bpH0+UO:43wiSm815MbJbHgMbJbp
                                                                                                                                                                                    MD5:5C62D606F4F14BC8994B28F9622D70DD
                                                                                                                                                                                    SHA1:E99F8CC5D330085545B05B69213E9D011D436990
                                                                                                                                                                                    SHA-256:5ADBB3D37C3369E5FC80D6A462C82598D5A22FAEF0E8DF6B3148231D2C6A7F73
                                                                                                                                                                                    SHA-512:81AC9200459B0896E27A028BD089A174F7F921B0367BC8FF1AB33D3E561417B6F8EC23DAB750ECB408AC8A11CDFDBFA4F890F9E723BB8607B017C9FEE00928A0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1851
                                                                                                                                                                                    Entropy (8bit):4.083347689510237
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83LxS/Sm8S9+es/Ii/R91bpH0+U/c+es/Ii/R91bpH0+UO:431iSm8S5MbJbQgMbJbp
                                                                                                                                                                                    MD5:6FC1CC738207E2F8E0871103841BC0D4
                                                                                                                                                                                    SHA1:D2C62C7F6DA1EF399FCBE2BA91C9562C87E6152F
                                                                                                                                                                                    SHA-256:1FC13070CF661488E90FECE84274C46B1F4CC7E1565EAB8F829CCAA65108DFCA
                                                                                                                                                                                    SHA-512:E547D5CBB746654051AFDA21942075BC2224C2FF75D440C6C34C642AD24CF622E520FF919B8BD4AFC0116D9CE69B3ABA4E81EE247C1388F3C5741150201F5C60
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1851
                                                                                                                                                                                    Entropy (8bit):4.084701680556524
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83lxS/Sm8M9+es/Ii/R91bpH0+UBc+es/Iv/I91bpH0+UO:43LiSm8M5MbJbSgMo0bp
                                                                                                                                                                                    MD5:8188C37CA44FEFFF8D895AAD503AD4F6
                                                                                                                                                                                    SHA1:C48F2E3B9FC055704D2DAFDC67E9D08EE6897D45
                                                                                                                                                                                    SHA-256:294F3E46C55453EDAD44567E1330F9B43E69A07FA0655B24DD2780A4490C1194
                                                                                                                                                                                    SHA-512:F86FCFC7C460473D46C472041AB2E1F9388CF34BCA9050295D1DAE454E35A2A0320D0C61D5E8CBB832AF74FFDD1A7511AF32EA2A53B481F39A1CBCF5F086D514
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2157
                                                                                                                                                                                    Entropy (8bit):4.27810535662921
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:43PI8IKQGQ8mA/XxQJxQnA9QJlPyI/tbCaQICMIcQ8InVI5tNIzQFIQQLtChjsI4:2PItK5BSb9ajfycCW5IzdQNxK
                                                                                                                                                                                    MD5:6334BDDFC1E0EAE4DBB2C90F85818FD8
                                                                                                                                                                                    SHA1:085EDC3D027D6B5A6A6A2561717EA89C8F8B8B39
                                                                                                                                                                                    SHA-256:A636A82C7D00CCDC0AF2496043FFA320F17B0D48A1232708810D3BB1453E881E
                                                                                                                                                                                    SHA-512:18ADB77314FCFD534E55B234B3A53A0BC572AB60B80D099D2F3B20E0C5FE66179FDC076AA43200DB3CA123BC6216989EC41448FA624D3BA9633413AD8AD6034C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0430\u0442"\.. "\u0441\u0440"\.. "\u0447\u0446"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \.. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\.. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\.. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\.. "\u0441\u0435\u0440\u0430\u0434\u0430"\.. "\u0447\u0430\u0446\u0432\u0435\u0440"\.. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset be MONTHS_ABBREV [list \.. "\u0441\u0442\u0434"\.. "\u043b\u044e\u0442"\.. "\u0441\u043a\u0432"\.. "\u043a\u0440\u0441"\.. "\u043c\u0430\u0439"\.. "\u0447\u0440\u0432"\.. "\u043b\u043f\u043d"
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1871
                                                                                                                                                                                    Entropy (8bit):4.4251657008559935
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:43EUAIlnQf/QVdQ81mnEZqEavWQEQ3QvQrQL0QjQTtQDCQSY4tqP:27xMk+nEZqE3biIYbUi+C9y
                                                                                                                                                                                    MD5:E5225D6478C60E2502D18698BB917677
                                                                                                                                                                                    SHA1:52D611CB5351FB873D2535246B3A3C1A37094023
                                                                                                                                                                                    SHA-256:CFE4E44A3A751F113847667EC9EA741E762BBDE0D4284822CB337DF0F92C1ACA
                                                                                                                                                                                    SHA-512:59AB167177101088057BF4EE0F70262987A2177ECB72C613CCAAE2F3E8D8B77F07D15DA5BE3B8728E23C31A1C9736030AA4036A8CD00A24791751A298B3A88B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0434"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u043b\u044f"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0421\u0440\u044f\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\.. "\u041f\u0435\u0442\u044a\u043a"\.. "\u0421\u044a\u0431\u043e\u0442\u0430"].. ::msgcat::mcset bg MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset bg MO
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2335
                                                                                                                                                                                    Entropy (8bit):4.107102006297273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR835e/MWrD//6HFEVcVVcCVcTUTVckVEVcT7VcEEVcby/Vcn0VcMr/0VcM8VcQ:43ktX++QalMObalMZ6IE6V
                                                                                                                                                                                    MD5:5D25E7FC65824AC987535FEA14A4045C
                                                                                                                                                                                    SHA1:85C10F05823CD3263FC7B3EC38796BEC261B3716
                                                                                                                                                                                    SHA-256:890EA6521DEB1B3C3913CCD92562F6360E064DAEE2E2B0356A6DD97A46264A1F
                                                                                                                                                                                    SHA-512:5D8A88ACAEBBF3CD721F288FA0F1FEE517EE568CA5482E30CFA1E36CD37DF011C449090E2D9041F1D046A191F13D4C5C4B6F9E2F16FD259E63CE46ECC4E4F81F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \.. "\u09b0\u09ac\u09bf"\.. "\u09b8\u09cb\u09ae"\.. "\u09ae\u0999\u0997\u09b2"\.. "\u09ac\u09c1\u09a7"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\.. "\u09b6\u09c1\u0995\u09cd\u09b0"\.. "\u09b6\u09a8\u09bf"].. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \.. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\.. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\.. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\.. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\.. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\.. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"].. ::msgcat::mcset bn MONTHS_ABBREV [list \.. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\.. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):265
                                                                                                                                                                                    Entropy (8bit):4.868201122972066
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xovtvfluo/E3v6xyFjovto+3vflm68vn:4EnLB383UtvfltE3v6g8tF3vflm6+n
                                                                                                                                                                                    MD5:B91BB2ABC23B90962D2070B9588F2AB5
                                                                                                                                                                                    SHA1:CBB4E9CD600773792C6E9F3E6B27E99C1846B44F
                                                                                                                                                                                    SHA-256:B3D8A4632290B0F3DA690E47C1FDF06A8B9E171A96E938AFDB0DD52CF806CE54
                                                                                                                                                                                    SHA-512:932FC4B8C3CA72731187D56012AD7DD7777C4D447F16EEB17B9D68235C9590DF99992FD22B8D7C85A843A610F93CD36FAFA993C34C441255A1C0A93C73BC5FE4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1152
                                                                                                                                                                                    Entropy (8bit):4.2880653012847985
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83FMVBNfPg+g+RjMu5+C6MB4zdiwvWvn:432g6jh65zd3gn
                                                                                                                                                                                    MD5:72DDD60C907DD235BCE4AB0A5AEE902C
                                                                                                                                                                                    SHA1:06150F793251687E6FBC3FDA3BC81BCBFC7DE763
                                                                                                                                                                                    SHA-256:3BE295DCC8FCDC767FED0C68E3867359C18E7E57D7DB6C07236B5BC572AD328E
                                                                                                                                                                                    SHA-512:3B0A85003692F1E46185D5CC09236D2DA5E6D29166C9812D07A7D6BF6AC6C3B0708F91C6899768D4DBA3528081B8B43E09F49622B70F1CF991AFAC5352B6BA37
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \.. "dg."\.. "dl."\.. "dt."\.. "dc."\.. "dj."\.. "dv."\.. "ds."].. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \.. "diumenge"\.. "dilluns"\.. "dimarts"\.. "dimecres"\.. "dijous"\.. "divendres"\.. "dissabte"].. ::msgcat::mcset ca MONTHS_ABBREV [list \.. "gen."\.. "feb."\.. "mar\u00e7"\.. "abr."\.. "maig"\.. "juny"\.. "jul."\.. "ag."\.. "set."\.. "oct."\.. "nov."\.. "des."\.. ""].. ::msgcat::mcset ca MONTHS_FULL [list \.. "gener"\.. "febrer"\.. "mar\u00e7"\.. "abril"\.. "maig"\.. "juny"\.. "juliol"\.. "agost"\.. "setembre"\.. "octubre"\.. "novembre"\.. "desembre"\.. ""].. ::msg
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1354
                                                                                                                                                                                    Entropy (8bit):4.466447248030554
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83U4nZ4yJTkkG3mYWEZqO1R3DNBEVG+PYhxrU4UF3ecCvt7/v3e6:43TJTGmnEZqE5/EVEDOGtDp
                                                                                                                                                                                    MD5:F32EAD82CC26754C5A8E092873A28DB3
                                                                                                                                                                                    SHA1:325124660F62242B24623B4B737CB4616F86CFF3
                                                                                                                                                                                    SHA-256:AFEA12A16A6FA750EA610245133B90F178BA714848F89AEC37429A3E7B06BE1A
                                                                                                                                                                                    SHA-512:04E335AAFBF4D169983635FC87BCFFE86FBA570A3E1820D20240EF7B47E7A3CD94AE3598543DCE92A1F82B5146CAAD982EFE9490EFD9E581D58515CFC3930581
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "\u00dat"\.. "St"\.. "\u010ct"\.. "P\u00e1"\.. "So"].. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \.. "Ned\u011ble"\.. "Pond\u011bl\u00ed"\.. "\u00dater\u00fd"\.. "St\u0159eda"\.. "\u010ctvrtek"\.. "P\u00e1tek"\.. "Sobota"].. ::msgcat::mcset cs MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset cs MONTHS_FULL [list \.. "leden"\.. "\u00fanor"\.. "b\u0159ezen"\.. "duben"\.. "kv\u011bten"\.. "\u010derven"\.. "\u010dervenec"\.. "srpen"\.. "z\u00e1\u0159\u00ed"\.. "\u0159\u00edjen"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1208
                                                                                                                                                                                    Entropy (8bit):4.315504392809956
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83wV0tBVYuorIsmZ5meAxyISjTHU92WFVwpwvbvT:43w+DiuorreAY0zw8rT
                                                                                                                                                                                    MD5:27A6A8BE8903AEF9D0BE956906A89583
                                                                                                                                                                                    SHA1:EE29FDF67CB3AE150DF6BBBE603C1C3F5DA28641
                                                                                                                                                                                    SHA-256:0D422A991BCA13FE9033118691CFEDAB0F372222EBB0BC92BAF8E914EE816B84
                                                                                                                                                                                    SHA-512:0E702A679AD94BF479226B7DE32077562F3F95210F6453AE564138386DBB179941BA5359AEE9AC532F4A6E5BE745D6962D6B638A21DD48B865716F2FD2A0CB01
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset da MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset da MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marts"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset da B
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1276
                                                                                                                                                                                    Entropy (8bit):4.349293509679722
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83cFNSsZKKgXum47fpK2OaSIui7dHqWZ0ZIBFJWJvvvWIn:43InZKKgXoOqx1W67W9XWIn
                                                                                                                                                                                    MD5:EE3963A5F7E29C05C9617BE3FD897114
                                                                                                                                                                                    SHA1:0F978CA174DF596817F872B5EF1B447B9DFE651C
                                                                                                                                                                                    SHA-256:4C27733502066E8391654D1D372F92BF0484C5A3821E121AE8AA5B99378C99AE
                                                                                                                                                                                    SHA-512:EA933709C68F8199858A1CC1FFDA67EE7458CC57A163E672535EB0B4C37BFDC200604C7506748DAC3158B6CA63C2F076A2C6252B2A596E59F83D3B1D4BC9C901
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Mo"\.. "Di"\.. "Mi"\.. "Do"\.. "Fr"\.. "Sa"].. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mrz"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de BCE "v.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):847
                                                                                                                                                                                    Entropy (8bit):4.412930056658995
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR831sMm47fpK2++SIui7dHqWZ0ZItovGvzvW:431h+mx1Wm+QjW
                                                                                                                                                                                    MD5:A6227CD4F7434952D093F1F3C64B4378
                                                                                                                                                                                    SHA1:0DDB9A49CB83DDF2396B2ECA85093260710496C2
                                                                                                                                                                                    SHA-256:1C02D14140196623297F858E2EEF00B4159E1C6FAFE044EC65A48C9C24D46540
                                                                                                                                                                                    SHA-512:D63F34024356F5CE0335D14EA557F4BBF238CCA8265DD27C039C70F7F28FE737F368B030DEE10B2C536512D2815E1F5B19838D08745C6A76A39050D573597EB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_AT MONTHS_ABBREV [list \.. "J\u00e4n"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_AT MONTHS_FULL [list \.. "J\u00e4nner"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset de_AT TIME_FORMAT "%T".. ::msgcat::mcset de_AT TIME_FORMAT_12 "%T".. ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1276
                                                                                                                                                                                    Entropy (8bit):4.389082225723362
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83B8VSysVB8VsZKKgJ5Mm47fpK26aSIui7dHqWZ0ZIlj5VevjevbDvW:43Bt1VBbZKKgJs6qx1Wc5VojobzW
                                                                                                                                                                                    MD5:C351057D8E5328C0790901D1F4DBEC9F
                                                                                                                                                                                    SHA1:F73DE8AEF7F8083B0726760AA003E81067A68588
                                                                                                                                                                                    SHA-256:532845CD15EC821C1939D000C648694A64E8CA8F0C14BAD5D79682CF991481CE
                                                                                                                                                                                    SHA-512:8152AD082D0A6A4EBE7E1CCA9D4A5F2E48ABE3F09F4385A517C523A67CA3B08E0F20C193D0F6850F37E55ED0CD6FBD201FE22CC824AF170976D04DB061212F2D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \.. "Son"\.. "Mon"\.. "Die"\.. "Mit"\.. "Don"\.. "Fre"\.. "Sam"].. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de_BE MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_BE MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::m
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2304
                                                                                                                                                                                    Entropy (8bit):4.371322909589862
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR833v+ZYYWtv+nWfFyL1NYOg+EKVJQ19tWQYmYaYRn9sWuSAJIJ6eRa6WrmdlX:43/pZyLjY0uYR9QmdkjC9r
                                                                                                                                                                                    MD5:7DD14B1F4FF532DCAF6D4C6F0DF82E9A
                                                                                                                                                                                    SHA1:707875FEF4207EBB71D066FDC54C7F68560C6DAD
                                                                                                                                                                                    SHA-256:8B23E0E2F0F319BB9A2DFDCCDC565FF79A62FA85094811189B6BC41594232B6B
                                                                                                                                                                                    SHA-512:5ECA072DE5DD7890270AE268C7C8D40EE2DB6966643604D16E54194DB0AD74FDA8D04848331E61B387E8B494AF18252E38671D939069EC4C90C672A629563B88
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \.. "\u039a\u03c5\u03c1"\.. "\u0394\u03b5\u03c5"\.. "\u03a4\u03c1\u03b9"\.. "\u03a4\u03b5\u03c4"\.. "\u03a0\u03b5\u03bc"\.. "\u03a0\u03b1\u03c1"\.. "\u03a3\u03b1\u03b2"].. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \.. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\.. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\.. "\u03a4\u03c1\u03af\u03c4\u03b7"\.. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\.. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\.. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\.. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"].. ::msgcat::mcset el MONTHS_ABBREV [list \.. "\u0399\u03b1\u03bd"\.. "\u03a6\u03b5\u03b2"\.. "\u039c\u03b1\u03c1"\.. "\u0391\u03c0\u03c1"\.. "\u039c\u03b1\u03ca"\.. "\u0399\u03bf\u
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):307
                                                                                                                                                                                    Entropy (8bit):4.896073290907262
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoCwmGjbmvFjoCws6W3v1oCws6W3v6p6HyFjoCwmT+3vjbe:4EnLB383QrmdSs6W3vss6W3v6QSoJ3ve
                                                                                                                                                                                    MD5:5B31AD8AC0000B01C4BD04BF6FC4784C
                                                                                                                                                                                    SHA1:F55145B473DDCAE38A0F7297D58B80B12B2A5271
                                                                                                                                                                                    SHA-256:705C66C14B6DE682EC7408EABDBA0800C626629E64458971BC8A4CBD3D5DB111
                                                                                                                                                                                    SHA-512:1CCE6BCAE5D1F7D80E10687F0BCA2AE1B2DD53F04A0F443DC9B552804D60E708E64326B62BA4E3787325D89837B4AC8CCCA9AF6F39CBD654BCC8A9C27EA63BB8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):312
                                                                                                                                                                                    Entropy (8bit):4.870560620756039
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoCr3FuoCsX3vtfNrsoCsX3v6YNIdjoCs+3v3FnN9vn:4EnLB383H3Fb3vtNN3v6y43v3FnNNn
                                                                                                                                                                                    MD5:DDA87ACED97F9F7771788A1A0A1E4433
                                                                                                                                                                                    SHA1:E221653CD659C095098180344654770FF059331B
                                                                                                                                                                                    SHA-256:BC87754A253C1036E423FA553DA182DBC56F62A13EDA811D8CD9E8AFA40404A6
                                                                                                                                                                                    SHA-512:BB95D9241B05686CA15C413746DD06071635CB070F38847BE9702397A86C01A3D54DEBE1ACAA51834AB74DB8D0F75E353995183864E382721425756EE46B0B1E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z".. ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.915769170926952
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xosmGMoss6W3v6ay/5osmT+3vR6HyFvn:4EnLB383hr8s6W3v6ay/hJ3voSVn
                                                                                                                                                                                    MD5:4CBF90CE15ECCB6B695AA78D7D659454
                                                                                                                                                                                    SHA1:30C26ADB03978C5E7288B964A14B692813D6E0B8
                                                                                                                                                                                    SHA-256:EC48F18995D46F82B1CC71EA285174505A50E3BA2017BCCE2D807149B7543FD0
                                                                                                                                                                                    SHA-512:CC809EBD1B2B5D9E918C2E2CE4E7075DFB0744C583F17C1C234D8437EF0C34654D2F09FF77544AD3430CEC78ABC70AA5F85F71AD1489A687B8087FCDFE07B088
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):295
                                                                                                                                                                                    Entropy (8bit):4.87629705076992
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoAhgqyFjoAZF3vX5oAZF3v6cvBoAh9+3vnFDL8vn:4EnLB383FhgqWDZF3vVZF3v6cvdhI3vM
                                                                                                                                                                                    MD5:BFC4A48F5B10D137A4D32B440C47D3C6
                                                                                                                                                                                    SHA1:C90EF2A8291DE589BC12D0A5B8AF2F0B00FEB7CD
                                                                                                                                                                                    SHA-256:3CF2D0937FD95264549CF5C768B898F01D4875A3EB4A85D457D758BC11DFEC6E
                                                                                                                                                                                    SHA-512:A91B81A956A438CA7274491CA107A2647CBDFB8AEB5FD7A58238F315590C74F83F2EBA4AA5C4E9A4A54F1FC1636318E94E5E4BBEA467326E0EACED079741E640
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_CA TIME_FORMAT "%r".. ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p".. ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.892405843607203
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoEbtvqyFjoELE3vLjoELE3v6mjoEbto+3vnFDoAkvn:4EnLB383BbtvqWHLE3vTLE3v6EbtF3vW
                                                                                                                                                                                    MD5:52E55DE8C489265064A01CEEC823DCDD
                                                                                                                                                                                    SHA1:16F314A56AE0EAC9DAD58ADDEA6B25813A5BAA05
                                                                                                                                                                                    SHA-256:C2CE5B74F9E9C190B21C5DF4106303B7B794481228FB9A57065B9C822A1059C3
                                                                                                                                                                                    SHA-512:6010F29BF75D0CB4EE4F10781423A8CC68D5018DE8C633CD1217A7FE1299A0532E8C0E5D120188B748171EB255C587BB0B64B7384A58F725F3B6A4B9EA04393E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_GB TIME_FORMAT "%T".. ::msgcat::mcset en_GB TIME_FORMAT_12 "%T".. ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):329
                                                                                                                                                                                    Entropy (8bit):4.851471679101967
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoa+joaQ9PoaAx/G4soaYYW3v6ay/5oaAx/T+3v4x6HyFvn:4EnLB383BSiF4KxW3v6ay/B/3v4ISVn
                                                                                                                                                                                    MD5:DE2A484508615D7C1377522AFF03E16C
                                                                                                                                                                                    SHA1:C27C0D10E7667AD95FFF731B4E45B2C6E665CC36
                                                                                                                                                                                    SHA-256:563450A38DB6C6A1911BC04F4F55B816910B3E768B1465A69F9B3BD27292DBEE
                                                                                                                                                                                    SHA-512:A360B0FD7E36BCC0FB4603D622C36199E5D4C705396C6701F29730EB5CB33D81B208541CADFAED5303FC329C7C6A465D23CA9584F0DEC2DE128E258478DD6661
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_HK AM "AM".. ::msgcat::mcset en_HK PM "PM".. ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.833246107458447
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoK6qyFjoKi+3vLjoKi+3v6mjoKv+3vnFDoAkvn:4EnLB383CqW13vJ3v6b3v9dmn
                                                                                                                                                                                    MD5:57F0BBE1316D14BC41D0858902A7980A
                                                                                                                                                                                    SHA1:B68BF99A021B9F01FE69341DF06F5D1453156A97
                                                                                                                                                                                    SHA-256:9E0DCEE86A03B7BDD831E0008868A9B874C506315BF01DF3982AD3813FD3BA8E
                                                                                                                                                                                    SHA-512:864F32254AAD39859AFC47D0C90DC5F38CA86EF0BBC7DE61BE253756C22B7806E616B59802C4F4D7B2F5543BF7C070FFF6FAF253E0A337EC443337E63A2E5A57
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_IE TIME_FORMAT "%T".. ::msgcat::mcset en_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):318
                                                                                                                                                                                    Entropy (8bit):4.80637980762728
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoKr3ujoKrGtoKr5vMoKrw3v1oKr5o+3voAsvn:4EnLB383T9xvT3vJF3vonn
                                                                                                                                                                                    MD5:1A54E506E70B2125C6016B373D3DD074
                                                                                                                                                                                    SHA1:15289902BAA93208D8FB224E119166D0E044E34E
                                                                                                                                                                                    SHA-256:ADEA3A1AB8AA84237DDB2F276ABDB96DCB4C51932E920D1A5E336904E1138664
                                                                                                                                                                                    SHA-512:0D663233E6C96515713B3B829B605E72D8CE581AEF1C02FF6CA96598C040DCA42A3AC765EE9B5002E8969A331EB19A9AF0F8215F7113D0AD2F2EB2C560239D53
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IN AM "AM".. ::msgcat::mcset en_IN PM "PM".. ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):307
                                                                                                                                                                                    Entropy (8bit):4.939458132662909
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoyejbmvFjo63v1o63v6p6HyFjoy7+3vjb0ysvn:4EnLB383temdj3vd3v6QS1S3ven
                                                                                                                                                                                    MD5:7E81708F107658FFD31C3BFBF704A488
                                                                                                                                                                                    SHA1:7941ED040707591B68581337F8D90FA03C5E1406
                                                                                                                                                                                    SHA-256:EC305B7CB393421E6826D8F4FEA749D3902EBA53BFA488F2B463412F4070B9ED
                                                                                                                                                                                    SHA-512:8F038FF960F81D96FF9E3454D8ABDA7FFDA5B99DA304ACECC42E74DDBED839388246F66B58928DA902D3B475FBA46602B34F6829A87ECB1124FFC47C036B4DBE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):329
                                                                                                                                                                                    Entropy (8bit):4.824360175945298
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoojoOo2e4soe3v6ay/5o27+3v4x6HyFvn:4EnLB38304u3v6ay/k3v4ISVn
                                                                                                                                                                                    MD5:E2E3BD806C20D7FB88109B7F3B84C072
                                                                                                                                                                                    SHA1:2D7AD6BECA9C4D611BAE9747AD55A3E9385C2B42
                                                                                                                                                                                    SHA-256:3A9C22B07906544C04F7A29B800FCE87C09D7FDF5C251236925115CF251A3890
                                                                                                                                                                                    SHA-512:B14756B59BCABF8B29B41AC688E4F3A011735AF190B88F88B7B5FDDD3DA77F63FFC0F7875B3B453729CD3BC65E79F75F6E632CA68952EF473F78337D89E80BF2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_PH AM "AM".. ::msgcat::mcset en_PH PM "PM".. ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.911413468674953
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoQW53FuoQGuX3v6ZwoQWa+3v3F0fxvn:4EnLB383V83FOJ3v62c3v3FEn
                                                                                                                                                                                    MD5:F70245D73BE985091459ADF74B089EBC
                                                                                                                                                                                    SHA1:21D52C336C08526D9DCF1AEC1F0701CB8B073D7A
                                                                                                                                                                                    SHA-256:D565679AE9AACBFE3B5273FE29BD46F46FFBB63C837D7925C11356D267F5FF82
                                                                                                                                                                                    SHA-512:171C70EB10D5E6421A55CE9B1AE99763E23FB6A6F563F69FE099D07C07FCA0CF8D3F6F00C5BB38BFF59A5F4C311506C4A9593F86C12B3B9E1861E72656B3800B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):251
                                                                                                                                                                                    Entropy (8bit):4.937431055623088
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoOr0lIZoOK3v6poOs+3v0l6Uvn:4EnLB383z+3v6R3vl2n
                                                                                                                                                                                    MD5:FCA7B13CA6C9527D396A95BEA94CC92D
                                                                                                                                                                                    SHA1:E6F338A08F72DA11B97F70518D1565E6EF9AD798
                                                                                                                                                                                    SHA-256:67C253E2A187AA814809418E5B7A21F3A1F9FB5073458A59D80290F58C6C1EB4
                                                                                                                                                                                    SHA-512:37B8B4EA24B1C77AF0252A17660650CB2D4F8BB55C75817D6A94E1B81A3DDEF9913D12D3BF80C7BFE524CD0AD84E353E73238056759E6545BFE69EF5F806B8B7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d".. ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S".. ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.934659260313229
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoEmGMoEs6W3v6ay/5oEmT+3vR6HyFvn:4EnLB383Zr0s6W3v6ay/ZJ3voSVn
                                                                                                                                                                                    MD5:A302091F490344B7A79C9463480AD7CF
                                                                                                                                                                                    SHA1:E3992D665077177BAD5A4771F1BAF52C2AD1829C
                                                                                                                                                                                    SHA-256:6F4754CE29DFA4F0E7957923249151CE8277395D1AF9F102D61B185F85899E4E
                                                                                                                                                                                    SHA-512:FEBDB0BD6D0FD4C592DB781836F93F0C579399D324112F8829B769303CC6EEA487AAB14EBD60ED1B4F3B3DABF501601C9F65656327FF54853BF2CD9EC6A2F00F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1285
                                                                                                                                                                                    Entropy (8bit):4.3537859241297845
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83dRb4vyomrIsmZ55vrAO0LH+50ydAcveva:43PT5rWvrAR60yW6oa
                                                                                                                                                                                    MD5:D87605E6282713EED41D56D53B7A04FD
                                                                                                                                                                                    SHA1:41AAD4BD3B72CCBB6A762FEED3C24931642DD867
                                                                                                                                                                                    SHA-256:98D52CAB5CA65789D1DC37949B65BAF0272AB87BCCBB4D4982C3AF380D5406AB
                                                                                                                                                                                    SHA-512:4A4F51B2FD0248B52530B5D9FE6BFCFE455147CBE2C1F073804A53666945405F89CBBAD219FFF6904C1F92885F7C53B9D9A969732D662CEA8EC1717B3303B294
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \.. "di"\.. "lu"\.. "ma"\.. "me"\.. "\u0135a"\.. "ve"\.. "sa"].. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \.. "diman\u0109o"\.. "lundo"\.. "mardo"\.. "merkredo"\.. "\u0135a\u016ddo"\.. "vendredo"\.. "sabato"].. ::msgcat::mcset eo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "a\u016dg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset eo MONTHS_FULL [list \.. "januaro"\.. "februaro"\.. "marto"\.. "aprilo"\.. "majo"\.. "junio"\.. "julio"\.. "a\u016dgusto"\.. "septembro"\.. "oktobro"\.. "novembro"\.. "decembro"\.. ""].. ::m
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1232
                                                                                                                                                                                    Entropy (8bit):4.2910064237800025
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83hEVIhlp4herIsYoorrClH+Fo9ARhprBvtFvr6:43OVY7+ercrmsYsr1thr6
                                                                                                                                                                                    MD5:91DE6EE8E1A251EF73CC74BFB0216CAC
                                                                                                                                                                                    SHA1:1FB01E3CF2CAFA95CC451BC34AB89DC542BBD7DD
                                                                                                                                                                                    SHA-256:E9A6FE8CCE7C808487DA505176984D02F7D644425934CEDB10B521FE1E796202
                                                                                                                                                                                    SHA-512:46CFD80E68461F165EE6A93AB6B433E4D4DA6A9A76CB7F3EF5766AC67567A7AFFB7B4E950A5AFA7C69C91F72AC82D2A448D32E39BBFC0BF26D2257460471EEC1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mi\u00e9"\.. "jue"\.. "vie"\.. "s\u00e1b"].. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \.. "domingo"\.. "lunes"\.. "martes"\.. "mi\u00e9rcoles"\.. "jueves"\.. "viernes"\.. "s\u00e1bado"].. ::msgcat::mcset es MONTHS_ABBREV [list \.. "ene"\.. "feb"\.. "mar"\.. "abr"\.. "may"\.. "jun"\.. "jul"\.. "ago"\.. "sep"\.. "oct"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset es MONTHS_FULL [list \.. "enero"\.. "febrero"\.. "marzo"\.. "abril"\.. "mayo"\.. "junio"\.. "julio"\.. "agosto"\.. "septiembre"\.. "octubre"\.. "noviembre"\.. "diciembre"\.. ""].. ::msgc
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):248
                                                                                                                                                                                    Entropy (8bit):4.878377455979812
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo8GzvFjot/W3v1o8T+3v9ysvn:4EnLB3833GzdV3vLK3vnn
                                                                                                                                                                                    MD5:313966A7E4F50BB77996FDE45E342CA9
                                                                                                                                                                                    SHA1:021DF7211DAE9A635D52F7005672C157DBBAE182
                                                                                                                                                                                    SHA-256:B97DCEA4FEC3E14632B1511D8C4F9E5A157D97B4EBBC7C6EE100C3558CB2947F
                                                                                                                                                                                    SHA-512:79DCC76263310523BAF1100C70918FCE6BECB47BE360E4A26F11C61F27E14FC28B588A9253AA0C1F08F45AE8A03312A30FBDCF4FDFFDC5BF9D086C4B539DE022
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.924579610789789
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoYePWWjoU3v6ry/5oY7+3vPUe6HyFvn:4EnLB383nedh3v6ry/nS3vs3SVn
                                                                                                                                                                                    MD5:EF58B1097A3C6F2133BD7AA8CCC1AD1B
                                                                                                                                                                                    SHA1:BD479E4635F3CD70A6A90E07B7E92757BC9E2687
                                                                                                                                                                                    SHA-256:B47F55539DB6F64304DEA080D6F9A39165F1B9D4704DCBA4C182DBD3AA31A11B
                                                                                                                                                                                    SHA-512:F9EB1489E5002200D255A45DC57132DEFD2A2C6DE5BC049D0D9720575E4FDD1B6A212D9E15974C6A2E0D0886069EA0DD967AD7C20845EC38EB74CBED0C3E5BE1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.9352990174129925
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xodvPWWjok3v6ry/5odo+3vPUe6HyFvn:4EnLB383OdV3v6ry/i3vs3SVn
                                                                                                                                                                                    MD5:42BCE0EE3A3F9E9782E5DE72C989903A
                                                                                                                                                                                    SHA1:0960646417A61E8C31D408AE00B36A1284D0300E
                                                                                                                                                                                    SHA-256:9D1A2A6EBA673C6F6D964DBCDDF228CB64978F282E70E494B60D74E16A1DB9CB
                                                                                                                                                                                    SHA-512:C53DDCC17F261CFFAA2205879A131CFD23A7BCF4D3787090A0EA8D18530C4805903ED6CF31B53A34C70510A314EBBB68676E9F128289B42C5EFBC701405D5645
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.908553844782894
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo4FjbmvFjo4F+3v6ry/5o4++3vjb0f6HyFvn:4EnLB3831mdD+3v6ry/P3vbSVn
                                                                                                                                                                                    MD5:6A8F31AE734DCEE4845454408CDB3BC5
                                                                                                                                                                                    SHA1:A3B9A0124D3CFA9E0E5957612897B23193AD5D59
                                                                                                                                                                                    SHA-256:5FAC53ACFB305C055AFD0BA824742A78CB506046B26DAC21C73F0BB60C2B889A
                                                                                                                                                                                    SHA-512:188A65CFE2FBD04D83F363AEA166F224137C8A7009A9EBEB24B2A9AC89D9484D3A7109A4CE08F5C0A28911D81571230CC37554F4F19956AE163F9304911EE53C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.919346233482604
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo76GzvFjoTW3v6ry/5o76T+3v9f6HyFvn:4EnLB383K6Gzdj3v6ry/K6K3vMSVn
                                                                                                                                                                                    MD5:2EDDA3F61BA4D049E6C871D88322CF72
                                                                                                                                                                                    SHA1:40AFB64AF810596FCBDBD742ACAFE25CE56F3949
                                                                                                                                                                                    SHA-256:A33DC22330D087B8567670B4915C334FF1741EE03F05D616CC801ECFDA1D9E64
                                                                                                                                                                                    SHA-512:B6A6059B44F064C5CB59A3DAFAA7BE9064EE3E38F5FA6391017D931EF3A2B471DC4D556B7BEC6852FD1F6260EF17F476754D6BEA89E035748E9304977513CFB5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.913083040975068
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xomerQZ2jou3v6ry/5om7+3vrQZg6HyFvn:4EnLB383sk4/3v6ry/s3vkrSVn
                                                                                                                                                                                    MD5:76CFD4F568EA799F9A4082865633FF97
                                                                                                                                                                                    SHA1:B09846BBF7A78243A5075F2DC9241791DCBA434B
                                                                                                                                                                                    SHA-256:8DC2F857E91912ED46A94EB6B37DD6170EA7BCDDCD41CB85C0926A74EE12FCC1
                                                                                                                                                                                    SHA-512:58B20A8A5D1F8C19AC36E61965106266B7E6F7E95DDD6AD9C4BB9FD7FFC561CB0E2103639D901A6A78CE2DD154CBF7F3AE0F71B4DC1CCB11DC6BB40D9C6E2157
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.915857529388286
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xozgzvFjoro+3v6ry/5oz9+3v9f6HyFvn:4EnLB383OgzdkF3v6ry/OI3vMSVn
                                                                                                                                                                                    MD5:94B713B1560FE7711EA746F1CEBD37CD
                                                                                                                                                                                    SHA1:E7047E8F04D731D38FA328FBC0E1856C4A8BB23D
                                                                                                                                                                                    SHA-256:52AB5A6C9DD4F130A75C049B3AF8F54B84071FC190374BCCF5FA0E1F3B91EB21
                                                                                                                                                                                    SHA-512:EE807D4D74A609F642CC3C6FC3D736708F67A6931DEB95288AB5822DA256BE4C908A346036195CF4266408458906D28BB5C715EEAFCACFC4FE45D4E6D8E435FE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.9102355704853435
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xohvjbmvFjoI3v6ry/5oho+3vjb0f6HyFvn:4EnLB383KmdJ3v6ry/W3vbSVn
                                                                                                                                                                                    MD5:761D0A468DF2EE75BC2CAB09D5FF38CD
                                                                                                                                                                                    SHA1:D627BE45FE71CCB3CA53153393C075FF5136C2F3
                                                                                                                                                                                    SHA-256:19B4D3025156C060A16328370A3FDB9F141298DECFC8F97BE606F6438FECE2EE
                                                                                                                                                                                    SHA-512:6CF7C9004A8A3B70495862B7D21921B1A6263C2153FEBC5C4997366498ABBFE70263B436C2B4998550780A4C3A58DCF0AAE7420FF9D414323D731FA44BD83104
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.947925914291734
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoIvriSFjoP3v6ry/5oIo+3vrig6HyFvn:4EnLB383V+2m3v6ry/v3v+lSVn
                                                                                                                                                                                    MD5:33CEE7F947A484B076F5FA7871A30FEB
                                                                                                                                                                                    SHA1:F77F8D1F42008770A6FF1F5097C863ECF482BEBE
                                                                                                                                                                                    SHA-256:07873D4D59BB41000706A844859C73D26B1FF794058AA83CFFCA804981A24038
                                                                                                                                                                                    SHA-512:EBF6873F9CB554489EFCD352943100C00171E49D27153769D1C4DB25E2D1F44F2D34869B596C267C9BB59ED0444468D9982137CFB1C6035FB15A855BB867133B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.9102355704853435
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoPjbmvFjoH+3v6ry/5oI+3vjb0f6HyFvn:4EnLB383UmdD3v6ry/k3vbSVn
                                                                                                                                                                                    MD5:678D7A6DC32355246BF3AC485A24AF4D
                                                                                                                                                                                    SHA1:B6C273D3BE5FB9F5A221B0333870CCE41CEDFDE4
                                                                                                                                                                                    SHA-256:A0F57137D2C0ABDC933E03CFB188F5632176C195CEADB9DC80D469C8DC6CEDC6
                                                                                                                                                                                    SHA-512:571404CCB0591C681C975E3F7A6C6972FAF2362F1D48BFC95E69A9EAE2DB3F40BF4B666C41950C4924E3FD820C61ED91204F92283B8554F1BD35B64D53BD4125
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.918215906418583
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoe/GriSFjo3W3v6ry/5oe/T+3vrig6HyFvn:4EnLB383Re+2eW3v6ry/RS3v+lSVn
                                                                                                                                                                                    MD5:471C41907CE5DB1F30C647A789870F78
                                                                                                                                                                                    SHA1:C575A639609620AF7C56430991D0E4C2B50BDEC5
                                                                                                                                                                                    SHA-256:6250663DA1378E54BEDCEF206583D212BC0D61D04D070495238D33715BB20CAE
                                                                                                                                                                                    SHA-512:CAE32DF8F583542CAFE3292501725D85B697A5C1F9A0A7993490E8A69B6CE5CE3DE3AA2733B14D989A8D13B5E31B437DB42E9AB9D1851FE72313592C752B5061
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.906719336603863
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoX5rQZ2joHE3v6ry/5oXa+3vrQZg6HyFvn:4EnLB383ak4F3v6ry/G3vkrSVn
                                                                                                                                                                                    MD5:571F6716293442672521F70854A5AD05
                                                                                                                                                                                    SHA1:525EBDEA6F85FC769B6C0C0B179BD98381647123
                                                                                                                                                                                    SHA-256:EBB661C1C09E7D4F6FBCC4B2DAD0F41442B1FFDD27F003ABDC0375DD316E57D7
                                                                                                                                                                                    SHA-512:C6176EE48515BDFC09B8347DAC5FD2C0165AA765916457DC7B057E526785AC912481CB72F118D2943372213B23CE3C39739263C2B3DA4DBFEB24C522ACC0439D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.90959433688075
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoIgzvFjoQ9X3v6ry/5oI9+3v9f6HyFvn:4EnLB383+zdB3v6ry/y3vMSVn
                                                                                                                                                                                    MD5:5A5997D834DDD3E2E8FF8C6956AD54AC
                                                                                                                                                                                    SHA1:AB4110E37B3665D738A8F2B3E64CBA9E99127301
                                                                                                                                                                                    SHA-256:90C130B66958CF63CB3DDD2C633E58444357DBAB44C56831DD794CBD2EB1AED0
                                                                                                                                                                                    SHA-512:1FEB8E77EA7B886E4A06279AC8A4B6200DBB86DCD28989651B92A0C9147A7BCFBB871DF8F904A1CF8F869BFFBD21325505AC44A4DBEBE1EFC87D43174597F1F3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.905689521403511
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo06GriSFjoeW3v6ry/5o06T+3vrig6HyFvn:4EnLB383gG+263v6ry/gK3v+lSVn
                                                                                                                                                                                    MD5:CE811BB8D12C7E6D53338759CCFB0A22
                                                                                                                                                                                    SHA1:0AED290AA479DE6887CCB58D3F0A0F379EF8D558
                                                                                                                                                                                    SHA-256:F790E8E48DC079DCD7DEB58170561006A31294F7E4ACBF9CF2ABFA3DB9E3FA9E
                                                                                                                                                                                    SHA-512:0C73654CC3D33F76D9BF545BD6C5E42CBDD10B6D9750BFD6536806010F3B6A3C3647FB9D5E7E75A39823FDB857E13D07B7F987809C94B9F980E6D3A6D3108E85
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.917539255090736
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo/5zvFjovE3v6ry/5o/a+3v9f6HyFvn:4EnLB383Czdt3v6ry/+3vMSVn
                                                                                                                                                                                    MD5:9CD6FAC4121E3D287C87157142E32845
                                                                                                                                                                                    SHA1:3081FE2197017EC8E052756A407880C1C4ED026A
                                                                                                                                                                                    SHA-256:70263F7EB22822DFEE8849B7AC4418ED9331275A71E77236B59226396505CDFF
                                                                                                                                                                                    SHA-512:25DC054085C4078734988EEDD87E31ABE93DA8B43512E924DE4BCDE9F8EC670436B72FAD1855484F9AC71DD0BEDD9ED30304D02219C4FFC4B0516D8889BDF9F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.929035824905457
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xofriSFjo3+3v6ry/5oY+3vrig6HyFvn:4EnLB383Y+22+3v6ry/Q3v+lSVn
                                                                                                                                                                                    MD5:AF300EA6E733DC6820768EA16194B472
                                                                                                                                                                                    SHA1:7766A6EB3D07BCC759CF6718EF3D6EC3FCE13565
                                                                                                                                                                                    SHA-256:26A38B3745C95673D21BABB987F1D41EE08DDA945C670F5432BA0CE6F893C0E9
                                                                                                                                                                                    SHA-512:C38D67C912584BE539D71881C6517AC186CBB336A160602DA716CE2708B2D38CE8FA7DD23EDB98890ABB7119B924B6C7816C18EC18F20C49D6284DF2386E32EE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.923802447598272
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xooygzvFjooq9X3v6ry/5ooy9+3v9f6HyFvn:4EnLB3835rzdbsX3v6ry/5J3vMSVn
                                                                                                                                                                                    MD5:2DC550FEC3F477B1159B824479BCE707
                                                                                                                                                                                    SHA1:4D0B20CF3E50B64D74655A405A7750E0B0BB4375
                                                                                                                                                                                    SHA-256:1291B58810739EA0651493DD7887F5EE3E14BDB806E06DD4BB8AE2520C742EDA
                                                                                                                                                                                    SHA-512:B12B927ACA6274904928A6A6CAEC8339A794C74A1F1804FF93AABC132AF9AD8AC5117F20067A60EFEBC9887150D7ACA5BE9643FF61509666011FD203211C25B9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.928484426267027
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoXrzvFjoXK3v6ry/5oXs+3v9f6HyFvn:4EnLB3838zdv3v6ry/c3vMSVn
                                                                                                                                                                                    MD5:184D6C4B9F0AA874DEB959F63F7CC01B
                                                                                                                                                                                    SHA1:5FB370B498289590C977F6B489FF646F0FB27425
                                                                                                                                                                                    SHA-256:91191517403C712299919F9C797F952502E33CB6961D1DBEE3A7C9E8D2B170B9
                                                                                                                                                                                    SHA-512:881CCAB0950AE993744ECCA141120C005F53D684167A3E5CBDDF950D110D630FB2B4F6AE6E3D0E06D5110AE25EA00A4F4DAFB03AD3B227DC8C63464D434431DA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1258
                                                                                                                                                                                    Entropy (8bit):4.391217201307309
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83P1Y2+1YoQVTsC/m48qpRTVTR7I/68qqq4Z0yoN7emG5wsvtqmsv5t:43P1p+1jQ9sq8y9v8Yko7emG5wKtqmKX
                                                                                                                                                                                    MD5:C8C5EF2FA6DD8DBD5BBD2699BE1A0BF6
                                                                                                                                                                                    SHA1:F5E26B40786B8987C98F9CBDEF5522043574A9ED
                                                                                                                                                                                    SHA-256:4BEE224C21B0483CFF39BE145C671AA20CB7872C8727FD918C0E8ECA2BBEB172
                                                                                                                                                                                    SHA-512:757FA85C137A11C1A3F4A8392C7A4E4030A67D0E593FA25A98BEC07DB295399AB2C0D9EBE61E07420B14387A29C060DC3AF812A1E7B85110DBB13C3C3DCB3600
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \.. "P"\.. "E"\.. "T"\.. "K"\.. "N"\.. "R"\.. "L"].. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \.. "p\u00fchap\u00e4ev"\.. "esmasp\u00e4ev"\.. "teisip\u00e4ev"\.. "kolmap\u00e4ev"\.. "neljap\u00e4ev"\.. "reede"\.. "laup\u00e4ev"].. ::msgcat::mcset et MONTHS_ABBREV [list \.. "Jaan"\.. "Veebr"\.. "M\u00e4rts"\.. "Apr"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "Aug"\.. "Sept"\.. "Okt"\.. "Nov"\.. "Dets"\.. ""].. ::msgcat::mcset et MONTHS_FULL [list \.. "Jaanuar"\.. "Veebruar"\.. "M\u00e4rts"\.. "Aprill"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "August"\.. "September"\.. "Oktoober"\.. "November"\.. "De
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1032
                                                                                                                                                                                    Entropy (8bit):4.002617252503668
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83DEXk8TT7vXk8TTMtzCIsOo/ssP6tvf1I49sHT:434bTbbTc+RjKi4mz
                                                                                                                                                                                    MD5:ED9805AF5BFB54EB28C6CB3975F86F5B
                                                                                                                                                                                    SHA1:2BD91BD850028712F35A2DDB2555036FBF6E8114
                                                                                                                                                                                    SHA-256:6889B57D29B670C6CFB7B5A3F2F1749D12C802E8E9629014D06CE23C034C7EF1
                                                                                                                                                                                    SHA-512:16F31DE5D2B0D3ED2D975C7891C73C48F073CDAC28F17572FC9424C2D384DDFE9E5E235F17C788F42840CB2D819D2D9499B909AB80FEF1B09F2AE1627CF1DADC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu MONTHS_ABBREV [list \.. "urt"\.. "ots"\.. "mar"\.. "api"\.. "mai"\.. "eka"\.. "uzt"\.. "abu"\.. "ira"\.. "urr"\.. "aza"\.. "abe"\.. ""].. ::msgcat::mcset eu MONTHS_FULL [list \.. "urtarrila"\.. "otsaila"\.. "martxoa"\.. "apirila"\.. "maiatza"\.. "ekaina"\.. "uztaila"\.. "abuztua"\.. "iraila"\.. "urria"\.. "azaroa"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):294
                                                                                                                                                                                    Entropy (8bit):4.915392589807169
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoszFnJF+l6VvBoszw3vLjoszw3v6mjosz++3v/RHvn:4EnLB383FL+l6VQ3vO3v6G3vZPn
                                                                                                                                                                                    MD5:4C91AA000D4316585893025CBB96E910
                                                                                                                                                                                    SHA1:3D4E73839A1A8CB9DEC1E59D9D2813257D9480F0
                                                                                                                                                                                    SHA-256:D45CC432E5743E6CEC34E9A1E0F91A9D5C315CDA409E0826B51AD9D908479EB6
                                                                                                                                                                                    SHA-512:0731F2EEB22ADC7EF8AF215B9EB4C5A66B33BC90E4F80CF7AA482AD002CB30543547230124A0507EC79EDDD6903A042EDA5D7C8AFD77F7FC994EFC6853FABB05
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da".. ::msgcat::mcset eu_ES TIME_FORMAT "%T".. ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T".. ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1711
                                                                                                                                                                                    Entropy (8bit):4.21837106187395
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83CnMqnbxbGwgjSyiY/Xw2mS1yM/8ye48YyfNqTb2gyj/8yHkQp:43Yzyhgvs9yi4P
                                                                                                                                                                                    MD5:7AB25F4E7E457469DC61A33176B3AA72
                                                                                                                                                                                    SHA1:EEA98283D250A99E33DD4D5D9B1B76A029716CE6
                                                                                                                                                                                    SHA-256:86898728B275288693B200568DC927C3FF5B9050690876C4441A8339DAE06386
                                                                                                                                                                                    SHA-512:7524437F91E91751BEB7A378D7674C49E5D84B716FE962F4C23580C46A671F3F33638FCD37A8F90C86E24DA8F54448E06AC9C3AEFFB5613E94A04E512C1AD68D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0648\u062a
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2009
                                                                                                                                                                                    Entropy (8bit):4.491667766230948
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83KnMqnbxbGUgjDiY/Xw2mS1yM/8ye48tfNqTb2gyj/8yHkQLoRv9v/vNv0P:43wihgvsai4Rmv53JU
                                                                                                                                                                                    MD5:C59EE7CA80AD9F612A21C8B6674A820E
                                                                                                                                                                                    SHA1:AEFD631EFC1892063244FA622DE1A091C461E370
                                                                                                                                                                                    SHA-256:6B56545C1AE1DE53BC2389BB7AE59F115BADE24F907E384E079491DC77D6541D
                                                                                                                                                                                    SHA-512:42F52091480599D317FB80DF8E52A6C6F88614C6172BF4033974DD136FB30E6F47D38982C8A7BC14CF3165C3EBAE3680F94DF3A0ED079AB68165286251CD0BD7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):426
                                                                                                                                                                                    Entropy (8bit):5.12739029869254
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:4EnLB383D2WGz7A/3vy3v6TANCmK3vz7AAbn:4aR83DoPivkvFk5vPN
                                                                                                                                                                                    MD5:9778A7C3ABD37ECBEC0BB9715E52FAF8
                                                                                                                                                                                    SHA1:D8063CA7779674EB1D9FE3E4B4774DB20B93038B
                                                                                                                                                                                    SHA-256:3D9779C27E8960143D00961F6E82124120FD47B7F3CB82DB3DF21CDD9090C707
                                                                                                                                                                                    SHA-512:B90B4A96CE5E8B9BF512B98C406603C60EA00F6740D04CD1FC30810C7155A37851AE5E28716F959137806F1A9E3152D2A0D79B8EA7E681A0737A28593657DE66
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d".. ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631".. ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y".. ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H".. ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P".. ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1195
                                                                                                                                                                                    Entropy (8bit):4.32217771842326
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83KTvIhmuw4tW/UWJTttWKeqA+3ewvtyv3e6:43YvIwuw4t05ttnlzt0p
                                                                                                                                                                                    MD5:CC06F0ABD8F985654DAD8256598EBCB7
                                                                                                                                                                                    SHA1:71C880F9F395ACD32AF7F538033211F392F83645
                                                                                                                                                                                    SHA-256:9929A6B7139BD7E0F29487F7888A83E4C4F5E9CE0352738CFCA94EE2DDF3BD6B
                                                                                                                                                                                    SHA-512:E1292665270B6FBF7738CC3864B55194E7B827C6AD9492FB2E54DC1B626159B243052CE502335B9D92E2B8F58A4DD1FA0E628CB6A9D1D3A652FE2B93A3FB711A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "ma"\.. "ti"\.. "ke"\.. "to"\.. "pe"\.. "la"].. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \.. "sunnuntai"\.. "maanantai"\.. "tiistai"\.. "keskiviikko"\.. "torstai"\.. "perjantai"\.. "lauantai"].. ::msgcat::mcset fi MONTHS_ABBREV [list \.. "tammi"\.. "helmi"\.. "maalis"\.. "huhti"\.. "touko"\.. "kes\u00e4"\.. "hein\u00e4"\.. "elo"\.. "syys"\.. "loka"\.. "marras"\.. "joulu"\.. ""].. ::msgcat::mcset fi MONTHS_FULL [list \.. "tammikuu"\.. "helmikuu"\.. "maaliskuu"\.. "huhtikuu"\.. "toukokuu"\.. "kes\u00e4kuu"\.. "hein\u00e4kuu"\.. "elokuu"\.. "syyskuu"\.. "lokakuu"\.. "marraskuu"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1033
                                                                                                                                                                                    Entropy (8bit):4.15884265510429
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR834YPxTSBFSa+E6rIsmYmyAxyIQbXHU92W1T:43a6rIyAE0B
                                                                                                                                                                                    MD5:5D224E66FD9521CA4327D4F164CD6585
                                                                                                                                                                                    SHA1:FC8F4C1D9A69931679028DE02155D96A18F6542E
                                                                                                                                                                                    SHA-256:2EC9B03469FA38B260915C93318F446EA5E12B9090BD441936B57552EBA1E3C9
                                                                                                                                                                                    SHA-512:0E0F97D99F0274A8A92AA7DC992B252A0BB696D69A8835602D8F4C03A6A15780F45971F00863436949CD81AD7DF6EE6BC463CE5B9FECF5E39508BA4D4E83C693
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \.. "sun"\.. "m\u00e1n"\.. "t\u00fds"\.. "mik"\.. "h\u00f3s"\.. "fr\u00ed"\.. "ley"].. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nadagur"\.. "t\u00fdsdagur"\.. "mikudagur"\.. "h\u00f3sdagur"\.. "fr\u00edggjadagur"\.. "leygardagur"].. ::msgcat::mcset fo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset fo MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "apr\u00edl"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.864028070948858
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoZA4WjoZd3vLjoZd3v6mjoZd+3vnFDoAkvn:4EnLB3831P23vS3v6u3v9dmn
                                                                                                                                                                                    MD5:92E2B6483B2374817548F4EAA1731820
                                                                                                                                                                                    SHA1:071E1E9368CCB4EC864E78622B2113F460920203
                                                                                                                                                                                    SHA-256:C3DCCF5E5904C24D4AD9AAA36160A78F5397A7452510C0C0E61DE4DE863305CB
                                                                                                                                                                                    SHA-512:E79D4D38A22298252FA46D15C383CFB2A1E49E8196C265A58F9BA4982DFD9CE29E87C0B85BE3F39617359451831B792FCD3092A52EDF8FFD999AFE5CFE1D170D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y".. ::msgcat::mcset fo_FO TIME_FORMAT "%T".. ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T".. ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1257
                                                                                                                                                                                    Entropy (8bit):4.383721663740675
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR835LzAX2t6KOkPwzZIGzRmzQf1waGqHvivh:43mlwIFZtA/qPkh
                                                                                                                                                                                    MD5:4D63B4A7CF13A28A6F6784B5597EEF43
                                                                                                                                                                                    SHA1:FE1B35A93CB72666D7D6BC37D9BE081B05A00CD9
                                                                                                                                                                                    SHA-256:96B1E1E12CD13A56722EBF27D362C70B467342FA1282A40B89FB16B5105A0480
                                                                                                                                                                                    SHA-512:5647CAE859B62C7CE1CEE6426A076361D2A29EFE6B6F311DDC0E7D006194BA68D575852FEC5FDE2AB43DF8AE440C57013D32A3951095CB856327070FD9BD1C76
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \.. "dim."\.. "lun."\.. "mar."\.. "mer."\.. "jeu."\.. "ven."\.. "sam."].. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \.. "dimanche"\.. "lundi"\.. "mardi"\.. "mercredi"\.. "jeudi"\.. "vendredi"\.. "samedi"].. ::msgcat::mcset fr MONTHS_ABBREV [list \.. "janv."\.. "f\u00e9vr."\.. "mars"\.. "avr."\.. "mai"\.. "juin"\.. "juil."\.. "ao\u00fbt"\.. "sept."\.. "oct."\.. "nov."\.. "d\u00e9c."\.. ""].. ::msgcat::mcset fr MONTHS_FULL [list \.. "janvier"\.. "f\u00e9vrier"\.. "mars"\.. "avril"\.. "mai"\.. "juin"\.. "juillet"\.. "ao\u00fbt"\.. "septembre"\.. "octobre"\.. "novembre"\.. "d\u00e9cembre
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.910112619660625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoXqyFjoIX3vLjoIX3v6mjog+3vnFDoAkvn:4EnLB383AqWv3vL3v6d3v9dmn
                                                                                                                                                                                    MD5:07EEADB8C2F2425FF9A27E46A81827A2
                                                                                                                                                                                    SHA1:AA18A651C64098C7885F1F869B9F221453F42987
                                                                                                                                                                                    SHA-256:AAD828BCBB512FBD9902DCDD3812247A74913CC574DEB07DA95A7BBE74B1FE48
                                                                                                                                                                                    SHA-512:1FA60B1A69B2F5FD2C009EC18695A937C4484D7C418F7E8398D95723B857698143E0584A546F9032B75894730CBBEF78453061AC13D90199FF702E148D983C28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset fr_BE TIME_FORMAT "%T".. ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.890376345610709
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xooIso13vLjo13v6mjo1+3vnFDoAkvn:4EnLB383vIF3vU3v6A3v9dmn
                                                                                                                                                                                    MD5:2F70BDDE7685E2892C5F79C632FC2F0F
                                                                                                                                                                                    SHA1:FD1A6F6042E59D1563ABB5858C348C1D785C435E
                                                                                                                                                                                    SHA-256:0624DF9A56723DDB89E59736C20A5837DEA2206A789EBE7EEF19AD287590CA45
                                                                                                                                                                                    SHA-512:50FC0C91AB2C75FFC4F100C0D42DFC4B2101DB9713FD77E6FF5BF3F25A0AF4A535A4709CF4586809CEEE76C25B66ABC0DD4FD61524510C57AA0E63EA8F46E8D5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset fr_CA TIME_FORMAT "%T".. ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):288
                                                                                                                                                                                    Entropy (8bit):4.913241133684606
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoFt28oF+3vLjoF+3v6mjo++3vnFDoAkvn:4EnLB383yte+3vs+3v6/3v9dmn
                                                                                                                                                                                    MD5:83FC7EBA68C3727F7C13C8EEAF79823F
                                                                                                                                                                                    SHA1:81C27F9B97F5F5190F7189230535EC09CD228158
                                                                                                                                                                                    SHA-256:290CA6EB74BAEAC4E2420D0755D148849F89EE87E37860F25CBB7B8AFA3EDCBC
                                                                                                                                                                                    SHA-512:35DA46558A246D7B3FAB02208001CE986E2E6DD88D6318AF743F4E81CA6920471D1425BB009A7476A79E7F61E1353C027B765331CD8EFA07A9E884DCB73F2195
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y".. ::msgcat::mcset fr_CH TIME_FORMAT "%T".. ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1188
                                                                                                                                                                                    Entropy (8bit):4.314271783103334
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR835k0CM/hlrXa754pD73/tKSx54pbIK5f2CA:43W05rXUa173/VadDA
                                                                                                                                                                                    MD5:67D137E5D853DB61A4B4264871E793F7
                                                                                                                                                                                    SHA1:4280E7F662DE792175AF8B4C93874F035F716F0F
                                                                                                                                                                                    SHA-256:880806867ACABD9B39E3029A5ADD26B690CC5709082D43B0959EBA725EA07AB5
                                                                                                                                                                                    SHA-512:C27B745143539D3E6D94BB754DCA35065CDE9B1AA6EE038D47F658175CFACC20236124D38BE5BBB03CAF8F613BD748C43CB8DFCC9234E915D18B5A477BAEF94E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \.. "Domh"\.. "Luan"\.. "M\u00e1irt"\.. "C\u00e9ad"\.. "D\u00e9ar"\.. "Aoine"\.. "Sath"].. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \.. "D\u00e9 Domhnaigh"\.. "D\u00e9 Luain"\.. "D\u00e9 M\u00e1irt"\.. "D\u00e9 C\u00e9adaoin"\.. "D\u00e9ardaoin"\.. "D\u00e9 hAoine"\.. "D\u00e9 Sathairn"].. ::msgcat::mcset ga MONTHS_ABBREV [list \.. "Ean"\.. "Feabh"\.. "M\u00e1rta"\.. "Aib"\.. "Beal"\.. "Meith"\.. "I\u00fail"\.. "L\u00fan"\.. "MF\u00f3mh"\.. "DF\u00f3mh"\.. "Samh"\.. "Noll"\.. ""].. ::msgcat::mcset ga MONTHS_FULL [list \.. "Ean\u00e1ir"\.. "Feabhra"\.. "M\u00e1rta"\.. "Aibre\u00e1n"\.. "M\u00ed na Bealtaine"\.. "Meith"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.824539027053997
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xobHAygDobHAqo+3vLjobHAqo+3v6mjobHAy9+3vnFDoAkv:4EnLB383p23vy3v6a3v9dmn
                                                                                                                                                                                    MD5:C27BD7F317AAADB380F4C38AE0D2FDA6
                                                                                                                                                                                    SHA1:79870A0E68AA0A9B301414EDC21889F83BB81E40
                                                                                                                                                                                    SHA-256:3F9615C617D3CDBC1E127B3EFEE785B0CB5E92E17B7DABAC80DA2BEAF076362C
                                                                                                                                                                                    SHA-512:3605B9A914284CF1D3CC90DF2F21A86C0472AEE59800942DC93D842C7AE164E1DA72813787F163DC80B72269D2C391953ABAD6A8B72CCF069BEE96D418A173E9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y".. ::msgcat::mcset ga_IE TIME_FORMAT "%T".. ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):997
                                                                                                                                                                                    Entropy (8bit):4.120890519790248
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83okzalCcPdJ5rK8yzMY4JlV1ZDqqIkFo8w:43JkPj9K8y4HHZLIQtw
                                                                                                                                                                                    MD5:A3D098C1A47E380F7C25233A52FBDE38
                                                                                                                                                                                    SHA1:C97E4EAA9E7A7F99950F422B93C57134B532C639
                                                                                                                                                                                    SHA-256:34D61B49DBF9584893051FFB458D6DE9E7E2E7774AC0011F70C4DD4184EBA81C
                                                                                                                                                                                    SHA-512:4687AB3D2FAA65FED90678EBC08C074959E93A9FEFAF3D61EEE39DB08FD200CB57C0DDB4DDBF6451FE1EF5E07EA976EDEF830769FF403CE51734129CEF24DA9F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Lun"\.. "Mar"\.. "M\u00e9r"\.. "Xov"\.. "Ven"\.. "S\u00e1b"].. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Luns"\.. "Martes"\.. "M\u00e9rcores"\.. "Xoves"\.. "Venres"\.. "S\u00e1bado"].. ::msgcat::mcset gl MONTHS_ABBREV [list \.. "Xan"\.. "Feb"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Xu\u00f1"\.. "Xul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset gl MONTHS_FULL [list \.. "Xaneiro"\.. "Febreiro"\.. "Marzo"\.. "Abril"\.. "Maio"\.. "Xu\u00f1o"\.. "Xullo"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Decembro"\.. ""]..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.886176304042503
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoPhkgMoPxsF3v6ay/5oPhk9+3vR6HyFvn:4EnLB383WrfK3v6ay/WJ3voSVn
                                                                                                                                                                                    MD5:78B9163C5E8E5E7049CBF91D1A5889A4
                                                                                                                                                                                    SHA1:F2F07AF3D79D61C8E0C73B13E2CA8266E10E396B
                                                                                                                                                                                    SHA-256:B5688CA07D713227B713655877710258CD503617E8DF79293A971649E3134F05
                                                                                                                                                                                    SHA-512:E86074B687670542CFA097C94D150292E1A73C9F231E92CD84386580A446569CC6F8F5817F46ED64A1D00F95D59F6F1F5D4B961DF3C8335938D83F3517794353
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1084
                                                                                                                                                                                    Entropy (8bit):4.213672208102291
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR832vTXAC2/fS5JfaCroeLaCAQbSm5qJe1:43QTXs32zrf
                                                                                                                                                                                    MD5:518FC3964D50854081FB79189A42D3E7
                                                                                                                                                                                    SHA1:59392F16CD56E3E6A685F78974D539FB3A972B98
                                                                                                                                                                                    SHA-256:404795F2C88D0038F9ED0B5120A251D26EDF8B236E1B1698BC71ACD4DC75AC45
                                                                                                                                                                                    SHA-512:E5C88CAB8741D631938CEC2E0959C0FE26685C395F5F9F4F1B5C9E146E84D23D897CD7A823AB46D4B62C590AE15EC76B87EB59308ACFB1BB6F61398890B43622
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \.. "Jed"\.. "Jel"\.. "Jem"\.. "Jerc"\.. "Jerd"\.. "Jeh"\.. "Jes"].. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \.. "Jedoonee"\.. "Jelhein"\.. "Jemayrt"\.. "Jercean"\.. "Jerdein"\.. "Jeheiney"\.. "Jesarn"].. ::msgcat::mcset gv MONTHS_ABBREV [list \.. "J-guer"\.. "T-arree"\.. "Mayrnt"\.. "Avrril"\.. "Boaldyn"\.. "M-souree"\.. "J-souree"\.. "Luanistyn"\.. "M-fouyir"\.. "J-fouyir"\.. "M.Houney"\.. "M.Nollick"\.. ""].. ::msgcat::mcset gv MONTHS_FULL [list \.. "Jerrey-geuree"\.. "Toshiaght-arree"\.. "Mayrnt"\.. "Averil"\.. "Boaldyn"\.. "Mean-souree"\.. "Jerrey-souree"\.. "Luanistyn"\.. "Mean-fouyir"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.936566750568767
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoQbtvMoQLE3v6ay/5oQbto+3vR6HyFvn:4EnLB383PbtvALE3v6ay/PbtF3voSVn
                                                                                                                                                                                    MD5:0B6BE614EF5F5F25A30D2D33701A9F94
                                                                                                                                                                                    SHA1:65800FBD73D9DAE550E04E1D818A6B9D1AEF86FE
                                                                                                                                                                                    SHA-256:86CABF3B9360C0E686CC4CBEB843E971C28BC6D35210ED378B54EB58CC41F3D5
                                                                                                                                                                                    SHA-512:376D21B38DA49A8F7C2983F2B808FD55AC9F6383BC66DF28DB99DBF61FDC9FFF8CD20F077EC3ED873EF47F0F613BDD9AD02DFFB1CB51F9A36715C7FC798C3B70
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1990
                                                                                                                                                                                    Entropy (8bit):4.298934047406144
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83Y71LCLxL0eCLbCLKCLaCLXL7CLB0p1dLGCoCLU5LT5Gv5LJ9p5LnLEHLGCh:43sl7KqpU/nNbhbOezd2ICn
                                                                                                                                                                                    MD5:A0E60036EB17208A449AAFC3AAAE622C
                                                                                                                                                                                    SHA1:9D7479BA85FBB00A2DF2B61F4ED2CBEA8F1EC8C3
                                                                                                                                                                                    SHA-256:787DA79AF58872BF45AB09E3B6A920A4496B5BD8A4F3C7F010CF013EC2E8EFE0
                                                                                                                                                                                    SHA-512:46D12C14B5736E5EA97EB728BF58999E9D7C2CF910D8F5AFA3F5D3A86329ABF41A3E2BEBD81EE4EF64BEA0DC173B77A9FE12471C1BD9D768ED552A55B3B80213
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \.. "\u05d0"\.. "\u05d1"\.. "\u05d2"\.. "\u05d3"\.. "\u05d4"\.. "\u05d5"\.. "\u05e9"].. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \.. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\.. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\.. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\.. "\u05e9\u05d1\u05ea"].. ::msgcat::mcset he MONTHS_ABBREV [list \.. "\u05d9\u05e0\u05d5"\.. "\u05e4\u05d1\u05e8"\.. "\u05de\u05e8\u05e5"\.. "\u05d0\u05e4\u05e8"\.. "\u05de\u05d0\u05d9"\.. "\u05d9\u05d5\u05e0"\.. "\u05d9\u05d5\u05dc"\.. "\u05d0\u05d5\u05d2"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1777
                                                                                                                                                                                    Entropy (8bit):4.2117128941697715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:438n4kALqrU1fbokQTbWqrU1fbokQTw38:28OD86D8gM
                                                                                                                                                                                    MD5:4219A929E27308ADC04A9F368F063F38
                                                                                                                                                                                    SHA1:FA728EEBA8751F4CE032ED32AECFDE124D1B68E2
                                                                                                                                                                                    SHA-256:192F4A8E77E1627712F85533C9896EF6A040157C7BD56DF3A4A7FA56AD6746C2
                                                                                                                                                                                    SHA-512:223B137AC1FC15908F5541067736EF3A29493549B963393EB78660036A82982E57CFC4AD09CBD33D32A5187FF9F4ACFB5F83A0C974702434B7FAD1B2539B7F76
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset hi MONTHS_ABBREV [list \.. "\u091c\u0928\u0935\u0930\u0940"\.. "\u092b\u093c\u0930\u0935\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u0905\u092a\u094d\u0930\u0947\u0932"\.. "\u092e\u0908"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u093e\u0908"\.. "\u0905\u0917\u0938\u094d\u0924"\.. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\.. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\.. "\u0928\u0935\u
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.9286948144352865
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xocv+IZoz3v6ry/5oco+3v+6f6HyFvn:4EnLB383Jvlg3v6ry/JF3vmSVn
                                                                                                                                                                                    MD5:1C1E1484EA0286175FADCB90937C9F34
                                                                                                                                                                                    SHA1:5CA1BF19021D529CB3B3A308EFFFCA7E4D073640
                                                                                                                                                                                    SHA-256:5A3BF0DD61BFB5A2BF75E96B11E0E3528FFAB720A0BF1923853606F8CAF0E76D
                                                                                                                                                                                    SHA-512:F9A43E1E18ADB6DC6B18BEDC3303A99F514DF6CA54F12100989F734233012D7D60216116915351CCACC12F6942795BF8F3BBD26B15A86E88101067D64BEE54F5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1171
                                                                                                                                                                                    Entropy (8bit):4.36311224714184
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83dVX79VIE9bLTWnh7rT+5dPcdvgrNv5KvOA1:43kmrQ7n+odIrJ6OS
                                                                                                                                                                                    MD5:906963A3AD09EAC781B35C190B77484E
                                                                                                                                                                                    SHA1:E5AA49DA9C4987EAFA839115F84612426EB8615E
                                                                                                                                                                                    SHA-256:105A9180BC5D23738183374FA0EA8DD80484BF3947E1432E515BDC2913C017D9
                                                                                                                                                                                    SHA-512:557BD1C8306750D09215D9774069A52C7D60E03DE2DF39FF909A8F658AB0565739D127E24ACDC96F736C69A71BEFA30B8A30BB489C7B7FDEA85386C802166349
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \.. "ned"\.. "pon"\.. "uto"\.. "sri"\.. "\u010det"\.. "pet"\.. "sub"].. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \.. "nedjelja"\.. "ponedjeljak"\.. "utorak"\.. "srijeda"\.. "\u010detvrtak"\.. "petak"\.. "subota"].. ::msgcat::mcset hr MONTHS_ABBREV [list \.. "sij"\.. "vel"\.. "o\u017eu"\.. "tra"\.. "svi"\.. "lip"\.. "srp"\.. "kol"\.. "ruj"\.. "lis"\.. "stu"\.. "pro"\.. ""].. ::msgcat::mcset hr MONTHS_FULL [list \.. "sije\u010danj"\.. "velja\u010da"\.. "o\u017eujak"\.. "travanj"\.. "svibanj"\.. "lipanj"\.. "srpanj"\.. "kolovoz"\.. "rujan"\.. "listopad"\.. "studeni"\.. "prosinac"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1381
                                                                                                                                                                                    Entropy (8bit):4.511450677731002
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83IFb7ZTmKrkAYm2LZyyApLDV2uZi5WF+shHUTyvtsv+:43C3ZTmKQAyZyyAp0BotK+
                                                                                                                                                                                    MD5:E398158EE1CD49CB5286D9642D4A61DD
                                                                                                                                                                                    SHA1:A93A588B0ADD198C067C4BB070DC1E5170E6E208
                                                                                                                                                                                    SHA-256:993475532F89E1EA7214ADB265294040862305612D680CFF01DD20615B731CCC
                                                                                                                                                                                    SHA-512:9E5791FB97110FE5F7A1F49FF2ED8801A05E49D5B9AF579474C0081073D2B40ECFFE6E4EB5B61F12B1995FDCC0A557CB572E5E116F951FD286A6254253DAEC01
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \.. "V"\.. "H"\.. "K"\.. "Sze"\.. "Cs"\.. "P"\.. "Szo"].. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \.. "vas\u00e1rnap"\.. "h\u00e9tf\u0151"\.. "kedd"\.. "szerda"\.. "cs\u00fct\u00f6rt\u00f6k"\.. "p\u00e9ntek"\.. "szombat"].. ::msgcat::mcset hu MONTHS_ABBREV [list \.. "jan."\.. "febr."\.. "m\u00e1rc."\.. "\u00e1pr."\.. "m\u00e1j."\.. "j\u00fan."\.. "j\u00fal."\.. "aug."\.. "szept."\.. "okt."\.. "nov."\.. "dec."\.. ""].. ::msgcat::mcset hu MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "m\u00e1rcius"\.. "\u00e1prilis"\.. "m\u00e1jus"\.. "j\u00fanius"\.. "j\u00falius"\.. "augusztus"\.. "szeptembe
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):961
                                                                                                                                                                                    Entropy (8bit):4.02166638427728
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83dcTcWKutdXaMmEfc2ftdT2dHblWZ0VT:43dQrKutdntdI8g
                                                                                                                                                                                    MD5:191ACF2E8A8F10A1360B283D42886382
                                                                                                                                                                                    SHA1:EE2C00D021381EA638B6CE3F395DEA5F8491ED9B
                                                                                                                                                                                    SHA-256:41C0C3D3B4491E9B36E719466503EFCD325175CB7824C4A5055CB113D347BE0F
                                                                                                                                                                                    SHA-512:29BC4F7D3FAE7DE392B175FEA76138FA823B7D9D0B051A19A73F7D36D51DE34E0D0C7C129867307ABF51FC92E70853C15BD96B8484AD21EAB0A8EB83B0411E03
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \.. "Min"\.. "Sen"\.. "Sel"\.. "Rab"\.. "Kam"\.. "Jum"\.. "Sab"].. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \.. "Minggu"\.. "Senin"\.. "Selasa"\.. "Rabu"\.. "Kamis"\.. "Jumat"\.. "Sabtu"].. ::msgcat::mcset id MONTHS_ABBREV [list \.. "Jan"\.. "Peb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Agu"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset id MONTHS_FULL [list \.. "Januari"\.. "Pebruari"\.. "Maret"\.. "April"\.. "Mei"\.. "Juni"\.. "Juli"\.. "Agustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""]..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.904408530699153
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo0kGMo0F/W3v6ay/5o0kT+3vR6HyFvn:4EnLB383wG33v6ay/wK3voSVn
                                                                                                                                                                                    MD5:FEB4D50576BF3E11A0A40FD29ABE35A7
                                                                                                                                                                                    SHA1:8CEAA187C8AA5EC101743060A877D039850964CA
                                                                                                                                                                                    SHA-256:BA7FC0C0452D3E482DB6E19BDF512CACED639BA72B92ED8F66D80B52FEA11AC0
                                                                                                                                                                                    SHA-512:8B5D18E3D6628F369FB387C8EF08CC80000E0CBE500972958F4AD75F1C2F0DD6058F9777BD7DD0D7C26E7ECAA65E5071E2BF51B560973E88637942116C7576FB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y".. ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1305
                                                                                                                                                                                    Entropy (8bit):4.457417703528286
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83XVhVTeMVHGPbfXSmWzaZlfFxUQbW1U6ZY95n123etvmv3eTn:43Xz0b/uzaZtXUMw8n
                                                                                                                                                                                    MD5:ACF0452D5BB6D36A40061D2B0AF4D7A6
                                                                                                                                                                                    SHA1:9DF4D88F1962A672EFBDDE524550F7A5D02D446D
                                                                                                                                                                                    SHA-256:778BE3D6BFE2DFFB64FF1AFB9EC8351A3343B314CF93A68E8F7FD1073EE122BB
                                                                                                                                                                                    SHA-512:34CC02D7D28B5E161ED10250C214375561FD3D00979BFB8BCF3DB72A81BD9B7C225301528B400F7C54D8B6379F772EB6477D5D03F2CF7DC4DD19D22AEEC151B5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \.. "sun."\.. "m\u00e1n."\.. "\u00feri."\.. "mi\u00f0."\.. "fim."\.. "f\u00f6s."\.. "lau."].. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nudagur"\.. "\u00feri\u00f0judagur"\.. "mi\u00f0vikudagur"\.. "fimmtudagur"\.. "f\u00f6studagur"\.. "laugardagur"].. ::msgcat::mcset is MONTHS_ABBREV [list \.. "jan."\.. "feb."\.. "mar."\.. "apr."\.. "ma\u00ed"\.. "j\u00fan."\.. "j\u00fal."\.. "\u00e1g\u00fa."\.. "sep."\.. "okt."\.. "n\u00f3v."\.. "des."\.. ""].. ::msgcat::mcset is MONTHS_FULL [list \.. "jan\u00faar"\.. "febr\u00faar"\.. "mars"\.. "apr\u00edl"\.. "ma\u00ed"\.. "j\u00fan\u00ed"\.. "j\u00fal\
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1294
                                                                                                                                                                                    Entropy (8bit):4.282101355195382
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83JYEVI2vfYpQjAOnhWBIIsmdC2lkOKk+Z+FoPJ6G3vesvY:43JZVB8eAOnh4IzR2+J6G/eKY
                                                                                                                                                                                    MD5:3354A6FC06C298E33AA14163929E56EB
                                                                                                                                                                                    SHA1:C3005370DAE8A266AE21F7E2B871AEA5A656A155
                                                                                                                                                                                    SHA-256:1D72170B9F9028A237364F7CD7EA8B48BD4770E61922205CE862300103B13DE5
                                                                                                                                                                                    SHA-512:58B64D4F5827CA2A1BF2DDFD1F7EFDDBBD46709A6A9B7277E8EB386D80043A87ADDE2B3D5A49A934E8EB8F797BD735FADA1D22AD3DD856FFE9507F71B9E45CBA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mer"\.. "gio"\.. "ven"\.. "sab"].. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \.. "domenica"\.. "luned\u00ec"\.. "marted\u00ec"\.. "mercoled\u00ec"\.. "gioved\u00ec"\.. "venerd\u00ec"\.. "sabato"].. ::msgcat::mcset it MONTHS_ABBREV [list \.. "gen"\.. "feb"\.. "mar"\.. "apr"\.. "mag"\.. "giu"\.. "lug"\.. "ago"\.. "set"\.. "ott"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset it MONTHS_FULL [list \.. "gennaio"\.. "febbraio"\.. "marzo"\.. "aprile"\.. "maggio"\.. "giugno"\.. "luglio"\.. "agosto"\.. "settembre"\.. "ottobre"\.. "novembre"\.. "dicembre"\.. "
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):250
                                                                                                                                                                                    Entropy (8bit):4.8982877714191035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoi5jL/oyJ+3v1oia+3vjLtAsvn:4EnLB383b3F+3vV3v3tnn
                                                                                                                                                                                    MD5:E4400C16406A46C2880250522BED2EDE
                                                                                                                                                                                    SHA1:787A04037A355FF845025B8865335EB938280BFB
                                                                                                                                                                                    SHA-256:24B5F303F5C7AF6F63FDC23ADB4D713087AE74B6D18C117D787AF03374C5F57E
                                                                                                                                                                                    SHA-512:3551DEEF0EAAC66042143F77F2F4DD9154764F35BD624DAB3C9F0F59F3489CA39CE34BC2A69BC5BFBB1926C6F5C39D74A806ECB1A47F6B374101071957FD417B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y".. ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1689
                                                                                                                                                                                    Entropy (8bit):4.951012555106795
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83Gl84OCtnbf3wvtMwvLv4GTwhvevTwSoXghGhD6h:43FULWttbdEVoES8gshD6h
                                                                                                                                                                                    MD5:11FBE427747012444AEEAFD6134034A4
                                                                                                                                                                                    SHA1:58C72C432053264EAE6335D6CC93C5FFA33C42B8
                                                                                                                                                                                    SHA-256:2B6D15A191437F1B84FA7023E34153B61E6BF1DE1452EA921E9CCBBE5D4BEB1C
                                                                                                                                                                                    SHA-512:4F993BDF5D50D6D9F7410C83D226FEF30BA8C989F9977A7025C36BE22CEECCD6C68CDD6AFC5C9CE3D700559C4EDC619042E14DD88EE7583B9D5AA66F0268FD23
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u6708"\.. "\u706b"\.. "\u6c34"\.. "\u6728"\.. "\u91d1"\.. "\u571f"].. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \.. "\u65e5\u66dc\u65e5"\.. "\u6708\u66dc\u65e5"\.. "\u706b\u66dc\u65e5"\.. "\u6c34\u66dc\u65e5"\.. "\u6728\u66dc\u65e5"\.. "\u91d1\u66dc\u65e5"\.. "\u571f\u66dc\u65e5"].. ::msgcat::mcset ja MONTHS_FULL [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"].. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d".. ::msgcat::mcset ja CE "\u897f\u66a6".. ::msgcat::mcset ja AM "\u5348\u524d".. ::msgcat::mcset ja PM "\u5348\u5f8c".. ::ms
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1025
                                                                                                                                                                                    Entropy (8bit):4.097746630492712
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83E7XIE/OWbjH3Tw2PzJrIsmZ5maAXaMHPB:43WlrraA/vB
                                                                                                                                                                                    MD5:2F79804667D6F8C77BB188D59EF5F3DF
                                                                                                                                                                                    SHA1:10950ECA798F24A7C405B3E18B559CCC0C056EC1
                                                                                                                                                                                    SHA-256:96FF17F1CFF976E4E204D3616D1EFCED4D0F907C5E6A0F04B4536CB4AD1190C9
                                                                                                                                                                                    SHA-512:1B8ADC3B7FF920F8F53A17BFCC7EA24A0F8E276A42E5C63F9880DAE9B74E12716DD12DB647A80A9D99294449146C643EC58A33B03681AA4FA26A5FBC508C248C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \.. "sab"\.. "ata"\.. "mar"\.. "pin"\.. "sis"\.. "tal"\.. "arf"].. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \.. "sabaat"\.. "ataasinngorneq"\.. "marlunngorneq"\.. "pingasunngorneq"\.. "sisamanngorneq"\.. "tallimanngorneq"\.. "arfininngorneq"].. ::msgcat::mcset kl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset kl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "martsi"\.. "aprili"\.. "maji"\.. "juni"\.. "juli"\.. "augustusi"\.. "septemberi"\.. "oktoberi"\.. "novemberi"\.. "dece
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.882476709336307
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoEpb53FuoEpLE3vLjoEpLE3v6mjoEpba+3vnFDoAkvn:4EnLB383jF3Fyw3vxw3v6A/3v9dmn
                                                                                                                                                                                    MD5:255830678C8724E65C05A7E020E68B5B
                                                                                                                                                                                    SHA1:0AEA48AB0439C04F92B5CA9A3B5182718B7F116B
                                                                                                                                                                                    SHA-256:3027CFE9EBD2172CEFC15C025786CAD47A6E2894BF0474AFC1B0C341E70202AA
                                                                                                                                                                                    SHA-512:99039FFA7269DD136D1693121E261DB5586E86EC401D2B1EB8FB1D13A9A7F1E514D9FC941B838286B986C02ED281828ED67E59002D837E350A64F4832340516A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y".. ::msgcat::mcset kl_GL TIME_FORMAT "%T".. ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T".. ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1621
                                                                                                                                                                                    Entropy (8bit):4.612163420716489
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:43fMlylslXlslxl1hVuqLGuqqntH4xUyw9:2fKYqVq3f
                                                                                                                                                                                    MD5:CCB2C2254D3FA3025183DB7E010CAD66
                                                                                                                                                                                    SHA1:510BBB6A9162F2EF908E6561CC714848C2EA74CA
                                                                                                                                                                                    SHA-256:EF6FB319C398EEA79B3A951319F831F3B186D556565D17D738E5F9B4B77570F2
                                                                                                                                                                                    SHA-512:A0264565899BD1B0783ADC0388F893CCE713ADB23BDD63907CF092A74ACB4F7D3BE09DA29801E9C11A7B08CB1706E3771C598ACED351A0FCCBF4EBBD7871148D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \.. "\uc77c"\.. "\uc6d4"\.. "\ud654"\.. "\uc218"\.. "\ubaa9"\.. "\uae08"\.. "\ud1a0"].. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \.. "\uc77c\uc694\uc77c"\.. "\uc6d4\uc694\uc77c"\.. "\ud654\uc694\uc77c"\.. "\uc218\uc694\uc77c"\.. "\ubaa9\uc694\uc77c"\.. "\uae08\uc694\uc77c"\.. "\ud1a0\uc694\uc77c"].. ::msgcat::mcset ko MONTHS_ABBREV [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\.. "7\uc6d4"\.. "8\uc6d4"\.. "9\uc6d4"\.. "10\uc6d4"\.. "11\uc6d4"\.. "12\uc6d4"\.. ""].. ::msgcat::mcset ko MONTHS_FULL [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):354
                                                                                                                                                                                    Entropy (8bit):5.058233326545794
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo56SFZhjAo56m5Ys5o56TGMovBo56a/W3v6mfKo56TT+3+:4EnLB383g62vjV6m5Ysg6TG26a+3v6oo
                                                                                                                                                                                    MD5:58CA45CE26AF8ECA729BA72898BB633D
                                                                                                                                                                                    SHA1:CBBEDB7370890A1DB65080A359A9A5C164B525D5
                                                                                                                                                                                    SHA-256:4CAC8FB43D290A63A4D3215F22228B358AB4FA174F08712DD6C5B64C5E485071
                                                                                                                                                                                    SHA-512:48CCBD3F7B96D0998B6D1A1F8D7FE2B4B070BB5B8809FABE0A38209AEAF2E95E098292A5B9B5F0954E7729708A2173D32AAD70B6C0F336DB1E9BFA2968E6A56B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804".. ::msgcat::mcset ko_KR CE "\uc11c\uae30".. ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d".. ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S".. ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1997
                                                                                                                                                                                    Entropy (8bit):4.202940482570495
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83cm48Vc7VczMmDNVcYVcR0prdSmS68FeDJVcYVcR0prdSmS68FeuT:4354a+0prjS68mq0prjS68pT
                                                                                                                                                                                    MD5:67FA08F588A3B44D67E42EC1025013BC
                                                                                                                                                                                    SHA1:6895FEF0476DE0349895DB052B335AC46636B23A
                                                                                                                                                                                    SHA-256:9D215E31A39FED45B3657144E5F73C942E59E500036CE16B1FFF201FD6358595
                                                                                                                                                                                    SHA-512:4C2708BD9DD98320D3133EEFFD19A8018F49A36AB8348DB7C0B0287ADB4C052D3EFAD3686C8E46E0520F3CE27F361978272BA8752EB04E5A7BC07780398480DB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \.. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset kok MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):260
                                                                                                                                                                                    Entropy (8bit):4.904340548436718
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo5VsNv+IZo5VsU3v6ry/5o5VsNo+3v+6f6HyFvn:4EnLB383gVsNvlAVsU3v6ry/gVsNF3vj
                                                                                                                                                                                    MD5:0AA20289A63BA3A14DCFED75EED980DE
                                                                                                                                                                                    SHA1:2B76013593D886B0724D82849FD1840B20922902
                                                                                                                                                                                    SHA-256:644F2B6D4BA27AF14891B781DEF60F708A9F18FC2F73566649B631A6DEA3EF09
                                                                                                                                                                                    SHA-512:6E13E0DC8BFD2ABE0D04B0BC098C40972F088F8D3D6ACA00338B17473ABC6F69840A88EC0C965C493B4270DEC777A0EA2D762BC33044EFE7030E437604EE201B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1013
                                                                                                                                                                                    Entropy (8bit):4.060027087416375
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83no1UwRlw4MAwBdc//3rpF6HFoot8:43vglHM7MTCHFs
                                                                                                                                                                                    MD5:CCEC7B77DCA1F6A406311FC43EE57030
                                                                                                                                                                                    SHA1:4ED329BB09A8F7C67F8984CD790E9B6819DE6F00
                                                                                                                                                                                    SHA-256:EAB468AC5BF1833D4F8CD658789413D4A46CAD16B63FB9B906CFF6DC9EA26251
                                                                                                                                                                                    SHA-512:4EFF6E49CC479A1BF0CEEAE256A1FAE7D4AE7D0ACE23CD87851471EC96BB5AF580C58A142E1B6CE72BC8B6BFF946A38801E681443B7DD9527A1DEB6E7EDD7D22
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \.. "Sul"\.. "Lun"\.. "Mth"\.. "Mhr"\.. "Yow"\.. "Gwe"\.. "Sad"].. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \.. "De Sul"\.. "De Lun"\.. "De Merth"\.. "De Merher"\.. "De Yow"\.. "De Gwener"\.. "De Sadorn"].. ::msgcat::mcset kw MONTHS_ABBREV [list \.. "Gen"\.. "Whe"\.. "Mer"\.. "Ebr"\.. "Me"\.. "Evn"\.. "Gor"\.. "Est"\.. "Gwn"\.. "Hed"\.. "Du"\.. "Kev"\.. ""].. ::msgcat::mcset kw MONTHS_FULL [list \.. "Mys Genver"\.. "Mys Whevrel"\.. "Mys Merth"\.. "Mys Ebrel"\.. "Mys Me"\.. "Mys Evan"\.. "Mys Gortheren"\.. "Mye Est"\.. "Mys Gwyngala"\.. "Mys Hedra"\.. "Mys Du"\.. "Mys Kevardhu"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.959913054070712
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoh6AvMoh633v6ay/5oh6Ao+3vR6HyFvn:4EnLB38346AvR633v6ay/46AF3voSVn
                                                                                                                                                                                    MD5:18E8576F63B978F1AFEF15AC57B44FBF
                                                                                                                                                                                    SHA1:D50EB90944FF81E3CBFF942B16C1874EB7EA2562
                                                                                                                                                                                    SHA-256:EDAC14D929D1C6559EC46E9B460F8F44A189B78FB915F2D641104549CBD94188
                                                                                                                                                                                    SHA-512:F3DE5EE77BB889DA1353F9C9A1811083AB28BBEE4B7D6C8782F38B1AE44CF77565371A0E18F7E2BACD7EF590BC1215CA3E41AF929A15F60B3E85F6099A4CF378
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1307
                                                                                                                                                                                    Entropy (8bit):4.506235846178408
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83iHYuAMLzHYCaNu3d3nT15T31FhAlDgK/YrDZ/6Qz2C9kGPCveksvc:43iHFnHuUd3/T3xM/+SQCC9kGPEekKc
                                                                                                                                                                                    MD5:D4EC2E96995E0EB263F338DD16CC4F8D
                                                                                                                                                                                    SHA1:7ED86175489B1AE3CA5C0E8D42969F951C895D6B
                                                                                                                                                                                    SHA-256:855B652FCC8066BA45C7DC8DBFD3807D1B4759EA8D71C523567F47BF445D1DE6
                                                                                                                                                                                    SHA-512:A55E0D759A22360FF6668CEFAFFB812BABB316C447ADDB1FD5CDBC06AE1DA2E891E09952D073164C013AD9BF4184614102E7ADA553EEEFB2BBA26208B79B277F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \.. "Sk"\.. "Pr"\.. "An"\.. "Tr"\.. "Kt"\.. "Pn"\.. "\u0160t"].. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \.. "Sekmadienis"\.. "Pirmadienis"\.. "Antradienis"\.. "Tre\u010diadienis"\.. "Ketvirtadienis"\.. "Penktadienis"\.. "\u0160e\u0161tadienis"].. ::msgcat::mcset lt MONTHS_ABBREV [list \.. "Sau"\.. "Vas"\.. "Kov"\.. "Bal"\.. "Geg"\.. "Bir"\.. "Lie"\.. "Rgp"\.. "Rgs"\.. "Spa"\.. "Lap"\.. "Grd"\.. ""].. ::msgcat::mcset lt MONTHS_FULL [list \.. "Sausio"\.. "Vasario"\.. "Kovo"\.. "Baland\u017eio"\.. "Gegu\u017e\u0117s"\.. "Bir\u017eelio"\.. "Liepos"\.. "Rugpj\u016b\u010dio"\.. "Rugs\u0117jo"\.. "Spa
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):4.460631492946299
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83Amshb4mZdA7nl9kMmfpK269rkbi5vWm0W9ARivirXsv05vkn:430bHA7XRr95QWQQgaKkn
                                                                                                                                                                                    MD5:554ED2CAFD25F5F82DA54AE057F4BA98
                                                                                                                                                                                    SHA1:E25CDF0F9C4B523B5B05408E7820F7B4F627D19E
                                                                                                                                                                                    SHA-256:7E90D2008B220DB19C796C7107AD69D263B8AC8C7BDDFB879230699D978E9A0A
                                                                                                                                                                                    SHA-512:612201CCD64A51EC943921196D8C74D8BCA3AB3E35B0C9E91AE7F3A6B36F4F255AA9ADB3A254EC03629B01BD221B0B3F8CC4DFBFAC1F1718775E81CAD188AA86
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \.. "Sv"\.. "P"\.. "O"\.. "T"\.. "C"\.. "Pk"\.. "S"].. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \.. "sv\u0113tdiena"\.. "pirmdiena"\.. "otrdiena"\.. "tre\u0161diena"\.. "ceturdien"\.. "piektdiena"\.. "sestdiena"].. ::msgcat::mcset lv MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maijs"\.. "J\u016bn"\.. "J\u016bl"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset lv MONTHS_FULL [list \.. "janv\u0101ris"\.. "febru\u0101ris"\.. "marts"\.. "apr\u012blis"\.. "maijs"\.. "j\u016bnijs"\.. "j\u016blijs"\.. "augusts"\.. "septembris"\.. "oktobris"\.. "novembris"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2157
                                                                                                                                                                                    Entropy (8bit):4.299300188052441
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:4389QMsGqdQfRQPjQmofqJp9sk5BstSpWQiQ3QJQ5QL39I0QRQTQ8Ql4J8W:2W8SMq+9sWINi2Kc9I0+gXF
                                                                                                                                                                                    MD5:888014F13A82511ABEF99497A753BFC3
                                                                                                                                                                                    SHA1:7F4231BEDE191370B37E8B917B6AD8829D15CA7D
                                                                                                                                                                                    SHA-256:4C0EB07F0FCB36DD12A3F7EDD6531616611ABF62BF7705B5A37CC59098221D5D
                                                                                                                                                                                    SHA-512:D748127CC615584901D35B6492EC566448B6C4DA6363858B5145921E9CD09490355CF4315F0F7A8542AA12790CD3432011A643A3A8F74B0119DB0DCE19FD68A4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0435\u0434."\.. "\u043f\u043e\u043d."\.. "\u0432\u0442."\.. "\u0441\u0440\u0435."\.. "\u0447\u0435\u0442."\.. "\u043f\u0435\u0442."\.. "\u0441\u0430\u0431."].. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0435\u043b\u0430"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\.. "\u043f\u0435\u0442\u043e\u043a"\.. "\u0441\u0430\u0431\u043e\u0442\u0430"].. ::msgcat::mcset mk MONTHS_ABBREV [list \.. "\u0458\u0430\u043d."\.. "\u0444\u0435\u0432."\.. "\u043c\u0430\u0440."\.. "\u0430\u043f\u0440."\.. "\u043c\u0430\u0458."\.. "\u0458\u0443\u
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1846
                                                                                                                                                                                    Entropy (8bit):4.220147808639664
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR833cXh48Vc7VczfVczPmzNVcYVcR0prdSmS68FezUVcYVcR0prdSmS68FeoV:43K4S+0prjS68Yh0prjS68nV
                                                                                                                                                                                    MD5:07F99E0A05083B10F80A4D6867163B23
                                                                                                                                                                                    SHA1:B6036C7DA8043E3401583D03831E7A4BF755D93D
                                                                                                                                                                                    SHA-256:AE873BF5484EACBBE179913D43451BE53378FA701B5D81594D052266B8A09AF0
                                                                                                                                                                                    SHA-512:3A032C81B8FBFEE6EB66C1538CBD16329A1B393E4684B4E9B3FBCDD6344CE8AD34FA699F76EF953B3EB597D8E253345F54C2E92E7A43611C721038BCC2471EA2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset mr MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\u091f\u0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.89440333975705
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoGNv+IZoGU3v6ry/5oGNo+3v+6f6HyFvn:4EnLB383Zvlw3v6ry/ZF3vmSVn
                                                                                                                                                                                    MD5:67368E8A5715860BABD44E54A168192F
                                                                                                                                                                                    SHA1:7790D4B4B28FE5E38AB11CD037FFB826A8EB77FD
                                                                                                                                                                                    SHA-256:B7B1D379355A1D278E13EF557A887A662E84FB6A9B62B8E19A27927926270EF9
                                                                                                                                                                                    SHA-512:E95C90CFFA7CC4E61026FC328A4AA0BEE6A54A0061BA0B9459F9F0F4B008DD36F81BC9B8D8B964FA051FCEAB7FECE6D107CD456B3FD01A83B4900ECC3A0BCFA4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):957
                                                                                                                                                                                    Entropy (8bit):4.018924167342869
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:4EnLB383Zm/aufodZmt+JHEA7UVRosmAL/7Idzr43xRRosuL1PJHWZ6tHhHjv:4aR83ZsauSHJkA7umE/72UD21PJWZ0hT
                                                                                                                                                                                    MD5:7E6A943B7D82404F61BDBD95682073CD
                                                                                                                                                                                    SHA1:B96DBB1738F293D2842FDCEDF2DEF13004F77A8D
                                                                                                                                                                                    SHA-256:970B2F3ECC04980FCC2F9531CA6CE2BF36BC12942CB614BF70313B4CB0508985
                                                                                                                                                                                    SHA-512:12F5A5F7A170EE79D1F4398E96FF2DE84472027C5B5003DE7E86F46713E3F0997439E2EBA03FFB7DB611F0CE0E06EB149F5BD08ED2AA0409DB8348867487FFFD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \.. "Aha"\.. "Isn"\.. "Sei"\.. "Rab"\.. "Kha"\.. "Jum"\.. "Sab"].. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \.. "Ahad"\.. "Isnin"\.. "Selasa"\.. "Rahu"\.. "Khamis"\.. "Jumaat"\.. "Sabtu"].. ::msgcat::mcset ms MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mac"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ogos"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dis"\.. ""].. ::msgcat::mcset ms MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Mac"\.. "April"\.. "Mei"\.. "Jun"\.. "Julai"\.. "Ogos"\.. "September"\.. "Oktober"\.. "November"\.. "Disember"\.. ""]..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):265
                                                                                                                                                                                    Entropy (8bit):4.818053174805798
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoChFfluoChF+3v6xyFjoCh++3vflm68vn:4EnLB383xPflwe3v6gZl3vflm6+n
                                                                                                                                                                                    MD5:A02F11BE0DF920E63E7A3ACCE746E32D
                                                                                                                                                                                    SHA1:4A8B1EF1A6F8A5FD022042D6E009A01E4B0FEBD3
                                                                                                                                                                                    SHA-256:F5B859D8DD2A2B5F756E39B0DFEB26B95878D2F54BA3CE46C56F0F26CF2B554B
                                                                                                                                                                                    SHA-512:5F9AF8C89F491CB4C158ED73EA4CF32E6A83CF44A94DA6FE1A962C58199BF2348530F3DEFA0C6F433BA3ADEF81AE9B3884F30CD7A841B159D52F9F21008B4F92
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):717
                                                                                                                                                                                    Entropy (8bit):4.55153350337982
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:4EnLB383VYmxWHWog4QUbxMmAMMiGZu+3v6ay/GK3vZsSVn:4aR83VYsxonQ2MmVVGRvjCGsvGSV
                                                                                                                                                                                    MD5:D8BBEC2F8935054E6081BB5E4AE8F7E3
                                                                                                                                                                                    SHA1:33FE6D51A284B8760BC6F442329B10374F506BDA
                                                                                                                                                                                    SHA-256:7DBC4E82D82FDE8CDF522FA10E082289D46B0C1A4A7D7A5FA83FF116677F052B
                                                                                                                                                                                    SHA-512:BF39C75DD6B3625897D7D44AC253AF5656CA21D0B394F78611584E2606CBC419C4A02353542D23393BEBCCF0CB4D861CDECD61AD89339F78C0260E966B495777
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \.. "\u0126ad"\.. "Tne"\.. "Tli"\.. "Erb"\.. "\u0126am"\.. "\u0120im"].. ::msgcat::mcset mt MONTHS_ABBREV [list \.. "Jan"\.. "Fra"\.. "Mar"\.. "Apr"\.. "Mej"\.. "\u0120un"\.. "Lul"\.. "Awi"\.. "Set"\.. "Ott"\.. "Nov"].. ::msgcat::mcset mt BCE "QK".. ::msgcat::mcset mt CE "".. ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y".. ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1209
                                                                                                                                                                                    Entropy (8bit):4.313626715960843
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83B0tSYuZrIsmYmPAxyIQ4HU92W16EL3Tvav31:43qhuZrIPAt04yTcF
                                                                                                                                                                                    MD5:42D02C3CAF28BE4994F27CEF5A183AB7
                                                                                                                                                                                    SHA1:DC411E8AC12C3D588AB2F3A3C95A75D8689AD402
                                                                                                                                                                                    SHA-256:534C5DACEF12F818FAF4ED806997A559F95D591F1B6236B0C30B07A107DD13F3
                                                                                                                                                                                    SHA-512:0BE27572106324FE2B6CDFF4513500DE7582AD1ABEF451FFC62B2050D3875A149DDDB66451E1B3F5BA9216268E9998D2A1C1E8343BBB9EF97947DA054B82818E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset nb MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nb MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nb BC
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1129
                                                                                                                                                                                    Entropy (8bit):4.235969198645435
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR837Ed+RxRMZZsmUmnZAEEHM92WFU5vtrvs:43AAHRMZZPnZALsCtt7s
                                                                                                                                                                                    MD5:B9B949794203D204628D4DBEA29587AE
                                                                                                                                                                                    SHA1:1642D8040144469B5C359E80693E68036F87B849
                                                                                                                                                                                    SHA-256:9E2FE3851CF13EC79A9B10A09B01CEB0A26044AE0DC90A4E00BE57745E854C79
                                                                                                                                                                                    SHA-512:0CCCCF6D61423CEE0389C3BA1A8E94F2B092C53465D1937F5595AF91E46DD38B318D6C7EE3D88B89F32BFB952C0D55E0E67B46D7DF306ECA6690E283ADEB2CB9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \.. "zo"\.. "ma"\.. "di"\.. "wo"\.. "do"\.. "vr"\.. "za"].. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \.. "zondag"\.. "maandag"\.. "dinsdag"\.. "woensdag"\.. "donderdag"\.. "vrijdag"\.. "zaterdag"].. ::msgcat::mcset nl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mrt"\.. "apr"\.. "mei"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset nl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "maart"\.. "april"\.. "mei"\.. "juni"\.. "juli"\.. "augustus"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset nl DATE_FORM
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.865165930946383
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xo4gPPdjog9X3vLjog9X3v6mjo49+3vnFDoAkvn:4EnLB3835gHdPF3vjF3v64I3v9dmn
                                                                                                                                                                                    MD5:3261F397ED0291368FF1881E7BA08ECE
                                                                                                                                                                                    SHA1:7147ABB62034EB152B1FED9246A533535F07372C
                                                                                                                                                                                    SHA-256:77A69DD60D171B321512B14794E75A66FF753410C007997B310790D86E09B057
                                                                                                                                                                                    SHA-512:C1526F454FA594DAD056B056F76F01D8B2AB713D04EB2A3643416B8E741B248CC94E000BAEE5B0F60436B88B1216FB1DE7F7C3FA456D4A4FBDE24F97C3B739B8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y".. ::msgcat::mcset nl_BE TIME_FORMAT "%T".. ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1200
                                                                                                                                                                                    Entropy (8bit):4.282788574144479
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83tCtrJwuQrIsmYmLAxyIQ4HU92W1W4/3Hv+v31:434suQrILAt0EafIF
                                                                                                                                                                                    MD5:985E97517C2BF37719A618F575DF392C
                                                                                                                                                                                    SHA1:65BC07FC3A955300ED09B7485F90AEC18CBAD43F
                                                                                                                                                                                    SHA-256:06FA2D6D8C59D0B8EAC2EDE5AB0DDB8B6E095D1A023B1966FCE3B65916FA14FB
                                                                                                                                                                                    SHA-512:75BC14DBAD147A98D32D2AF0BE0BE50F115BB9C3BBE283B53977B9F264A055734B30F6B1C4EEE9686F1874D178C535111731C92D495B7D370FB17213B65C9A40
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "m\u00e5"\.. "ty"\.. "on"\.. "to"\.. "fr"\.. "lau"].. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \.. "sundag"\.. "m\u00e5ndag"\.. "tysdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "laurdag"].. ::msgcat::mcset nn MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nn MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nn BCE "f.Kr."
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1263
                                                                                                                                                                                    Entropy (8bit):4.459506202908786
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83lUj0ORGgIzdW6RDYKG7FwRc0ypvOvX:43+HMg2W6RDYnFwRc0ydYX
                                                                                                                                                                                    MD5:79AB7C13AA3833A1DAEADDB1144CCE55
                                                                                                                                                                                    SHA1:C01ABC2F16549CAEC6B081448B2CBA88A680E250
                                                                                                                                                                                    SHA-256:61462C325DB0065352D8155307F949869862A86CAC67AD7BB6703F57A7FA2FF3
                                                                                                                                                                                    SHA-512:79EB696164FDDD9B121558C2780E54E295FF2DC4D8E87A0DE507B4F2925612721A98FF5010199CB68CF894ACA7A07884E9E02F3DC1E078D241431E3DC884C0A1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \.. "N"\.. "Pn"\.. "Wt"\.. "\u015ar"\.. "Cz"\.. "Pt"\.. "So"].. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \.. "niedziela"\.. "poniedzia\u0142ek"\.. "wtorek"\.. "\u015broda"\.. "czwartek"\.. "pi\u0105tek"\.. "sobota"].. ::msgcat::mcset pl MONTHS_ABBREV [list \.. "sty"\.. "lut"\.. "mar"\.. "kwi"\.. "maj"\.. "cze"\.. "lip"\.. "sie"\.. "wrz"\.. "pa\u017a"\.. "lis"\.. "gru"\.. ""].. ::msgcat::mcset pl MONTHS_FULL [list \.. "stycze\u0144"\.. "luty"\.. "marzec"\.. "kwiecie\u0144"\.. "maj"\.. "czerwiec"\.. "lipiec"\.. "sierpie\u0144"\.. "wrzesie\u0144"\.. "pa\u017adziernik"\.. "listopad"\..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1177
                                                                                                                                                                                    Entropy (8bit):4.394980756969744
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83CYkjBc1yHYJt//0/I31YMY47flV7YaqgCyt9Fo8g6Gtvt76svi:43C5LHcNnxJ9Ltg6Gpt76Ki
                                                                                                                                                                                    MD5:8F53B3571DD29E12BD33349CFA32F28F
                                                                                                                                                                                    SHA1:C125E059B8BFE5FECD482D1A1DA50B8678872BF6
                                                                                                                                                                                    SHA-256:6F6EEEDDCF232BDCB952592A144810CED44A1CBB4BCC2C062D5F98D441505380
                                                                                                                                                                                    SHA-512:5CD7E7097B720E5399795126A71348816CBA697FD8F14160779E982ADAB00D5994978E2F9445785B0DE62F6F14232278AD1A65BC53730CA58D676B057F0BC406
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Seg"\.. "Ter"\.. "Qua"\.. "Qui"\.. "Sex"\.. "S\u00e1b"].. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Segunda-feira"\.. "Ter\u00e7a-feira"\.. "Quarta-feira"\.. "Quinta-feira"\.. "Sexta-feira"\.. "S\u00e1bado"].. ::msgcat::mcset pt MONTHS_ABBREV [list \.. "Jan"\.. "Fev"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset pt MONTHS_FULL [list \.. "Janeiro"\.. "Fevereiro"\.. "Mar\u00e7o"\.. "Abril"\.. "Maio"\.. "Junho"\.. "Julho"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Dezembro"
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):286
                                                                                                                                                                                    Entropy (8bit):4.8608779725401785
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xofm6GPWWjofAW3vLjofAW3v6mjofm6T+3vnFDoAkvn:4EnLB383+NGdg93vk93v6fNK3v9dmn
                                                                                                                                                                                    MD5:A2626EA95C2480FEA68906AE6A1F6993
                                                                                                                                                                                    SHA1:A0592902337C00FC2E70B1DFB3A42453A86535BB
                                                                                                                                                                                    SHA-256:320BE7D5B730091E6FA35F196314737261C8E154577DCF6AC8C2057D44394AD7
                                                                                                                                                                                    SHA-512:9801A87D024565676D4F3EAF0702C213E59FC2B6719D8BE95C19C9ED53FC43487F65F5408378B401A2B4C2BD4E2E391C2D848CA87739A6082AB7766EC6B9EFE1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset pt_BR TIME_FORMAT "%T".. ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T".. ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1224
                                                                                                                                                                                    Entropy (8bit):4.350784108088039
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83coPUMSeZmkTMm41icpK+7ZVoImEcVUCWdvHvWIn:43lPHFmkm1iMVoxEc+CWZPWIn
                                                                                                                                                                                    MD5:F6575EC17966320106FF7ABDFB3186E2
                                                                                                                                                                                    SHA1:68C6B72D664FDA27450FCE8B5734AB627CE825D7
                                                                                                                                                                                    SHA-256:25ED6AC7A353E23B954B98611AE3B7E56BDCF2B0CB0DB358253CFB8BEBBB831C
                                                                                                                                                                                    SHA-512:E564543231922A17C898419545BFA65E5E31FE9F005FDD201B735CFDE08E96FB3B98349C2A7959E29CA8F7E6934B0C4C6DE6B5E67209D0DD9A7746DFEBF037B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \.. "D"\.. "L"\.. "Ma"\.. "Mi"\.. "J"\.. "V"\.. "S"].. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \.. "duminic\u0103"\.. "luni"\.. "mar\u0163i"\.. "miercuri"\.. "joi"\.. "vineri"\.. "s\u00eemb\u0103t\u0103"].. ::msgcat::mcset ro MONTHS_ABBREV [list \.. "Ian"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mai"\.. "Iun"\.. "Iul"\.. "Aug"\.. "Sep"\.. "Oct"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset ro MONTHS_FULL [list \.. "ianuarie"\.. "februarie"\.. "martie"\.. "aprilie"\.. "mai"\.. "iunie"\.. "iulie"\.. "august"\.. "septembrie"\.. "octombrie"\.. "noiembrie"\.. "decembrie"\.. ""].. ::msgcat:
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2091
                                                                                                                                                                                    Entropy (8bit):4.2886524607041006
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:43D+pQ7keidQfRQPgQHB81Z/sFIAZSQWQXQrQxJQjQRnQBFQiWftkWt:26pgkeoSnpjA4tMYiJcCMFmVRt
                                                                                                                                                                                    MD5:9F1C8DD58550558977821FD500E7C0E0
                                                                                                                                                                                    SHA1:EFDD809BC2872A5BE0E353D31BE6D7D72E4B829C
                                                                                                                                                                                    SHA-256:BB35BB6F07BAEF72C329EC3E95D6527A2736070EE2FFE5DE227E1FF0332390F8
                                                                                                                                                                                    SHA-512:AA3C5C40AE9D342F8287958355C3321CF60566AD3E84E3D18D782FC022A998DA275506A61010A65D2E7D7578F2919C47C63AB0BA63A38800AA48D4B88ACE54D3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \.. "\u0412\u0441"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \.. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\.. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\.. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"].. ::msgcat::mcset ru MONTHS_ABBREV [list \.. "\u044f\u043d\u0432"\.. "\u0444\u0435\u0432"\.. "\u043c\u0430\u0440"\.. "\u0430\u043f\u0440"\.. "\u043c\u0430\u0439"\.. "\u0438\u044e\u
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):248
                                                                                                                                                                                    Entropy (8bit):4.9420431225061
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoVAgWIZoVY9X3vtfNrsoVA9+3vW6Q9vn:4EnLB383SFWIyaX3vtNl/3vWHNn
                                                                                                                                                                                    MD5:DC98D88964650E302BE97FDB3B33326E
                                                                                                                                                                                    SHA1:1DDDCC4265D7B980B867FEE674BEF2FD87D823F7
                                                                                                                                                                                    SHA-256:13E4E79A0ED82034BADE0CFF8DEF5DE1222F6968108AD710662BDB7DAF36D7E1
                                                                                                                                                                                    SHA-512:F3B9D528C529DD520FEDA3C20ED354E521C5B3C29F3317E15B7939CE06A3D67554D34DD6E54FE038585E46C560C604A1FD7E7F84914086B5994D52CE2C9E99CE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y".. ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1212
                                                                                                                                                                                    Entropy (8bit):4.359036493565628
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83/YIXo4YY0dD6kMm7fX2NaSIvZdHZgHZ/IxvaGWxvtl9svWTN:43rLTR44/yWltOWB
                                                                                                                                                                                    MD5:E297221FA73BD78577B398BC7D061D21
                                                                                                                                                                                    SHA1:F2A6B456272F913A9E97C495CEE73AC774C90FA1
                                                                                                                                                                                    SHA-256:E65D6E5E837DF0A2DF0DB77BCE45334BBC27EFFF9023C37119E75D49932D9D6C
                                                                                                                                                                                    SHA-512:AB9DDAE7CB21193C7753041F0B88CF2D40987E7E604B47816219458D217F084AA4EBF36719E22AAB3FD71A271D9F956ADC353182991903D7ADE8C8F00F6B2F9B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Uto"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sub"].. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljak"\.. "Utorak"\.. "Sreda"\.. "\u010cetvrtak"\.. "Petak"\.. "Subota"].. ::msgcat::mcset sh MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maj"\.. "Jun"\.. "Jul"\.. "Avg"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset sh MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "Mart"\.. "April"\.. "Maj"\.. "Juni"\.. "Juli"\.. "Avgust"\.. "Septembar"\.. "Oktobar"\.. "Novembar"\.. "Decembar"\.. ""].. ::msgcat::mcset sh BC
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1255
                                                                                                                                                                                    Entropy (8bit):4.4043119723436135
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83c46o40u3rIsmJIcm93ApLDVb2IcU95WFGEXF3eUCvtz/v3e6:43c3ow3rF93Ap7tEXFREtznp
                                                                                                                                                                                    MD5:24DA40901D907D35195CC1B3A675EBC7
                                                                                                                                                                                    SHA1:8AF31248F06FADA5CFB0D83A940CFF5CE70E2577
                                                                                                                                                                                    SHA-256:976813F6C53C9BEBBF976B0F560FD7FC5E4EC4C574D7E1CD31F9A4056765CB7A
                                                                                                                                                                                    SHA-512:A9BC6AAFE9AEEDFD1E483E54A2D27871A09ADD6807D8F90410CD2BB82A91BA9DF435652EC9A7C3AD0A080D7F153CA848BB47DAD3936BA30E4AEFF3C474C433CC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "Ut"\.. "St"\.. "\u0160t"\.. "Pa"\.. "So"].. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \.. "Nede\u013ee"\.. "Pondelok"\.. "Utorok"\.. "Streda"\.. "\u0160tvrtok"\.. "Piatok"\.. "Sobota"].. ::msgcat::mcset sk MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sk MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "marec"\.. "apr\u00edl"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "august"\.. "september"\.. "okt\u00f3ber"\.. "november"\.. "decem
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1216
                                                                                                                                                                                    Entropy (8bit):4.333705818952628
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83MIXpC9opYuGS/BrIsmZ5hv1yAxyIVjd392WFThENvt0vJoO:43fXYujZrqyApYJtyR
                                                                                                                                                                                    MD5:CB76F54CBE0D1AAE8BA956B4C51CBD2A
                                                                                                                                                                                    SHA1:C1F78375EDB0BD2504553E33B2024C0C63FDB1B2
                                                                                                                                                                                    SHA-256:11A6264676DBED87E4F718075127E32E107854F35F141642454F484984084486
                                                                                                                                                                                    SHA-512:69964348FF08DE6EEB5E3DD61057FF0DF5441105EB7BEE7FB7E9AC5E26DCC164E3C7C011CA5CD7BC5B97A7872532331C97CCBC80563F6C5A3548014BFA8BEF16
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Tor"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sob"].. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljek"\.. "Torek"\.. "Sreda"\.. "\u010cetrtek"\.. "Petek"\.. "Sobota"].. ::msgcat::mcset sl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "avg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sl MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marec"\.. "april"\.. "maj"\.. "junij"\.. "julij"\.. "avgust"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset sl B
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1321
                                                                                                                                                                                    Entropy (8bit):4.408176575111904
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83F7ONQEwXwjjTlVoSEh76W/X+WZQJ4hv+H6v2V:43NwjPEwl4VQ8q
                                                                                                                                                                                    MD5:E606F620F03EC0FBDBE6551601299C5F
                                                                                                                                                                                    SHA1:0B50AB679E8D90D8E7319BCADAC426E004594D3B
                                                                                                                                                                                    SHA-256:1F4EFD78F6B45B65F73F09B2F52FC13C2A7C4138DCB7664804878D197B6EBDF9
                                                                                                                                                                                    SHA-512:08AF2B51EB7111E334ADDA3A03F9A8816C104E9742B523EC363FB5131A3DF73D298A8DDCD573D23C23C65CCFD2B8898DF75AE3D4F04BF80744044FB6BAB5EC0A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \.. "Die"\.. "H\u00ebn"\.. "Mar"\.. "M\u00ebr"\.. "Enj"\.. "Pre"\.. "Sht"].. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \.. "e diel"\.. "e h\u00ebn\u00eb"\.. "e mart\u00eb"\.. "e m\u00ebrkur\u00eb"\.. "e enjte"\.. "e premte"\.. "e shtun\u00eb"].. ::msgcat::mcset sq MONTHS_ABBREV [list \.. "Jan"\.. "Shk"\.. "Mar"\.. "Pri"\.. "Maj"\.. "Qer"\.. "Kor"\.. "Gsh"\.. "Sht"\.. "Tet"\.. "N\u00ebn"\.. "Dhj"\.. ""].. ::msgcat::mcset sq MONTHS_FULL [list \.. "janar"\.. "shkurt"\.. "mars"\.. "prill"\.. "maj"\.. "qershor"\.. "korrik"\.. "gusht"\.. "shtator"\.. "tetor"\.. "n\u00ebntor"\.. "dhjetor"\.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2087
                                                                                                                                                                                    Entropy (8bit):4.307749748884122
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:43ilQTSBQrQP9QenzMKSFD9NI/QiNQEQrQL1KKYjU5rtAx:2I5EyLMKSFZNIYMzYMKKiqW
                                                                                                                                                                                    MD5:BF363AB60B57F6D8FDCDBFD230A28DDF
                                                                                                                                                                                    SHA1:6375CBA0A2197DA7E65BEE45C42F02C4F0B9142D
                                                                                                                                                                                    SHA-256:FA00A7B22C9941F6C2B893F22B703DCB159CA2F2E4005FD6A74A632AEB786BFA
                                                                                                                                                                                    SHA-512:91AD8085EF321A5A0E4D2ED204940CB66E8E230BBEDE59A8A07D1CEED9155FCC6B075A1FCC44AE834C1FEEEB3A59256C4310684C5AC453D4C50DFABD88469814
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0435\u0434"\.. "\u041f\u043e\u043d"\.. "\u0423\u0442\u043e"\.. "\u0421\u0440\u0435"\.. "\u0427\u0435\u0442"\.. "\u041f\u0435\u0442"\.. "\u0421\u0443\u0431"].. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u0459\u0430"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\.. "\u0423\u0442\u043e\u0440\u0430\u043a"\.. "\u0421\u0440\u0435\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\.. "\u041f\u0435\u0442\u0430\u043a"\.. "\u0421\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset sr MONTHS_ABBREV [list \.. "\u0408\u0430\u043d"\.. "\u0424\u0435\u0431"\.. "\u041c\u0430\u0440"\.. "\u0410\u043f\u0440"\.. "\u041c\u0430\u0458"\.. "\u0408\u0443\u043d"\.. "\
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1219
                                                                                                                                                                                    Entropy (8bit):4.3542418837714285
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83qoLt6yLQoAusrIsmZ5m4AcjTHX92WFfjr4MvBvX:43ZLxQNusrr4Aw3Jkq1X
                                                                                                                                                                                    MD5:3B5C3FFA0829768470BDA1B46D882060
                                                                                                                                                                                    SHA1:C96799036EC5CCDE799A6B50CD7748908935A2F3
                                                                                                                                                                                    SHA-256:483916B51BD7E071E88F9EC36AAF3E08FEA823991532F832DE491C6C40B55A9F
                                                                                                                                                                                    SHA-512:684FA249123878AA7F856DF0FD3B0D9F041113CFEA8EEFA47D0E1948DA23694330BF0D62BA896A3891CD559C16CAE9330BF31508F530AC003D2929D5FD9246D8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \.. "s\u00f6"\.. "m\u00e5"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f6"].. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \.. "s\u00f6ndag"\.. "m\u00e5ndag"\.. "tisdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f6rdag"].. ::msgcat::mcset sv MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sv MONTHS_FULL [list \.. "januari"\.. "februari"\.. "mars"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "augusti"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat:
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1040
                                                                                                                                                                                    Entropy (8bit):4.108744949579904
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:4EnLB383A4mScvhkzoR4mtuWckRkoay3UVxMmALfG7IdzVJ633xRCPLMYMvYo76u:4aR83/Shkz1uckO76kMmEf62qOTdMvvn
                                                                                                                                                                                    MD5:5774860C8AEECBD48F1502E616158CAB
                                                                                                                                                                                    SHA1:DE7059713EA7913A0C79F5386833CE2BCAD2CFD7
                                                                                                                                                                                    SHA-256:1DA068C9AA02EF14A2440758C6040D632D96044A20EC501DBB9E40D8592E0E7F
                                                                                                                                                                                    SHA-512:91E69222DDF55E9E0E389DB77D7A0F2E082351DC3FB34A1A2C1E350E4187E8BB940F6C2EDE1B8651159C2787AA0BE4D7268F33F7A82CAED03514FCE462530408
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \.. "Jpi"\.. "Jtt"\.. "Jnn"\.. "Jtn"\.. "Alh"\.. "Iju"\.. "Jmo"].. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \.. "Jumapili"\.. "Jumatatu"\.. "Jumanne"\.. "Jumatano"\.. "Alhamisi"\.. "Ijumaa"\.. "Jumamosi"].. ::msgcat::mcset sw MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset sw MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Machi"\.. "Aprili"\.. "Mei"\.. "Juni"\.. "Julai"\.. "Agosti"\.. "Septemba"\.. "Oktoba"\.. "Novemba"\.. "Desemba"\.. ""].. ::msgcat::mcset sw BCE "
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1874
                                                                                                                                                                                    Entropy (8bit):4.080580566597515
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83AI0xnJdnQhmHlHYPKtul+eOPfIxyH5ztUSLu8tptLtrl+eOPfIxyH5ztUSU:43N0dQmHlHYPKtu1HxMtr1Hx/
                                                                                                                                                                                    MD5:85288236C3997302EA26D7403BBA2C15
                                                                                                                                                                                    SHA1:05AB389CC4DCF17B37BFF6ED1ECD58D6E9850A01
                                                                                                                                                                                    SHA-256:AEFDC4255890D5B3FFE5CEE1B457B7D711283C2287ABA644155C10956012F6C1
                                                                                                                                                                                    SHA-512:8E389D46606176EE14B8356153095B49C9426B80139B672A620F488891F091D1A272D4FB116775900E4AB4EC84DDDEBD8D6AF81AC672F14F148F2BFC638D2B10
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \.. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\.. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\.. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\.. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\.. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\.. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\.. "\u0b9a\u0ba9\u0bbf"].. ::msgcat::mcset ta MONTHS_ABBREV [list \.. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\.. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\.. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\.. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\.. "\u0bae\u0bc7"\.. "\u0b9c\u0bc2\u0ba9\u0bcd"\.. "\u0b9c\u0bc2\u0bb2\u0bc8"\.. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\.. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\.. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                    Entropy (8bit):4.863003494480733
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xosDv+IZosK3v6ry/5osDo+3v+6f6HyFvn:4EnLB383ZDvl5K3v6ry/ZDF3vmSVn
                                                                                                                                                                                    MD5:CF078352DA0507C767F04E31D6C14296
                                                                                                                                                                                    SHA1:0A9B1255BD85B60D3620AE61370F54748AB7A182
                                                                                                                                                                                    SHA-256:4978A193076DE56944236F7F1DCECACFF739536DFB3DBEFC1F7FE2B97A8AEAF4
                                                                                                                                                                                    SHA-512:6FFC85B2A8DECB373EC76B1CD1A9459A30E443319F2C8DB9BBE6E115F5EFEEBAC314D4E8BE996EA55EE46466C6F6057A73078F5FDCF1C4CBAF1A270E45BC10C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2149
                                                                                                                                                                                    Entropy (8bit):4.097884113767283
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:43a8mxI9k3JR0UjjFbPcniLHVktjjFbPcniLHVM:2a8v9k3JdbPcIidbPcIG
                                                                                                                                                                                    MD5:61E4CB2AAD66285E9113071057F39C35
                                                                                                                                                                                    SHA1:A2BD21090859669C4B6A875E077825381B7E2702
                                                                                                                                                                                    SHA-256:9E96C7123100234A7018533764502985A208F2EB3314F5B6332D46016725A63F
                                                                                                                                                                                    SHA-512:589A2D65508B07B5FDEDA883F71A4B496B25458CA1ECE7C4D4F5DAE82EB683DA82C8E21E57D63A235AB600174C9D362A746B2E27BAA6E3ADE1B7BD9D6000BE27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \.. "\u0c06\u0c26\u0c3f"\.. "\u0c38\u0c4b\u0c2e"\.. "\u0c2e\u0c02\u0c17\u0c33"\.. "\u0c2c\u0c41\u0c27"\.. "\u0c17\u0c41\u0c30\u0c41"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\.. "\u0c36\u0c28\u0c3f"].. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \.. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"].. ::msgcat::mcset te MONTHS_ABBREV [list \.. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\.. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\.. "\u0c2e\u0c3
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):419
                                                                                                                                                                                    Entropy (8bit):5.058324650031252
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:4EnLB383LjZWsn0sHjoD0savzda3v6ry/ZF3vMSVn:4aR833Z1nnHjoDnavzd8vSCZNvMSV
                                                                                                                                                                                    MD5:BCA040A356E7E8CC597EFB9B9065F8E1
                                                                                                                                                                                    SHA1:ADAF7EC8C2035BC06E168D3F1BD7F39277E9273F
                                                                                                                                                                                    SHA-256:B110FEEDDA21ECCEFA624BEF8E1476E9F221FB253880AC370967AE4D0237CA7A
                                                                                                                                                                                    SHA-512:D408ECE8CF89FB23B45420D3CBA7655EEE713498210889A84EE25D3417360705546D97028EAAAA47764B6E9B0A3699669B98C0A53861A38E0DFCB9F3B8A47BEC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2359
                                                                                                                                                                                    Entropy (8bit):4.382796122808316
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:439X4QKPQJecQwFA0P9JmDsxQ7KHfWkD2CQM0DnWxFDzCYmdrtVP:29ohCi1028QmHfIC4jW3DmHB
                                                                                                                                                                                    MD5:7F61E1EA256D78948189EF07119663CD
                                                                                                                                                                                    SHA1:6867E9780049FACE9984B7788B6F362B8D1AD718
                                                                                                                                                                                    SHA-256:48BEAF693BF5B6EED15234DB0D375B97E6D576A749E9048420C153E6CAFC0259
                                                                                                                                                                                    SHA-512:F3E24E0B41A7D722AC2FA0E429A2DCB1CCB5BAECC9912ADF6AF79C51366EA1AC9F931F0F44F068F3CEE6873516E6223CC5E7616CF523B1DFB9E528DE4D58454A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \.. "\u0e2d\u0e32."\.. "\u0e08."\.. "\u0e2d."\.. "\u0e1e."\.. "\u0e1e\u0e24."\.. "\u0e28."\.. "\u0e2a."].. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \.. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\.. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"].. ::msgcat::mcset th MONTHS_ABBREV [list \.. "\u0e21.\u0e04."\.. "\u0e01.\u0e1e."\.. "\u0e21\u0e35.\u0e04."\.. "\u0e40\u0e21.\u0e22."\.. "\u0e1e.\u0e04."\.. "\u0e21\u0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1183
                                                                                                                                                                                    Entropy (8bit):4.390397293529625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR83ZVUflVdq4qTr6dyX59508THHCh5LbQgWiNv9KvWIn:43PXTtbTngLhWiJGWIn
                                                                                                                                                                                    MD5:017F0F989BD5DBBF25E7C797CE09C45C
                                                                                                                                                                                    SHA1:162922DBD55A31A74410375A36EE7BC50E092BDD
                                                                                                                                                                                    SHA-256:4B85B345D6C43F7257C6849A60A492397FD5FD9D82DF3A2252189D7A1ECCBB64
                                                                                                                                                                                    SHA-512:73B6CF395753D863330687404E8A584CB08B81A8CC456DCE7BB49C4EA15EA19E45E3CC1E1367E10915DE14AC6258383289BCFEF55AD2768A50889DF390D37EF9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \.. "Paz"\.. "Pzt"\.. "Sal"\.. "\u00c7ar"\.. "Per"\.. "Cum"\.. "Cmt"].. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \.. "Pazar"\.. "Pazartesi"\.. "Sal\u0131"\.. "\u00c7ar\u015famba"\.. "Per\u015fembe"\.. "Cuma"\.. "Cumartesi"].. ::msgcat::mcset tr MONTHS_ABBREV [list \.. "Oca"\.. "\u015eub"\.. "Mar"\.. "Nis"\.. "May"\.. "Haz"\.. "Tem"\.. "A\u011fu"\.. "Eyl"\.. "Eki"\.. "Kas"\.. "Ara"\.. ""].. ::msgcat::mcset tr MONTHS_FULL [list \.. "Ocak"\.. "\u015eubat"\.. "Mart"\.. "Nisan"\.. "May\u0131s"\.. "Haziran"\.. "Temmuz"\.. "A\u011fustos"\.. "Eyl\u00fcl"\.. "Ekim"\.. "Kas\u0131m"\.. "Aral\u
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2165
                                                                                                                                                                                    Entropy (8bit):4.289021158621493
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:436yILgoQjQPxUIkgPDRQnQ0vVQbC1iQwweIgWQDIoZI7QDI3QbI87IVQnIzQ7mh:2AzUe3EhV8CYgrbH7z3fLVTzgn5jyX7p
                                                                                                                                                                                    MD5:323BD95809A44B0BADC71AD36E5F095B
                                                                                                                                                                                    SHA1:44F6016873CA955D27545C56CCD24BDB06A83C43
                                                                                                                                                                                    SHA-256:7093DA7E39CEB6D3F51EB6CF1CCA2D7F3680ED7B8FE4A5F0CECEEF6BEB21AC77
                                                                                                                                                                                    SHA-512:DB16E0E2D17CE47673DE781A7171944C14CC550FB8EB0920C05B979E4D067E36DF0B59B8BFA81F82D8FCE1FFDDAAD2755E68BFE5BC0DBB11E8716A4D18BA5F7E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0432\u0442"\.. "\u0441\u0440"\.. "\u0447\u0442"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0456\u043b\u044f"\.. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\.. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\.. "\u0441\u0435\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440"\.. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset uk MONTHS_ABBREV [list \.. "\u0441\u0456\u0447"\.. "\u043b\u044e\u0442"\.. "\u0431\u0435\u0440"\.. "\u043a\u0432\u0456\u0442"\.. "\u0442\u0440\u0430\u0432"\.. "\u0447\u0435\u0440\u0432"\.. "\u043b
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1471
                                                                                                                                                                                    Entropy (8bit):4.44729506678271
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4aR836DNjYTP55YAUy2tJ9kyzW68IFYHMBSW1K1pvhv1O:43dbYJyC8ySgI1dV1O
                                                                                                                                                                                    MD5:C127F54C462917D3B3EEF5F29F612138
                                                                                                                                                                                    SHA1:B1D9A67F856D93F98524C6372B352EA0DE1B9CD3
                                                                                                                                                                                    SHA-256:E9B7AECD456F1D2288604C982B5DED0DCF71DCA968C0B0EAFF4CA16CC3B73EC2
                                                                                                                                                                                    SHA-512:0B0F132F10580751258D37E070338C3B39DF57FDECDB9D0AFA67E90D6766DDCB4D711876E551ED759D177F1B8F4E9E1DD8F7899F7CB57F8039F55EC4C2984E87
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \.. "Th 2"\.. "Th 3"\.. "Th 4"\.. "Th 5"\.. "Th 6"\.. "Th 7"\.. "CN"].. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \.. "Th\u01b0\u0301 hai"\.. "Th\u01b0\u0301 ba"\.. "Th\u01b0\u0301 t\u01b0"\.. "Th\u01b0\u0301 n\u0103m"\.. "Th\u01b0\u0301 s\u00e1u"\.. "Th\u01b0\u0301 ba\u0309y"\.. "Chu\u0309 nh\u00e2\u0323t"].. ::msgcat::mcset vi MONTHS_ABBREV [list \.. "Thg 1"\.. "Thg 2"\.. "Thg 3"\.. "Thg 4"\.. "Thg 5"\.. "Thg 6"\.. "Thg 7"\.. "Thg 8"\.. "Thg 9"\.. "Thg 10"\.. "Thg 11"\.. "Thg 12"\.. ""].. ::msgcat::mcset vi MONTHS_FULL [list \.. "Th\u00e1ng m\u00f4\u0323t"\.. "Th\u00e1ng hai"\.. "Th\u00e1ng ba"\.. "Th\u00e1ng t\u01b0"\.. "Th\u00e
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (1598), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3385
                                                                                                                                                                                    Entropy (8bit):4.5164095151631125
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:43qrY2BBT7uxDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyke2gdr:2yPTKdo
                                                                                                                                                                                    MD5:2F356DE14D48B1091DEAA32D20C38D96
                                                                                                                                                                                    SHA1:4AB78D47A73290000955A7C1DFDF7106093F69FD
                                                                                                                                                                                    SHA-256:EB247F5184A59414D3DF7E3ECA51F5998C248CFB27D2C02E62A7A30AB35197A7
                                                                                                                                                                                    SHA-512:602410830018B455C68AE2EBDD83BA561CF59DA5898E00C80CE7EF619912E591EB38B4C8FE8D9B1F024E7105B0C4D2D326FC855F31E79C1B954429B947DFFBB1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh MONTHS_ABBREV [list \.. "\u4e00\u6708"\.. "\u4e8c\u6708"\.. "\u4e09\u6708"\.. "\u56db\u6708"\.. "\u4e94\u6708"\.. "\u516d\u6708"\.. "\u4e03\u6708"\.. "\u516b\u6708"\.. "\u4e5d\u6708"\.. "\u5341\u6708"\.. "\u5341\u4e00\u6708"\.. "\u5341\u4e8c\u6708"\.. ""].. ::msgcat::m
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):319
                                                                                                                                                                                    Entropy (8bit):5.167825099880243
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoX5YBoHJ+3vtfNrsoHJ+3v6MYBoXa+3vYq9vn:4EnLB383U5YMJ+3vtN3J+3v6LcL3vYqN
                                                                                                                                                                                    MD5:9FCDC2E80E13984D434E3CC91E1ED14C
                                                                                                                                                                                    SHA1:710D9EE2A71021F4AB609886138EED43C1380ACD
                                                                                                                                                                                    SHA-256:4C8A855700FEFE8EE21B08030FF4159D8011AE50353F063229C42DE6292475CF
                                                                                                                                                                                    SHA-512:D899A1F58DF1051BB2C2C4AC859C52A2D19B1593C37022A29439B37A8057ADC3941F3564E2E1D9CEB72AE123A4E12E24C3736343AA3A5EC8749AB5AEBBF65085
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e".. ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2".. ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):780
                                                                                                                                                                                    Entropy (8bit):4.716025632367214
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:4EnLB383HmSBBHZovDh4ToC4qU3WwVW3v6P3v3WwSn:4aR83Hxo14u3Ww+viv3WwS
                                                                                                                                                                                    MD5:CFDA7B6463305FA15DBBA72D725A1876
                                                                                                                                                                                    SHA1:2BF885073FBAF4A38B7AFDA76CA391F195A5A362
                                                                                                                                                                                    SHA-256:7E1C5BD9EC1A17BB851B0DCABD0DFA9FF9D64B89603D9D3FBEAAC609172346AE
                                                                                                                                                                                    SHA-512:55F974C706933ECE0575A33C381D9B370B8A408C5C5514C805EC04C8B0CA5BAFAA47267DA98E1805B478A9589FFB7549D79002B2A7AF387049011D78DD7605B6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u4e00"\.. "\u4e8c"\.. "\u4e09"\.. "\u56db"\.. "\u4e94"\.. "\u516d"].. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"\.. ""].. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5".. ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S".. ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):347
                                                                                                                                                                                    Entropy (8bit):5.062880051437783
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoOpEoPpFocMohX3v6Zwoh+3v6fxvn:4EnLB383J53v6O3vCn
                                                                                                                                                                                    MD5:3218F8E6BEDD534277DE0849C423158E
                                                                                                                                                                                    SHA1:10C006446A10406A5644C4033665E877EBF72AF7
                                                                                                                                                                                    SHA-256:500546B3211D454659D845B4AB9AEF226125100DF40407C49530DE17CDD4363F
                                                                                                                                                                                    SHA-512:3142893DA85BA8F83A5B6851B313B5F5FF80D2B989C1AE015665EE70373249B44EFB4FF7C621F1D8F37AC6019EF5E8D6D21C76C48998C3D9072F9C5060AA8813
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_SG AM "\u4e0a\u5348".. ::msgcat::mcset zh_SG PM "\u4e2d\u5348".. ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y".. ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):354
                                                                                                                                                                                    Entropy (8bit):5.124064818715749
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSyEtJLl73oo6d3/xoAykaRULH/XRxy/5oAyjZRULHi5oAyU/G0OMoAyxW3v6ZQ:4EnLB38315xDOiKRRW3v6F3v8A2n
                                                                                                                                                                                    MD5:9010E34791B5DDB7F1E0AD4DA6BD4623
                                                                                                                                                                                    SHA1:418F7374BABEF27FEC8E00D3A32F535084593AB9
                                                                                                                                                                                    SHA-256:DBA0584B8E1925B439F06E0BF0965E97AFB7EB39E70E0E4C9B70769EBC5F996C
                                                                                                                                                                                    SHA-512:D3AB698B725E84DAB06E472C41FF2EB55D63885D22B4598C596800BAC83A02A44CB524524F267D090952AF7E0031F47720786ACF9E354EF672CF9EEFB7DB3BD4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d".. ::msgcat::mcset zh_TW CE "\u6c11\u570b".. ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e".. ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z"..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):33777
                                                                                                                                                                                    Entropy (8bit):4.60013086740989
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:4D0xrpIuhenN4kA0G6sRcl5AdtsPLKiF64aJQ2L:HpnhsS9C5Adqua5aJvL
                                                                                                                                                                                    MD5:4ECD97188BFED58A15FE22EC566FA6A3
                                                                                                                                                                                    SHA1:6E4E91096298F1A0AE6CD4241F167C8B4F661EE5
                                                                                                                                                                                    SHA-256:67A157F1873D606B53DC4D894BD8E71F6B1A0DD66177B9513BD039B348B40349
                                                                                                                                                                                    SHA-512:1D5067BBB13DAB001168EEB41EBFA2D13BACB0F43A8067CC93923E8F4D062AA387DA23D7D98D6A2AE77D7C849A6026F2343102CBE03690C2CEA0890222339475
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# optparse.tcl --..#..# (private) Option parsing package..# Primarily used internally by the safe:: code...#..#.WARNING: This code will go away in a future release..#.of Tcl. It is NOT supported and you should not rely..#.on it. If your code does rely on this package you..#.may directly incorporate this code into your application.....package require Tcl 8.5-..# When this version number changes, update the pkgIndex.tcl file..# and the install directory in the Makefiles...package provide opt 0.4.8....namespace eval ::tcl {.... # Exported APIs.. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \.. OptProc OptProcArgGiven OptParse \... Lempty Lget \.. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \.. SetMax SetMin......################# Example of use / 'user documentation' ###################.... proc OptCreateTestProc {} {.....# Defines ::tcl::OptParseTest as a test proc with parsed arguments...# (can't be d
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):620
                                                                                                                                                                                    Entropy (8bit):4.702477618616754
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:jHxIRu9zhjJS42wbGlTULuUAZb3KykszLYIGbyAkXaqrQ+pBb6:biRUJS42wbGlTUcZ+yk2LY0XaqrB4
                                                                                                                                                                                    MD5:07532085501876DCC6882567E014944C
                                                                                                                                                                                    SHA1:6BC7A122429373EB8F039B413AD81C408A96CB80
                                                                                                                                                                                    SHA-256:6A4ABD2C519A745325C26FB23BE7BBF95252D653A24806EB37FD4AA6A6479AFE
                                                                                                                                                                                    SHA-512:0D604E862F3A1A19833EAD99AAF15A9F142178029AB64C71D193CEE4901A0196C1EEDDC2BCE715B7FA958AC45C194E63C77A71E4BE4F9AEDFD5B44CF2A726E76
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Tcl package index file, version 1.1..# This file is generated by the "pkg_mkIndex -direct" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....if {![package vsatisfies [package provide Tcl] 8.5-]} {return}..package ifneeded opt 0.4.8 [list source [file join $dir optparse.tcl]]..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):23995
                                                                                                                                                                                    Entropy (8bit):4.884828325514459
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
                                                                                                                                                                                    MD5:DDB0AB9842B64114138A8C83C4322027
                                                                                                                                                                                    SHA1:ECCACDC2CCD86A452B21F3CF0933FD41125DE790
                                                                                                                                                                                    SHA-256:F46AB61CDEBE3AA45FA7E61A48930D64A0D0E7E94D04D6BF244F48C36CAFE948
                                                                                                                                                                                    SHA-512:C0CF718258B4D59675C088551060B34CE2BC8638958722583AC2313DC354223BFEF793B02F1316E522A14C7BA9BED219531D505DE94DC3C417FC99D216A01463
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# package.tcl --..#..# utility procs formerly in init.tcl which can be loaded on demand..# for package management...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval tcl::Pkg {}....# ::tcl::Pkg::CompareExtension --..#..# Used internally by pkg_mkIndex to compare the extension of a file to a given..# extension. On Windows, it uses a case-insensitive comparison because the..# file system can be file insensitive...#..# Arguments:..# fileName.name of a file whose extension is compared..# ext..(optional) The extension to compare against; you must..#..provide the starting dot...#..Defaults to [info sharedlibextension]..#..# Results:..# Returns 1 if the extension matches, 0 otherwise....proc tcl::Pkg::CompareExtension {fileName {ext {}}} {.. global tcl_platfor
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):844
                                                                                                                                                                                    Entropy (8bit):4.883013702569192
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:TF7S2n2wn2SNHaeYF9xcwrmXhbs1GUiSYX3EtSK78ex4VIpynEw88/McUBbPgnz:TF7Hn2wnlk2KwyZSM4SkV/3UB7Cz
                                                                                                                                                                                    MD5:577787C2F4F5956BA70F83012B980AE5
                                                                                                                                                                                    SHA1:040B2469F796F3FDFCD1E1DD2EB1C5B799EDEF62
                                                                                                                                                                                    SHA-256:E269029C8263E3CBC1920C3604ECDCF15EDCCB208A0D68F9EB42B73954D620C0
                                                                                                                                                                                    SHA-512:C2940F6F3D77412EFC537B8AB67352F519DFFA95739FCC17BF1817335AFD9E5BFE91ABE98CBA99E278CB4923D4E6D431ED9D72282745203C0F7D73193F550238
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# parray:..# Print the contents of a global array on stdout...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....proc parray {a {pattern *}} {.. upvar 1 $a array.. if {![array exists array]} {...return -code error "\"$a\" isn't an array".. }.. set maxl 0.. set names [lsort [array names array $pattern]].. foreach name $names {...if {[string length $name] > $maxl} {... set maxl [string length $name]...}.. }.. set maxl [expr {$maxl + [string length $a] + 2}].. foreach name $names {...set nameString [format %s(%s) $a $name]...puts stdout [format "%-*s = %s" $maxl $nameString $array($name)].. }..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42223
                                                                                                                                                                                    Entropy (8bit):4.822635446297551
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:H/Jo8y7AyARYhZfc3njlVdRIp4xOtoYx4WneNiBq5vIhfwEaqadlUCJ2Pbb1P6:H/c7AmhZmnjvdRIG924WneNiBq5+fwEc
                                                                                                                                                                                    MD5:B8C1561D471CFBF4111C706411D59883
                                                                                                                                                                                    SHA1:71483EAEEF377EE9AF90BEC44F70C7B12C5BC720
                                                                                                                                                                                    SHA-256:C21DCE3AB31893118BBED01E559070F1D3541877FEE331BD45F5BF4300ED9654
                                                                                                                                                                                    SHA-512:465065A938C71AF4588B3331B51A62DD57F57492EB1CB6C0F52B9FD0A2FE7A54B1E995AA56E4A41D7A99EAFF665C1E23E3B240FB3F9840AB242C21B1DBFFFF45
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# safe.tcl --..#..# This file provide a safe loading/sourcing mechanism for safe interpreters...# It implements a virtual path mechanism to hide the real pathnames from the..# child. It runs in a parent interpreter and sets up data structure and..# aliases that will be invoked when used from a child interpreter...#..# See the safe.n man page for details...#..# Copyright (c) 1996-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....#..# The implementation is based on namespaces. These naming conventions are..# followed:..# Private procs starts with uppercase...# Public procs are exported and starts with lowercase..#....# Needed utilities package..package require opt 0.4.8....# Create the safe namespace..namespace eval ::safe {.. # Exported API:.. namespace export interpCreate interpInit interpConfigure interpDelete \...interpAddToAccessPath interpFindInAccessPath setL
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5617
                                                                                                                                                                                    Entropy (8bit):4.747404679682368
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
                                                                                                                                                                                    MD5:C62FB22F4C9A3EFF286C18421397AAF4
                                                                                                                                                                                    SHA1:4A49B8768CFF68F2EFFAF21264343B7C632A51B2
                                                                                                                                                                                    SHA-256:DDF7E42DEF37888AD0A564AA4F8CA95F4EEC942CEBEBFCA851D35515104D5C89
                                                                                                                                                                                    SHA-512:558D401CB6AF8CE3641AF55CAEBC9C5005AB843EE84F60C6D55AFBBC7F7129DA9C58C2F55C887C3159107546FA6BC13FFC4CCA63EA8841D7160B8AA99161A185
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Tcl autoload index file, version 2.0..# -*- tcl -*-..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(auto_reset) [list source [file join $dir auto.tcl]]..set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.t
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12204
                                                                                                                                                                                    Entropy (8bit):4.763796758810551
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
                                                                                                                                                                                    MD5:215262A286E7F0A14F22DB1AA7875F05
                                                                                                                                                                                    SHA1:66B942BA6D3120EF8D5840FCDEB06242A47491FF
                                                                                                                                                                                    SHA-256:4B7ED9FD2363D6876092DB3F720CBDDF97E72B86B519403539BA96E1C815ED8F
                                                                                                                                                                                    SHA-512:6ECD745D7DA9D826240C0AB59023C703C94B158AE48C1410FAA961A8EDB512976A4F15AE8DEF099B58719ADF0D2A9C37E6F29F54D39C1AB7EE81FA333A60F39B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# -*- tcl -*-..#..# Searching for Tcl Modules. Defines a procedure, declares it as the primary..# command for finding packages, however also uses the former 'package unknown'..# command as a fallback...#..# Locates all possible packages in a directory via a less restricted glob. The..# targeted directory is derived from the name of the requested package, i.e...# the TM scan will look only at directories which can contain the requested..# package. It will register all packages it found in the directory so that..# future requests have a higher chance of being fulfilled by the ifneeded..# database without having to come to us again...#..# We do not remember where we have been and simply rescan targeted directories..# when invoked again. The reasoning is this:..#..# - The only way we get back to the same directory is if someone is trying to..# [package require] something that wasn't there on the first scan...#..# Either..# 1) It is there now: If we rescan, you get it; if not you don
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):147
                                                                                                                                                                                    Entropy (8bit):4.995501022397479
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2DcsBdNMXGm2OHnFvpsYoHsdSalHFLwy:SlSWB9eg/2DBpDm2OHnFvmYoH1alHOy
                                                                                                                                                                                    MD5:FF8B5540631A6EE93507338C4E7AA49D
                                                                                                                                                                                    SHA1:817B261A1B6B92AA498EC286349964EA10FB5A84
                                                                                                                                                                                    SHA-256:7213997BB9CF9D384A7002B8C8EFEF25C01ABA6083D9835A16D583D5DCEE40A0
                                                                                                                                                                                    SHA-512:8D78AC4868ED0013EDA536C0E82E0E91398772AA18C637AEFE22F24B142FCDA55A4CB853B2282951E907C9E2F62BD3F831A5CF995F52898F5225D16889943A9C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Abidjan) {.. {-9223372036854775808 -968 0 LMT}.. {-1830383032 0 0 GMT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):183
                                                                                                                                                                                    Entropy (8bit):4.832432925672155
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dc9XfBQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DUGDBS
                                                                                                                                                                                    MD5:52FDFD3DB98475FBBB620D0D5565C5CC
                                                                                                                                                                                    SHA1:C7750452859663605272553DBEE0B6C134E1517C
                                                                                                                                                                                    SHA-256:6040827AFED8CEF45F252FBD7E3E862C0B5E9D06C1C98C58BAD61DFE67BD57CC
                                                                                                                                                                                    SHA-512:2FF9D96D81279148A86BE208FEEACCBCB8B4224D093D6C092ECD1C4EA2186589CCF947027D3A726600C703611B4CFEE029AA14ED3E8593C477B427C4F342CF27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Accra) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3852
                                                                                                                                                                                    Entropy (8bit):3.7766651198444507
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:58ybRwEa40MF4pt0/jaGYbaJF0a3T07ITB85oWXmSGmuyTVuV0apRQnL0KD3rZza:fLg1GbJFp3gHRQVy7DPUUQkiHMo
                                                                                                                                                                                    MD5:9DCDB3DD41DA13D81EB8E1CAF56964DA
                                                                                                                                                                                    SHA1:F95EE7B1EF464F2640EC4AE29F3C18B5BF2B2905
                                                                                                                                                                                    SHA-256:8698B0A53D858AEA7C495EDF759EF0E6C63F7E07A256599393DEC7B7A7413734
                                                                                                                                                                                    SHA-512:BA5898ABEE541BC72C9DEDD77BABB18024C7AEA0274FA3F809748FCBFF770BFAD902BF70680DDE989F7D3592E5398C100D0E0EA388D4200911ED7DE089535D6D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Cairo) {.. {-9223372036854775808 7509 0 LMT}.. {-2185409109 7200 0 EET}.. {-929844000 10800 1 EEST}.. {-923108400 7200 0 EET}.. {-906170400 10800 1 EEST}.. {-892868400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-857790000 7200 0 EET}.. {-844308000 10800 1 EEST}.. {-825822000 7200 0 EET}.. {-812685600 10800 1 EEST}.. {-794199600 7200 0 EET}.. {-779853600 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165801600 7200 0 EET}.. {-147402000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5532
                                                                                                                                                                                    Entropy (8bit):3.535398586134154
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:zE+CJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:7MZSszBrlKcJC9k
                                                                                                                                                                                    MD5:18183122D242E0B69A80BC02BC0328DF
                                                                                                                                                                                    SHA1:C9976ABC0663EB29A2FEAAFDF6746C05A264B67C
                                                                                                                                                                                    SHA-256:8776EEDFDFEE09C4C833593127CEFAC9C33E2487AB9BF4BF8C73E5E11B4E5613
                                                                                                                                                                                    SHA-512:9611A6EF9C5B55FAB752C1EC7E464B8AF60AE32383CE9BA72F35168ABB68A45DB0654A9099CBDC123F5F6E2B6DB7C8FBF56A8DDB813824187AD1090971F12219
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Casablanca) {.. {-9223372036854775808 -1820 0 LMT}.. {-1773012580 0 0 +00}.. {-956361600 3600 1 +00}.. {-950490000 0 0 +00}.. {-942019200 3600 1 +00}.. {-761187600 0 0 +00}.. {-617241600 3600 1 +00}.. {-605149200 0 0 +00}.. {-81432000 3600 1 +00}.. {-71110800 0 0 +00}.. {141264000 3600 1 +00}.. {147222000 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {448243200 3600 0 +01}.. {504918000 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {13731
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7536
                                                                                                                                                                                    Entropy (8bit):3.8315604186920704
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:TzLdXKy9f4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:TdayR41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:30155093248C4F7E45EF7C0132D2B2AB
                                                                                                                                                                                    SHA1:FAD100CC49F0CB0910BDE39B43295A47512E1BE6
                                                                                                                                                                                    SHA-256:8827F7311EDE69A9679BDF2B7418DBF350A2FC8F973E8B1E1E4390D4D5C6D2E8
                                                                                                                                                                                    SHA-512:469A24AF0C2A4A40CB2488C3E21BB9BBDE057F876EACA08A31FC6F22845063D917A0A4AE96680401E45792DE534EE3A305F137A93C4DF879B4602510D881270E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ceuta) {.. {-9223372036854775808 -1276 0 LMT}.. {-2177452800 0 0 WET}.. {-1630112400 3600 1 WEST}.. {-1616810400 0 0 WET}.. {-1451692800 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1293840000 0 0 WET}.. {-94694400 0 0 WET}.. {-81432000 3600 1 WEST}.. {-71110800 0 0 WET}.. {141264000 3600 1 WEST}.. {147222000 0 0 WET}.. {199756800 3600 1 WEST}.. {207702000 0 0 WET}.. {231292800 3600 1 WEST}.. {244249200 0 0 WET}.. {265507200 3600 1 WEST}.. {271033200 0 0 WET}.. {448243200 3600 0 CET}.. {504918000 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.88110192592456
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcmMM1+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DCM1+c
                                                                                                                                                                                    MD5:8CDD2EEB7E0EC816F3EC051350FEBF13
                                                                                                                                                                                    SHA1:37F3A149B4A01DFA2EAB42A28C810BE66AAB7C52
                                                                                                                                                                                    SHA-256:3176C99FC45337CBCE0CD516DE4B02B8BAA47D00E84F698122A2ADD57797984E
                                                                                                                                                                                    SHA-512:5A90B6DB45EDAD7734D596FB81FD1959A433F57E71D2212E1DCBD6A12F3FD1FE747FA363C4C787A4D3023F542553C1E2C9CF4F61E28F1BB13042E4AFE3D0FF31
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):183
                                                                                                                                                                                    Entropy (8bit):4.856992353568779
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXXMFBx/2DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DKXEBn
                                                                                                                                                                                    MD5:946D3B52F915445DBB8EE8BF67F4EFAB
                                                                                                                                                                                    SHA1:18345968B95E886CA72634D49F2B38F9B29BA629
                                                                                                                                                                                    SHA-256:D50F9732757B284BAC75526F2CFA585DF7F6974160827AFB0FF66124C7CFD361
                                                                                                                                                                                    SHA-512:00B531D1352CF35045EE25C777C7FEA17294E9861E68CE2DE0D9884C05EBDEA84D5F4F0E8B5605721295E25C259979446B7DB76525A633C7D2FA35B38962CF43
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):191
                                                                                                                                                                                    Entropy (8bit):4.8447607449193075
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2Dc8bEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DJbVDR
                                                                                                                                                                                    MD5:7A819572758BC60F4085DF28F1DD1C01
                                                                                                                                                                                    SHA1:0A5BA34EBFBA5A8E8B896713BA527781FC90FF01
                                                                                                                                                                                    SHA-256:AB69948637416219A3D458777990FA4568BEBC89388884BBF129C0E1370A560B
                                                                                                                                                                                    SHA-512:C03E785D1E85292056BB0BDD8DF8326C5DFEB6070AB1C071E1032D14EA69C9DEBC57B2CC7852E35D31652187126CCF0009A6A5C32F9DBB75D56C705535DF05CC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.829357904445218
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcRHKQ1BQDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DOrkDR
                                                                                                                                                                                    MD5:7981499F9430DC1636C9F834273E0B91
                                                                                                                                                                                    SHA1:1D63F8578420D56E4A5D9D0881FBEC015421E416
                                                                                                                                                                                    SHA-256:E7F7560CCD65D53C446ADAE7128A74D37E17DD0B907A2F2FD85322FB8707B497
                                                                                                                                                                                    SHA-512:3C3F7D78E9A0DE6E2950E1C305EA2DBC986754AE9FB10AC410685F30C39EC235F6F221393099C012E62EE5A7B4F1BED67C96B7B81E90BBA064BA9FE685FE4050
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):178
                                                                                                                                                                                    Entropy (8bit):4.850101792457859
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcnKe2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dml2D4yn
                                                                                                                                                                                    MD5:44881E75AC32FA95FF6143066EF01B90
                                                                                                                                                                                    SHA1:A221619B4CDE8BE6A181E1F3869EAB665F2E98B8
                                                                                                                                                                                    SHA-256:FCF2DAD148F4D2951320EA99730C56D5EB43D505F37416BE4BAD265CE2902706
                                                                                                                                                                                    SHA-512:4FA67A5F84758366189F0FC4A7FA6C820BA083E1C56EA95D25D21A367F25F76261B7EB5631DFFEB20E095CFD64E770338773F76BD50D4CF6AE29AD3EDFCEC408
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Douala) $TZData(:Africa/Lagos)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5235
                                                                                                                                                                                    Entropy (8bit):3.541189246992611
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:+eCJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:+eqZSszBrlKcJC9k
                                                                                                                                                                                    MD5:956F5B51FA8BA2E954A0E59AAC8F3276
                                                                                                                                                                                    SHA1:AE35A8502E57EA6EE173E3B42509E4CAC73DA091
                                                                                                                                                                                    SHA-256:5FB102A95B3C004AAB8371840B1A04AC352F48FF9E9EAFDEAAF21960B0F3CAA6
                                                                                                                                                                                    SHA-512:19E7F2574E2B62DF68CC24737F6B94864B3D64B2472BC7D78E6AB5142A1DC1AB3B3700AB802129CB16AED4A4FED29E2B8A5593EE327ADF496255FE2FEF6A7023
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/El_Aaiun) {.. {-9223372036854775808 -3168 0 LMT}.. {-1136070432 -3600 0 -01}.. {198291600 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {1373162400 0 0 +00}.. {1376100000 3600 1 +00}.. {1382839200 0 0 +00}.. {1396144800 3600 1 +00}.. {1403920800 0 0 +00}.. {1406944800 3600 1 +00}.. {1414288800 0 0 +00}.. {1427594400 3600 1 +00}.. {1434247200 0 0 +00}.. {1437271200 3600 1 +00}.. {1445738400 0 0 +00}.. {1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.866631090752554
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcu5sp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dk4DBS
                                                                                                                                                                                    MD5:6C115220CF951FC2EE3C299F86935B6D
                                                                                                                                                                                    SHA1:A1CAB8C710BF20553AF45343118C1726CFE922B7
                                                                                                                                                                                    SHA-256:BC53A4D489F48F14C594C4B0E52079B34E043A5751BBC7DF254A560352243575
                                                                                                                                                                                    SHA-512:E87A4FD145B645DF034182CAD7F9D2BE5B2D9F3A17B6A9B6C84A0B3E846D92EC4C69DF2E85129B7A1AFBC0CCAAC8E3B1D47EB09F0900A82B908E9F6BF63B9736
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):183
                                                                                                                                                                                    Entropy (8bit):4.899477454245453
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcHK0o/4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAV+4Dt
                                                                                                                                                                                    MD5:07222D8ED83CDC456B4D5D84C4BDE320
                                                                                                                                                                                    SHA1:2C657F461FA3F48D56C791AFE4AB7D2EAF45AF60
                                                                                                                                                                                    SHA-256:653AF88955C4418D973E2F8681A99552EB7BE95BCA64C736072F488462F7B373
                                                                                                                                                                                    SHA-512:3016D0636F401BD88BCD460F6A61782E7E8A2C32CE4ECB904C711DF414038A5818F0CA3D7FC671C5ABCE70647FC674A2EF9081C5289EBFD184B44885902E007A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181
                                                                                                                                                                                    Entropy (8bit):4.884642061266759
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc0B5h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2Dlfh4Dt
                                                                                                                                                                                    MD5:8666DABE8D196ACD94A9691C592FAF4E
                                                                                                                                                                                    SHA1:9F7EE009DCEAACA79C6EAA6FC73015D595467919
                                                                                                                                                                                    SHA-256:06B82C524585192E0E8FC69DCC1CF86183A8C5EF404645DC413FCF3F8C16B0AB
                                                                                                                                                                                    SHA-512:AAA32FD1B01BFECDD0D1C9C1DF1163374DAFE094C75720EA4095C34F7EAE7DCB594D1A7F6A2A90FB43FF01020F7AEB48E92496E0EE2D039AF23076CD369DD2A7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Harare) $TZData(:Africa/Maputo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):309
                                                                                                                                                                                    Entropy (8bit):4.695542624694403
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2DWbzDm2OHePoHvmmXsd//HF2d7d6VcF2d6KsYov:MB862DW7mdHePCvmmcZvF0cVcF/KsFv
                                                                                                                                                                                    MD5:F0E153FC9B978E30742ABC025CA45E02
                                                                                                                                                                                    SHA1:73D96F3188190DAC2453E6F18A1C683CECB9CDE3
                                                                                                                                                                                    SHA-256:5EEF6475E1312051037FCAE3354E32DC0910BE7A5116B71F8CCBE1CCA08D3F1C
                                                                                                                                                                                    SHA-512:E66F4B5FF18BAAD53AFB1ED36A0827115C793075A61F794F26F32BC9F6799DF816A1F817BEB0C0BC938F89E6F5BFBE1AB4F504F1AF518764103FB287746552C7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Johannesburg) {.. {-9223372036854775808 6720 0 LMT}.. {-2458173120 5400 0 SAST}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {-829526400 10800 1 SAST}.. {-813805200 7200 0 SAST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1127
                                                                                                                                                                                    Entropy (8bit):4.027824722230131
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5mesdOkMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8M5:5YMV04MSHMzNxMbwM0JXMfCsMzaMq0QJ
                                                                                                                                                                                    MD5:32EC0589260D9D4BCC85FE91E6F04D00
                                                                                                                                                                                    SHA1:BAA269852C4AC6B89EA7941E7A75A007E0CF9EDF
                                                                                                                                                                                    SHA-256:F2646E15488ABF2E960759CEFE5705416E71DA71BB8407B26196244FD1A3394F
                                                                                                                                                                                    SHA-512:4F485453BE1D186ADBE0908852475C63C57BA498091C222EFFB9A5FEA2DB7F55E1BB2DBDBF6AC0F24CC67D47549FA3F5257655B5449B1BCF1FB5CDB27B03D501
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Juba) {.. {-9223372036854775808 7588 0 LMT}.. {-1230775588 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.837466713772859
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcJEl2DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DIEl2V
                                                                                                                                                                                    MD5:E929ED1BC316C71AABE7E625BD562FB1
                                                                                                                                                                                    SHA1:C20C172518C02D93327F4BBBC5D410BFFEF5039D
                                                                                                                                                                                    SHA-256:8EA3028CE2B025F0C457DC8F7601279CA5AF565A88B9FE80208F9F1030F2B0D0
                                                                                                                                                                                    SHA-512:B2FBCF06EACCF18DE97AF1D6BC57D9638E0A36DBF17044FF97F6B9E5089CF9E13E1304F304495324C0ACC1128A7D2D494E7C1FDB95DB0855FCE54F7028096C50
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1131
                                                                                                                                                                                    Entropy (8bit):4.0421745451318385
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5xe9dSXMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8MM:5hMV04MSHMzNxMbwM0JXMfCsMzaMq0Qc
                                                                                                                                                                                    MD5:2BD3850DDBE2F05BF6F24F3AEFF7516C
                                                                                                                                                                                    SHA1:22B0DBB54E071F30D51A8654CF103F99537F74CD
                                                                                                                                                                                    SHA-256:F475DB8A857A46B310B12C21D6A9BC6CA9FF2960DA429A9D57FA375F9439E13B
                                                                                                                                                                                    SHA-512:1CF82FC07348C697F26625673DA7E3D734358B3FBE69D8E2132CAC0D9F00C7E8CDC353676CD9BAC4CBB9E26CF6638CEAE41DF559E7445D9C453409D7115FFC6C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Khartoum) {.. {-9223372036854775808 7808 0 LMT}.. {-1230775808 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181
                                                                                                                                                                                    Entropy (8bit):4.910322325134086
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcCJRx+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DRX+DEi
                                                                                                                                                                                    MD5:3017253E1C6ACCA8D470A014E4BB321D
                                                                                                                                                                                    SHA1:671B7AC04580B56E2C34F88D123E8296947DDD7E
                                                                                                                                                                                    SHA-256:73FEB807006897B4B485CB82394867444E890265EFE960EC66D6C0E325DA9372
                                                                                                                                                                                    SHA-512:2498C380D761A16C183D78BC1BB18B1D2A1BFCB9C703D86A3FC04CCCE43D88C8D4BC3C47CC31639B78A5FE9C8A7445E9DBB52062E2F3B737DA1E7D0FF70F140A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Kigali) $TZData(:Africa/Maputo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.866127364448228
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcqQFeDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DdD4yn
                                                                                                                                                                                    MD5:41209A335A99803239A854575190C5ED
                                                                                                                                                                                    SHA1:E6EA627C25513B9DDE053F9A24D509AA317C30A1
                                                                                                                                                                                    SHA-256:611375C4901AD6C4844C2BB7D02FB17F34996F49E642546A6784D6F0B28530CC
                                                                                                                                                                                    SHA-512:DF2C0B131F35F54DF5EBF7F8459F98DBABEB6F081247BA95B5D7B41146E2A2EF9BC6B1D909DE57A1223D9C258AB197D9668ED2E111A365C86BABDAA7DF551FB6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):235
                                                                                                                                                                                    Entropy (8bit):4.7936510664790815
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2D4JDm2OHWQvvoHvBsp9boFvoHzIX7uRe6vF9:MB862DymdHWQCvqpmVCzIq
                                                                                                                                                                                    MD5:EC08046589E85D999A597252FF5368B7
                                                                                                                                                                                    SHA1:126E3DE158E1E7AF4737D0AB5B51C0F92F416DC7
                                                                                                                                                                                    SHA-256:DCC9F52F539A67DFD7ABAFDE072ACDAE2B67754C559C8A5FE61979F5A286A066
                                                                                                                                                                                    SHA-512:84B9AB18BC343C8B8934F5FDD2E2EB413925B04D6F5394AA8337B7B55E6487FB071A83A69BD4D0FA40F7F31EBC57B9908729674542CEA3083D700FCD02D77633
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Lagos) {.. {-9223372036854775808 815 0 LMT}.. {-2035584815 0 0 GMT}.. {-1940889600 815 0 LMT}.. {-1767226415 1800 0 +0030}.. {-1588465800 3600 0 WAT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.865878143076229
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcr7bp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dgfp4D4y
                                                                                                                                                                                    MD5:35D8A58EE21E603C6FC4FB896AE6B3D0
                                                                                                                                                                                    SHA1:F1D0A939D761F3F0954F045814CF5339A5597036
                                                                                                                                                                                    SHA-256:AB3E797548C7663CF9ABA7FE163635FF7CAB9E6CB61FA1644C0F7B4B5CCE8B99
                                                                                                                                                                                    SHA-512:97717961987F6B6832C24A7833150CDFE7E82BBEB32DFDB84D2500442AAD9263F8BD4E879591E913D56E9A1991C389EF730211853647A889F358AE3FA37C0185
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Libreville) $TZData(:Africa/Lagos)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.862780607964543
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcih4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DNh4D4
                                                                                                                                                                                    MD5:EA21ABBF8B11953916A1C509B8A1B427
                                                                                                                                                                                    SHA1:35ADC230C57B001BE8A99A3D2E34B609A60A1162
                                                                                                                                                                                    SHA-256:EACA9124F17E5B11F27D11FA6141D19EB3AC23E155E155B73467BDAA3BC99AA7
                                                                                                                                                                                    SHA-512:A7972D4F1C5FB988CA04B39E2CDD580F51383BA9D7A66C478275C11A07B8D7A6EFF53A3E1929B0D89F10BCC39D22F285DB2601ED60DB4647C65465643F70C137
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Lome) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):178
                                                                                                                                                                                    Entropy (8bit):4.856982839546061
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DccLtBQDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DXQD4yn
                                                                                                                                                                                    MD5:40CD47F6DCF51EBEFEF42489F1716257
                                                                                                                                                                                    SHA1:DF245192A1899A72DE01A57F6969AC060E841734
                                                                                                                                                                                    SHA-256:4C2FD1E44DFAAF0C0DD2EB56B84B538F1E2D84B301AB2CFB8EE7759783501444
                                                                                                                                                                                    SHA-512:D39BEB0EEF344B1A44F7D6A806A1D5B956D7D402648EE0C67C4BA46493236840AF975D89A91B2D33B8AA7D6DC9A051E66718DCDBC1C83B0E964215C2E32ED923
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Luanda) $TZData(:Africa/Lagos)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.940313336280723
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcfpT0DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2D8pT0Dt
                                                                                                                                                                                    MD5:71A5DE1276902DB1542840318F9B1AF3
                                                                                                                                                                                    SHA1:AC3825BF343482E0E4D9D6FAA6FCA4D1A125433B
                                                                                                                                                                                    SHA-256:24384EEC359FD24D181AAEF3C017E3C345490A8D352B29D19B1B143A29A811C2
                                                                                                                                                                                    SHA-512:2984EB42A79B8B32BB93DFE71F1C4C0CABFDC9B0A199971347BB3473463FA07FDB5D20227D288BF8653B1BDE347E1297459BBB4C3C34AF7A5434FBF945683577
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181
                                                                                                                                                                                    Entropy (8bit):4.905174746463853
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcOf+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkDEi
                                                                                                                                                                                    MD5:1D7FDB388535CC59742CA0F1AEE27FBD
                                                                                                                                                                                    SHA1:A99FF2CAC47FD333429C22B271E190D979EEC024
                                                                                                                                                                                    SHA-256:B00801A7279741434D9C2D7EC7322DD93B85EA4F5C9976AB3A43F0AB142E1553
                                                                                                                                                                                    SHA-512:0174D3C6F9116C36C62AD1EB58203EE7DFE8C37F618B8449D5E45AD6290CF8334F28798877D7A563A12EE533026244D6A49BCCF29B5D7FCB5BCC91481D0DDDE2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):178
                                                                                                                                                                                    Entropy (8bit):4.857096806490649
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcn2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D42D4yn
                                                                                                                                                                                    MD5:1CA9B3E7BCD5BC1CC881453D16B09389
                                                                                                                                                                                    SHA1:1B1964B314E72847D71A42C147CF2BF331B44461
                                                                                                                                                                                    SHA-256:35D56EFFE9E7E60F17B32BD30486E566B635F0AE7A8948D77395B8E6332E26F1
                                                                                                                                                                                    SHA-512:9E08D57B7824F5B076D159D9A5106E51450DF24729C36F485B9B68E8F47E8DFC50F9BEC3F11E0AE6579A8E372A5C0F0DA18A2E797CF2115519D1B4E5B64413DD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Malabo) $TZData(:Africa/Lagos)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):149
                                                                                                                                                                                    Entropy (8bit):4.952872531197478
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2DcfKiMXGm2OHoVoHvdSF2I:SlSWB9eg/2DEZDm2OHoVoHvdI
                                                                                                                                                                                    MD5:CD429B6891CBF603A93F9A9733E2391B
                                                                                                                                                                                    SHA1:C6833B83B6D1694AC632018A27915E6F97F708AE
                                                                                                                                                                                    SHA-256:FE6B6A4BE1B61F7F909A3F6137530DFE6D1754499A4D9B0D1CE4952FFF0AE62D
                                                                                                                                                                                    SHA-512:6E57B70B71515998AD617954F9DDAE19968B20946542201153DAB47FBE63790D42F41AE29148ECBCE6D12812879BCF0A4EC881507B62CDB2675AB20267220BF9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Maputo) {.. {-9223372036854775808 7820 0 LMT}.. {-2109291020 7200 0 CAT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):199
                                                                                                                                                                                    Entropy (8bit):4.964472328419063
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DZQs+DWb4n:MByMaHw7NH/t2DZiDWU
                                                                                                                                                                                    MD5:88C8FF2B480648EDADBD0FB93F754275
                                                                                                                                                                                    SHA1:BED7A784C378909914CEB0D303DFE6D05FD576B7
                                                                                                                                                                                    SHA-256:1D80FD86CB733D57D88ECD404E702F750B233ED0CCBFBFFFEED1AAD3B7F1CB04
                                                                                                                                                                                    SHA-512:CB7F831CF099E85B948AE57FCE9D91C7EAAD39753AF82C56EC15B65830EB4115A71BBC83A71A2AC947CAB24DEDDB557E02FAA5A3264546AE6E60607DF6BD2FA3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):200
                                                                                                                                                                                    Entropy (8bit):4.957246428185456
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DzjEHp4DWb4n:MByMaHw7NH/t2DzjEJ4DWU
                                                                                                                                                                                    MD5:CA7255B86425BA706D214924856B6818
                                                                                                                                                                                    SHA1:E9BE6CF871BB1786E842953D41392299952EC9AC
                                                                                                                                                                                    SHA-256:547197C09C1987350AE5720A4EEC7E8D8F4B9F4A0559726E225E13C707F7C564
                                                                                                                                                                                    SHA-512:23F9AD0F926A0945A17BBC3DCFF9A3D7EE68EC9423EA78985F5FFC60CC61641B57871F9AA703B5FB9BE842DCD4693D0641F9EDED702240873F58D24CD4D60C32
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):187
                                                                                                                                                                                    Entropy (8bit):4.877126792757121
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcBEBXCEeDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DFSVDR
                                                                                                                                                                                    MD5:5C2E2B5189E0E816D5BD7AFC8B49A35E
                                                                                                                                                                                    SHA1:4E43A1ED51399528636D6442B1DDFFD820911407
                                                                                                                                                                                    SHA-256:25E221BE49DEC5547A74AEB91B0041859C59BC866987272A447AB2343D1CC30C
                                                                                                                                                                                    SHA-512:B74735CFAB692756BAADFB1A51A8CC0C986F981D8E7E7A8182370A9017E67439875F0115820A349AFB3BE2FA581A721440968EF817471DD2C5E1286E53B2FE99
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):208
                                                                                                                                                                                    Entropy (8bit):4.8660011420394955
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2D3NPDm2OHrFGxYoHvlHIg5pTwdPsy:MB862D3NbmdHhmYCvdIg5GPsy
                                                                                                                                                                                    MD5:1B3C94B5098E454981C73C1F2AF80164
                                                                                                                                                                                    SHA1:1EBA9E2DBEA70BB1AE5EB13739518AB5A62D2130
                                                                                                                                                                                    SHA-256:2BF0D90610211651127402680519B29AB50B15D344263D0C1A22EDEBE5E01E27
                                                                                                                                                                                    SHA-512:DA4A0BCE7C6750BD7D3BA76B6301B9390723BE0C001C39BE453D80BD87020C2253A75629F68F83C19410D2A75FAF5223A435299CD4AA53DE545EC7C5B5AA54B7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Monrovia) {.. {-9223372036854775808 -2588 0 LMT}.. {-2776979812 -2588 0 MMT}.. {-1604359012 -2670 0 MMT}.. {63593070 0 0 GMT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):277
                                                                                                                                                                                    Entropy (8bit):4.655052651600954
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2Dk1Dm2OHsvT5oH99VCV22ufPnVCkVBKBQn9q:MB862DGmdHsvVCjkifvdH9q
                                                                                                                                                                                    MD5:B640661FB37BB74FAB172DBDF1B433E1
                                                                                                                                                                                    SHA1:0236A5B53443A4A18B8B9D6AA7732620BE9A6553
                                                                                                                                                                                    SHA-256:BD8E9765174431C0D403249D3E881C949C83966E9F8162552DA88AE53132467B
                                                                                                                                                                                    SHA-512:53DCC6DF7C3E0B00A6D98A8DCC4988C8CFD6B53CC89E6F8D32DA41CB532A62D9C6A823675C5039F5639CE0D423F6D571F46F5B93FFC7EFFB4EDFFBF89D46AA12
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Nairobi) {.. {-9223372036854775808 8836 0 LMT}.. {-1946168836 9000 0 +0230}.. {-1309746600 10800 0 EAT}.. {-1261969200 9000 0 +0230}.. {-1041388200 9900 0 +0245}.. {-865305900 10800 0 EAT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):208
                                                                                                                                                                                    Entropy (8bit):4.856754881865487
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2DjUfDm2OHNseoH1axCXFHzaSmkFWTvF9:MB862DjULmdHPC1XNzaS3yz
                                                                                                                                                                                    MD5:EDB548348E590C8CFE04ED172D96B86C
                                                                                                                                                                                    SHA1:AD3B631FB03819772164402E202AFA781687F597
                                                                                                                                                                                    SHA-256:9ADA5F5AFB25E823E1F0E8AD2489AAA1C09F01356634A9403670D7AB21CA2E2C
                                                                                                                                                                                    SHA-512:17E396A9BE497077B774AD1108CC8760ED35FC92F65FFF070F9ACD3C4FB67A335C1C57DF1CCB1570DE14B708EFCA0063990A969E30759C9A47731DA45ED25EFE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ndjamena) {.. {-9223372036854775808 3612 0 LMT}.. {-1830387612 3600 0 WAT}.. {308703600 7200 1 WAST}.. {321314400 3600 0 WAT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):178
                                                                                                                                                                                    Entropy (8bit):4.871519187180041
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcdhA9Ff2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dsh2f2D1
                                                                                                                                                                                    MD5:0134039CD1666E983A9B6E43ABD6AF59
                                                                                                                                                                                    SHA1:A2A99345390F4D17C892CEADE58C604257686764
                                                                                                                                                                                    SHA-256:B517120AD8DB3F21EAB4E44A78001EE856EB4EA35852C54CCA96D38887DEBCFA
                                                                                                                                                                                    SHA-512:E5911ADD3D776D87ACFC986C4D2564E3ED9AB12C67F23391ED35FF2A31AD8314B873E31DB8DA4D5E0DAEA12BE34110A8F0C27C9C6126977BAD51C6AD5CDFA39B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Niamey) $TZData(:Africa/Lagos)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.909962899502589
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcboGb+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dqbb+c
                                                                                                                                                                                    MD5:550E482599C2F4280F2C258019BB2547
                                                                                                                                                                                    SHA1:A39045BEF313094CEDC100A7D695AE51BC9E498D
                                                                                                                                                                                    SHA-256:64CAF2BF9D45095DF97F419714D5617CF6300ACDB544B621DCE1D594AA9B910C
                                                                                                                                                                                    SHA-512:4FD29C5B4C0D2BDE69C437E9BF4F08A11E1DAAA689B69F28F3551F550BDCCDD055E4C1A241EDB2FA48B18825AFF792F4860F55983E106EA8224F1D87ED4F7546
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.920023025906233
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXCZDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2D1DBS
                                                                                                                                                                                    MD5:6CFC4E938E50C9B591F8CC42A14FA82A
                                                                                                                                                                                    SHA1:FCE14A5CA62C9005C76D27B849A238E76C834F8A
                                                                                                                                                                                    SHA-256:03B9C1FE350B5E9F6F333F9519FA394DCC562308D9388A903AF3D3FECEBDC762
                                                                                                                                                                                    SHA-512:98F22F1D23A9930276A2D306A1473E64DC43547A16CFD01226E4F030A26A3CC4FDED77F790583CC5C078FC6DFCCE81C16A50879AE46A0D3A6F1FA98373F413C7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.893842293207225
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcyTKM0DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DQD4yn
                                                                                                                                                                                    MD5:6D979FCD225D5431C7391AE568C6409F
                                                                                                                                                                                    SHA1:6C9DCD222061CC00FD386773C6BB2861F3429A60
                                                                                                                                                                                    SHA-256:8FB8692DB9281AE2B087D704168BFD47D3D0901781FEF65BFD62FCB213BA6B50
                                                                                                                                                                                    SHA-512:32AFA6AF6BFC3D42CA636DD2B96906048EF1ADFBB135BB7E7B77C444FED99FDABB84FBBADF56EC63828FFA7B3371191FF1311822B1C75241EBD9CF602467088E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):234
                                                                                                                                                                                    Entropy (8bit):4.818597723513168
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2DXDm2OHH5oHvzdoH1aNbbFHRMy:MB862DTmdHH5CvzdC16bZRMy
                                                                                                                                                                                    MD5:28A5967C797F4B38FB63F823D6F07168
                                                                                                                                                                                    SHA1:17872E91683B884191D2E4C777FB79DCE6D73EE7
                                                                                                                                                                                    SHA-256:BA1D60DF2B41320F92A123A714E17E576C89383526B96E0541A464C3FBA415B7
                                                                                                                                                                                    SHA-512:B335E3D3268631F3A71F4BAD59740F3A5222344E8223C201B8FE885BAA7F1A550FA7778E498D6DC2111F41053856F50B21413AECCE84B80833EC8176F2A1009C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Sao_Tome) {.. {-9223372036854775808 1616 0 LMT}.. {-2713912016 -2205 0 LMT}.. {-1830384000 0 0 GMT}.. {1514768400 3600 0 WAT}.. {1546304400 0 0 GMT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.905303708777235
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcHdDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwdDBS
                                                                                                                                                                                    MD5:F2D7F7BC4EA3629EC7F0E45300A0CFD2
                                                                                                                                                                                    SHA1:E7594D378C5DCFEB1E87E13AC79A026260D2E630
                                                                                                                                                                                    SHA-256:9D8009ACAB019B32B1E87AB10E0AC3765ABCABE8066318DA8CA4905D41562F72
                                                                                                                                                                                    SHA-512:795E58172907020C85CF0B10BBA35842D5F92872CCB3382DFDC787BAA504C79927FA23BC3104AD63541A95C44CA80977E8247846DE918A0B00963B970F4823D2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):954
                                                                                                                                                                                    Entropy (8bit):4.151253074491018
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862DrmdHrCDWR+f7Zn9ueRSmNvlTtuyI/ZBv8dq8Jw4VFZBZYEuAENSfp8kSYx:5veuDkWx3NdT18kbjjAkxTx
                                                                                                                                                                                    MD5:2DF9B050D82B06EB89DA908C31C1F1C9
                                                                                                                                                                                    SHA1:CB294E12560A98D5CEA3BA7004B5519B6C22BAAC
                                                                                                                                                                                    SHA-256:B447B6B1C351E77F22A2D77C0437F2BBB7D8BDFDFDC3D6285E0D260519CC7110
                                                                                                                                                                                    SHA-512:BBE281D551E9F8DA7B6BB08D809177615410A11E4B1184ABD220EA8B1F355B2BBC090C6BAAF7E07FD61286891388ECD4026D4433C4E4B6A8D201F8D95E174532
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tripoli) {.. {-9223372036854775808 3164 0 LMT}.. {-1577926364 3600 0 CET}.. {-574902000 7200 1 CEST}.. {-512175600 7200 1 CEST}.. {-449888400 7200 1 CEST}.. {-347158800 7200 0 EET}.. {378684000 3600 0 CET}.. {386463600 7200 1 CEST}.. {402271200 3600 0 CET}.. {417999600 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {465429600 3600 0 CET}.. {481590000 7200 1 CEST}.. {496965600 3600 0 CET}.. {512953200 7200 1 CEST}.. {528674400 3600 0 CET}.. {544230000 7200 1 CEST}.. {560037600 3600 0 CET}.. {575852400 7200 1 CEST}.. {591660000 3600 0 CET}.. {607388400 7200 1 CEST}.. {623196000 3600 0 CET}.. {641775600 7200 0 EET}.. {844034400 3600 0 CET}.. {860108400 7200 1 CEST}.. {875919600 7200 0 EET}.. {1352505600 3600 0 CET}.. {1364515200 7200 1 CEST}.. {1382662800 7200 0 EET}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1111
                                                                                                                                                                                    Entropy (8bit):4.150944563639585
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862DHmdHjCvbB/lxRjntMVyoKCyFWeey0XSe/OSyHaCgmvLOcSFQSFeSTC6ZPJ:5LemvbplxRhbv+yuh2tIee6kvcw9Cy
                                                                                                                                                                                    MD5:0C99335A41D33AA8BC1EDA0CB4CDCBF5
                                                                                                                                                                                    SHA1:5CABC28D318FA5B8307429EA571FFF91EB8E1252
                                                                                                                                                                                    SHA-256:0760D1028E733888E43E7F1E057217DC2B52786029FCEC67B27EB69CC6A54938
                                                                                                                                                                                    SHA-512:C8FE685ACA46FD4836F3AABC15833F294E5EBED123A487D04E74A8C5668BDFAFB96D2326760452A6E5A1B9CC25AC6C3918D8C10A7F8EF737456640E3000BBA2F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tunis) {.. {-9223372036854775808 2444 0 LMT}.. {-2797202444 561 0 PMT}.. {-1855958961 3600 0 CET}.. {-969242400 7200 1 CEST}.. {-950493600 3600 0 CET}.. {-941940000 7200 1 CEST}.. {-891136800 3600 0 CET}.. {-877827600 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-842918400 3600 0 CET}.. {-842223600 7200 1 CEST}.. {-828230400 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796269600 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766634400 3600 0 CET}.. {231202800 7200 1 CEST}.. {243903600 3600 0 CET}.. {262825200 7200 1 CEST}.. {276044400 3600 0 CET}.. {581122800 7200 1 CEST}.. {591145200 3600 0 CET}.. {606870000 7200 1 CEST}.. {622594800 3600 0 CET}.. {641516400 7200 1 CEST}.. {654649200 3600 0 CET}.. {1114902000 7200 1 CEST}.. {1128038400 3600 0 CET}.. {1143334800 7200 1 CEST}.. {1162083600 3600 0 CET}.. {11747
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1649
                                                                                                                                                                                    Entropy (8bit):3.9974091170263066
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5t+Lmcz0iMHHWMbnHoMcHiM0H+MCySHr/MDHqMafHO8MwHJMHHOMHSHWMHHXM5Hs:OLjQDI6jZ2WFcv
                                                                                                                                                                                    MD5:4846FB13467BA93EB134D88228D7F534
                                                                                                                                                                                    SHA1:477FC6144B7DF365606A2E44EF1430F8DF6FB841
                                                                                                                                                                                    SHA-256:DFC3D1FC182B315B31D999BC103C264BD205EB16F971C8636003A71170D7BD7C
                                                                                                                                                                                    SHA-512:A719F5083F66CE44FE047880A10B2ED04B66E01C7F0F7DADAE2FFB95172308F091D669BCFED5A236D2A0F80A4A1D78DA7A778DDE3FAECB40170ECDA705573769
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Windhoek) {.. {-9223372036854775808 4104 0 LMT}.. {-2458170504 5400 0 +0130}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {637970400 7200 0 CAT}.. {764200800 3600 1 WAT}.. {778640400 7200 0 CAT}.. {796780800 3600 1 WAT}.. {810090000 7200 0 CAT}.. {828835200 3600 1 WAT}.. {841539600 7200 0 CAT}.. {860284800 3600 1 WAT}.. {873594000 7200 0 CAT}.. {891734400 3600 1 WAT}.. {905043600 7200 0 CAT}.. {923184000 3600 1 WAT}.. {936493200 7200 0 CAT}.. {954633600 3600 1 WAT}.. {967942800 7200 0 CAT}.. {986083200 3600 1 WAT}.. {999392400 7200 0 CAT}.. {1018137600 3600 1 WAT}.. {1030842000 7200 0 CAT}.. {1049587200 3600 1 WAT}.. {1062896400 7200 0 CAT}.. {1081036800 3600 1 WAT}.. {1094346000 7200 0 CAT}.. {1112486400 3600 1 WAT}.. {1125795600 7200 0 CAT}.. {1143936000 3600 1 WAT}.. {1157245200 7200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8447
                                                                                                                                                                                    Entropy (8bit):3.867931581740766
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:6hvOs5vveFaHU6lgqN/zNMkixlrxYTMcmo1LWF59:6hvOstgqN/zNMkArxiZmf
                                                                                                                                                                                    MD5:DF52E726B33FA47EB115C1233614E101
                                                                                                                                                                                    SHA1:26B0E49022FCB929F0160617F9C9D2DBEDC63610
                                                                                                                                                                                    SHA-256:77231D179260C08690A70AEE6C2517E4B621ED4794D9AEEA7040539F4FF05111
                                                                                                                                                                                    SHA-512:48AAF25419E07B06E076B0E19F9A0C27EB257556E62FD8F7B2AA963A817823DD89D33AB6AFEAAC2EF2230361D76776355E19CC2BBBB4D19536F823A347AC8AA4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Adak) {.. {-9223372036854775808 44002 0 LMT}.. {-3225223727 -42398 0 LMT}.. {-2188944802 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8685
                                                                                                                                                                                    Entropy (8bit):3.9620252256806845
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:esKLO6KLC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:etLhN9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                    MD5:BFEACEA04AAA8A69A9AC71CF86BCC15C
                                                                                                                                                                                    SHA1:1693971B8AAA35021BA34799FB1B9FADC3DA0294
                                                                                                                                                                                    SHA-256:DE7FBE2B3ED780C6B82099E1E249DD41F4452A3ADB9DD807B1D0EC06049C2302
                                                                                                                                                                                    SHA-512:E94112A2A5F268C03C58CE3BB4C243B2B9B0FC17CB27FDD58BCD2CCC8D377B805C87A552AE7DE1C5698C5F2C4B0FCAB00A3420B1DAD944C1A2F7A47CE7118F78
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Anchorage) {.. {-9223372036854775808 50424 0 LMT}.. {-3225223727 -35976 0 LMT}.. {-2188951224 -36000 0 AST}.. {-883576800 -36000 0 AST}.. {-880200000 -32400 1 AWT}.. {-769395600 -32400 1 APT}.. {-765378000 -36000 0 AST}.. {-86882400 -36000 0 AHST}.. {-31500000 -36000 0 AHST}.. {-21470400 -32400 1 AHDT}.. {-5749200 -36000 0 AHST}.. {9979200 -32400 1 AHDT}.. {25700400 -36000 0 AHST}.. {41428800 -32400 1 AHDT}.. {57754800 -36000 0 AHST}.. {73483200 -32400 1 AHDT}.. {89204400 -36000 0 AHST}.. {104932800 -32400 1 AHDT}.. {120654000 -36000 0 AHST}.. {126705600 -32400 1 AHDT}.. {152103600 -36000 0 AHST}.. {162388800 -32400 1 AHDT}.. {183553200 -36000 0 AHST}.. {199281600 -32400 1 AHDT}.. {215607600 -36000 0 AHST}.. {230731200 -32400 1 AHDT}.. {247057200 -36000 0 AHST}.. {262785600 -32400 1 AHDT}.. {278506800 -36000 0 AHST}.. {294235200 -3
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):202
                                                                                                                                                                                    Entropy (8bit):4.908728298285591
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290/8J5290ppv:MByMYbpwt290/8m90b
                                                                                                                                                                                    MD5:1C3CE9F156ABECEAA794E8F1F3A7ADDB
                                                                                                                                                                                    SHA1:6F84D0A424FD2DE85E3420EA320A186B277B0295
                                                                                                                                                                                    SHA-256:F38610019C0A2C18AC71F5AA108B9647D9B5C01DCB55211AFB8312308C41FE70
                                                                                                                                                                                    SHA-512:CA2DA6F9551E4DBF775D7D059F6F3399E0C4F2A428699726CD2A1B0BB17CCF5CDEEF645EE1759A2A349F3F29E0343600B89CE1F4659CF5D2B58280A381C018AD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Anguilla) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):201
                                                                                                                                                                                    Entropy (8bit):4.898881450964165
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290//MFe90ppv:MByMYbpwt290//V90b
                                                                                                                                                                                    MD5:DB16FFE76D625DEC731AB6320F5EF9BF
                                                                                                                                                                                    SHA1:D286994E03E4F82C08DE094B436FA098648AFADE
                                                                                                                                                                                    SHA-256:561E58E11DC5A86CAE04B5CB40F43EFCFF9ABC0C841FAC094619E9C5E0B403F8
                                                                                                                                                                                    SHA-512:8842B616205378AF78B0B2FC3F6517385845DE30FFD477A21ACFA0060D161FB6462A3C266DCFD54F101729446B8E1B2ECF463C9CF2E6CE227B2628A19AF365F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Antigua) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1782
                                                                                                                                                                                    Entropy (8bit):3.733307964154526
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5KChlvEw6kSSx5H4a8tf3fkuozd23t8VZDG8+GCRRRd:QIlvEwJSSxdF8tfMuozdCt8VZy8+GCRB
                                                                                                                                                                                    MD5:9B01680A362EA7B462DC236F6A35E14C
                                                                                                                                                                                    SHA1:456A5E771F6B749BFDB2BFD59836A6A930499881
                                                                                                                                                                                    SHA-256:B1327CBEC20A21E3FF873E28A2EDFA271EE3A5C01933779300EABD6B185DA010
                                                                                                                                                                                    SHA-512:E6C2F5C489BEA31B0AAC3CB1DB750AC2B665DAC0AC82C1CE6756E768305300297BA5E3B32EDEB9E1715452F02223E47674C4F2B1844920F664623C9F34309240
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Araguaina) {.. {-9223372036854775808 -11568 0 LMT}.. {-1767214032 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2048
                                                                                                                                                                                    Entropy (8bit):3.7664759014118188
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5p9uuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0wi:jIu3pfe92jCs/VOHv2kdeRtnxafwwfF0
                                                                                                                                                                                    MD5:2B9A1EDE5110B46E24F4726664EA1E3F
                                                                                                                                                                                    SHA1:939D1A7A50544F34B318ACDB52BC6930FE453F6D
                                                                                                                                                                                    SHA-256:BC86AC89121EC4AA302F6259CCC97EFFD7022DC6CEE3B291C57DA72B6EA0C558
                                                                                                                                                                                    SHA-512:C204740DACBCECF2CC5CF4FEB687E86B9150512623203C999D6F4EB5FB246D07681A35C28D8445F6A50F49940C321E0AA5E51FE5A73B8ED076F29CEB5B4D4CA2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Buenos_Aires) {.. {-9223372036854775808 -14028 0 LMT}.. {-2372097972 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2077
                                                                                                                                                                                    Entropy (8bit):3.742645155048276
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5/nuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0NC:Vuu3pfe92jCs/VOHv2kdeRtnxafww3mP
                                                                                                                                                                                    MD5:3D2AF5714DFC392ED4BC976784D5A58A
                                                                                                                                                                                    SHA1:9252DE40B6EF872E1D2F7CDD53DDD21145E93C5C
                                                                                                                                                                                    SHA-256:A516BB0937977EF949D47B3C8675E30F1CA6C34F8BD298DCF6EBB943580D5317
                                                                                                                                                                                    SHA-512:8D5FFDB5B578B8EA0291D3A21BDDE25F8301CB16B11AE794FFBA8DCFFE46F6AC5EC03D93E511061B132D84E69E5FAF1BB212837EB8A5A4B4BE517F783837E615
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Catamarca) {.. {-9223372036854775808 -15788 0 LMT}.. {-2372096212 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522740
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):242
                                                                                                                                                                                    Entropy (8bit):4.72138001874583
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/290/MquQ90/MMXAy:MByMY/MYp/MrRt290/MquQ90/MK
                                                                                                                                                                                    MD5:8A609667DE461CEDC1127BE38B161459
                                                                                                                                                                                    SHA1:557D2D55DEA38D1CD1103E183F89C65F4016662B
                                                                                                                                                                                    SHA-256:8CCD6FC77D55582938F1912B1BA66035882D1BFC18A797C631E5E89ABFBF570B
                                                                                                                                                                                    SHA-512:DBAFDA069DB5FDBCBA11050AC91A733C1712BD6395939CFFFC5EAA78BD0B70B4AF2D9FB8954C6841CCF3AC5F8EDCF08E604D3F2CF67F1CBEA5EB6D3C4DC7F2FA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2043
                                                                                                                                                                                    Entropy (8bit):3.7481312409221594
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5lxQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0n:/xBu3pfe92jCs/VOHv2kdeRtnxafww3j
                                                                                                                                                                                    MD5:8C1D665A25E61CE462C2AC57687763BF
                                                                                                                                                                                    SHA1:B5BBC26CF6A24BD5BEA42AC485D62C789B80905F
                                                                                                                                                                                    SHA-256:FA75E274240A341C6BFE3539CFDC114D125AEAEA3161D3C2409347CF8046042A
                                                                                                                                                                                    SHA-512:A89A7A92C025B87DA4CDFE99BF70CD0E64690D7BFE827DCBFBF0E91B188003FA26487E72B6B950D3BFC9C854B890E5936F414BBEAAD5F3F0673AC5EFE273CDF4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Cordoba) {.. {-9223372036854775808 -15408 0 LMT}.. {-2372096592 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2041
                                                                                                                                                                                    Entropy (8bit):3.7481290145270245
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5HluuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwcSPAC8OS0E:xwu3pfe92jCs/VOHv2kdeRtnxafwcDCK
                                                                                                                                                                                    MD5:995EDE9E1E86DB500C7437A196325E21
                                                                                                                                                                                    SHA1:4A8FB1511AA124CA2D299EC8DE155EE9D0479180
                                                                                                                                                                                    SHA-256:43EB79ABC03CBAC661C563DE1BC09D9DD855CBC72DD2B6467EA98F0F90421BA9
                                                                                                                                                                                    SHA-512:B58B35EA1B2F0388B8108DCF254F3BD1B21894F00A9F313ABC093BC52C36FCDD94B7486DBA38161C9EFCDB12BC3CD81E7E02395B0CA480A7F01148C43CD3054F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Jujuy) {.. {-9223372036854775808 -15672 0 LMT}.. {-2372096328 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2106
                                                                                                                                                                                    Entropy (8bit):3.744252944523733
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5lduuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0NC:Tou3pfe92jCs/VOHv2kdeRtnxafwwkFP
                                                                                                                                                                                    MD5:4A45A063D45EB94214005EF3CA5BCD6D
                                                                                                                                                                                    SHA1:2420E8591DC53A39EE1A58B2E45DCFAF9503685F
                                                                                                                                                                                    SHA-256:2B018B791E48269FA9EDA12662FFEC3E2DC33603A918E8B735B8D7D6BEB3B3AA
                                                                                                                                                                                    SHA-512:0B2824FA3D40B2EDBE8488D50C30368F4CF6E45A39FF6DEBC5BB4FD86F85AD52F5331AD1EB50E5166FA2E735B7E8AA9D94A5FED9421334DB0499524DBE08F737
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/La_Rioja) {.. {-9223372036854775808 -16044 0 LMT}.. {-2372095956 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2077
                                                                                                                                                                                    Entropy (8bit):3.738002814507529
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5CPBuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwGSmSc8OSI:GUu3pfe92jCs/VOHv2kdeRtnxafwGJld
                                                                                                                                                                                    MD5:F6CB24E8567B2443224E9E17EE438BFE
                                                                                                                                                                                    SHA1:8029426C30C4C645EA77C6240391CDB1C3107568
                                                                                                                                                                                    SHA-256:DC39400BBFD5BDDDC174FE099194806FBFD3FC3AA20E670D67BE0AC35FE97AD4
                                                                                                                                                                                    SHA-512:6869CFC24C21FBB2DFCCAA9AE7E21A0B24DC002EE792FB28A8F2F05C75C20E93C95A39BD8653AA272AF10FE95922B99EECC1208AACE814817D9441F84360E867
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Mendoza) {.. {-9223372036854775808 -16516 0 LMT}.. {-2372095484 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2080
                                                                                                                                                                                    Entropy (8bit):3.7580685839169545
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5oQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0NC:qBu3pfe92jCs/VOHv2kdeRtnxafwwfFP
                                                                                                                                                                                    MD5:212D13CE27AF114A8EC2E04023D218C4
                                                                                                                                                                                    SHA1:C4C5F86BC6EC0D5EA4C9CF199309D085767B97E8
                                                                                                                                                                                    SHA-256:A05B6708DEFF0607396BFC6661C2287341C3432841AE353D94A67AC742B5FAFA
                                                                                                                                                                                    SHA-512:CE7201EEA6A86FB49641410D2EEE4030EDB1B96F3218D764762F5AE23883C796F5742ED69CEC985A9D3582D6C72ED74114DE81508F6DEB4B54865B6974ADC965
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Rio_Gallegos) {.. {-9223372036854775808 -16612 0 LMT}.. {-2372095388 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2011
                                                                                                                                                                                    Entropy (8bit):3.7415813345133975
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5NPuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0wF:72u3pfe92jCs/VOHv2kdeRtnxafww3mz
                                                                                                                                                                                    MD5:A06C33CDFD7E7B630CB1DF34E72E61E5
                                                                                                                                                                                    SHA1:694826B9B910DA0BD70A9CB547C26E6838B08111
                                                                                                                                                                                    SHA-256:CAEFC60F2F36EF9FFE0C5921C3C392DE1E95755683A96C1C4EC0BA2C242A4D84
                                                                                                                                                                                    SHA-512:D6696A6C14EECF2B77EC586F40137BDD95E5CE5C5193570C809FAB9E5FCA4B8744283CEB6818E525C73F6EFF657274410B2622902EE8C15912C8D5F5FA5C805E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Salta) {.. {-9223372036854775808 -15700 0 LMT}.. {-2372096300 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2106
                                                                                                                                                                                    Entropy (8bit):3.747934819596411
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5vXxuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0K:hUu3pfe92jCs/VOHv2kdeRtnxafwwkFl
                                                                                                                                                                                    MD5:32A50D0ABF408D9E59C0580D5B8CC472
                                                                                                                                                                                    SHA1:EA5BB8860982F8BAFEAEFDE1D6ACD440DA132DFE
                                                                                                                                                                                    SHA-256:41B2C25E42146A76934B866061BB3245B8ADA0FF4E1BFBA6F8842A30BDD5C132
                                                                                                                                                                                    SHA-512:E5D2521A4EF53AAD3E74506708EC2768C4D2EE8D6D014DCCF4A6DC290B713B4D46021B66527548C35004E10D753E1B685EEFD55BBE7BF01EC6104D7D8AAC4403
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Juan) {.. {-9223372036854775808 -16444 0 LMT}.. {-2372095556 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2081
                                                                                                                                                                                    Entropy (8bit):3.7399269084699975
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5MDuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafw6bS2nZSbdI:yCu3pfe92jCs/VOHv2kdeRtnxafwWnZr
                                                                                                                                                                                    MD5:FB06B66F5D41709C7E85C8B1E9BFCFA0
                                                                                                                                                                                    SHA1:D5C0C4B12C6190856C300321B1C106C7474BA54B
                                                                                                                                                                                    SHA-256:A43B35F25E54EF359D046E33281C0A978F0EE8811C93A6809F1F65750878BBB6
                                                                                                                                                                                    SHA-512:D445F46D6A17A075AD995885E45234A711F53BF3FE2DFC6DFBB611E8AC154B10C91E137927DD66D6A7C596A93BAE5DE283796F341B5095FA0DD05595E1C3A077
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Luis) {.. {-9223372036854775808 -15924 0 LMT}.. {-2372096076 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2105
                                                                                                                                                                                    Entropy (8bit):3.741704529449777
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5yZujuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OSf:suiu3pfe92jCs/VOHv2kdeRtnxafww3w
                                                                                                                                                                                    MD5:D9497141EC0DC172E5FF5304FED0BE6B
                                                                                                                                                                                    SHA1:CD20A4F0C127A84791093010D59DF119DD32340A
                                                                                                                                                                                    SHA-256:0F7DB23E1280FC19A1FB716E09A9699ADA2AAE24084CAD472B4C325CC9783CCF
                                                                                                                                                                                    SHA-512:0B71952055013CD6045ED209FD98168083550655FAB91B7870C92098E40C4FE6827EAAF922D34ECE28298CBB14327A76AD6780D480E552F52F865AA11A4AA083
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Tucuman) {.. {-9223372036854775808 -15652 0 LMT}.. {-2372096348 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2075
                                                                                                                                                                                    Entropy (8bit):3.7445758155279836
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5SHuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0jE:YOu3pfe92jCs/VOHv2kdeRtnxafwwfFn
                                                                                                                                                                                    MD5:16A89FD2CDEE50E534301A9797311A9D
                                                                                                                                                                                    SHA1:4A4EBA1798214C7CF5ACDC0B2EC8B4716CD968CB
                                                                                                                                                                                    SHA-256:10B6FF51314D8EE1D010187D8805C4E3D71B778BC6DECB26E66193A5BB3E9EA2
                                                                                                                                                                                    SHA-512:DBB0BA3F8AA2B54C86EA8B6530C16DF95AF1331FC5F843B113A204DA20B8EF011FE93C27EB917D01B9040D4914057687B4AACCD292A847559AF69150D1BDC4B5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Ushuaia) {.. {-9223372036854775808 -16392 0 LMT}.. {-2372095608 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):199
                                                                                                                                                                                    Entropy (8bit):4.893042770292303
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290/V90ppv:MByMYbpwt290/V90b
                                                                                                                                                                                    MD5:CC015E3E5D3293CAA1348B4E0EE5795C
                                                                                                                                                                                    SHA1:75E7EFD905C9001CE9CA5872DA3915A19BCB00E0
                                                                                                                                                                                    SHA-256:7490CD66408B8A14C549278FE67DC3338FE9E458F423F01CCBEA00B5E6F6CEF6
                                                                                                                                                                                    SHA-512:66523F050E4A42A1C9FC8C02B822CD3864A6E35F6364FB6A675F2A503BD8030FE6E380B252068668A79A6593B5042520EE40700DA033517742B3F0ED33D79DAF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Aruba) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7944
                                                                                                                                                                                    Entropy (8bit):3.5156463862656775
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:j7RXBXLqbvdvZsV4GGdzVUFg7XaMOhKpJq3o5GMJq90vRFhjGF3RxTBhcXBACBLo:jEJgXh
                                                                                                                                                                                    MD5:181203CAD98E94355B9914A205514904
                                                                                                                                                                                    SHA1:D361CB53955437270905A9432DE9E7F6C1AE7189
                                                                                                                                                                                    SHA-256:EAEFE21276EE60C7F876C1D65039999AC069339DCDB82A23FC9206C274510575
                                                                                                                                                                                    SHA-512:AE9262DFC35579AEB610DF8BB5F7FBB49232195F55F78402405017681F72C0D2A09FA9EB605B406065A1F44FE6785AC0163870C921DAFFC4746DA6EDA3081521
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Asuncion) {.. {-9223372036854775808 -13840 0 LMT}.. {-2524507760 -13840 0 AMT}.. {-1206389360 -14400 0 -04}.. {86760000 -10800 0 -03}.. {134017200 -14400 0 -04}.. {162878400 -14400 0 -04}.. {181368000 -10800 1 -04}.. {194497200 -14400 0 -04}.. {212990400 -10800 1 -04}.. {226033200 -14400 0 -04}.. {244526400 -10800 1 -04}.. {257569200 -14400 0 -04}.. {276062400 -10800 1 -04}.. {291783600 -14400 0 -04}.. {307598400 -10800 1 -04}.. {323406000 -14400 0 -04}.. {339220800 -10800 1 -04}.. {354942000 -14400 0 -04}.. {370756800 -10800 1 -04}.. {386478000 -14400 0 -04}.. {402292800 -10800 1 -04}.. {418014000 -14400 0 -04}.. {433828800 -10800 1 -04}.. {449636400 -14400 0 -04}.. {465451200 -10800 1 -04}.. {481172400 -14400 0 -04}.. {496987200 -10800 1 -04}.. {512708400 -14400 0 -04}.. {528523200 -10800 1 -04}.. {544244400 -14400 0 -04}.. {5
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):187
                                                                                                                                                                                    Entropy (8bit):4.791603790249234
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE/qlOi+4IAcGEu5B:SlSWB9vsM3y7oDSHAIgpdN/290/qlf+M
                                                                                                                                                                                    MD5:5A45B70C79F533548B3DD332F988E15B
                                                                                                                                                                                    SHA1:C7485828619A1D4F5CA59D80ABD197100AC58F64
                                                                                                                                                                                    SHA-256:518BEB6E54AE811F8C725EA8CC42787D48FC605A3476D6E7A00A1B5733CBD6AC
                                                                                                                                                                                    SHA-512:A81C2EBE282E019ED011EADDB8F74C3E6FBE88D87E8D8706B3022CDCC48EF92AD90F9BCF9F25031664BB6EFE069EAFDD23D9B55BF672FC7528A2DD8CB6B986B4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Atikokan) $TZData(:America/Panama)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):177
                                                                                                                                                                                    Entropy (8bit):4.812527147763069
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/yO5WXHAIg20/yOoNvWARL/2IAcGE/ol7x+IAcGs:SlSWB9vsM3y7/yrHAIgp/yH0AN/290/e
                                                                                                                                                                                    MD5:13479F64BFBDC7583C637E1562C454B4
                                                                                                                                                                                    SHA1:2F59484C779B0D6033FC14E205DA9BCAB7A5FCB1
                                                                                                                                                                                    SHA-256:1D6FEE336E71FFFB64874A830C976867C071EBF6B133C296B32F87E3E7D814C9
                                                                                                                                                                                    SHA-512:D2C5D35BBBDAB8D58BF6185328124796C06B67ADFB4C1828BA5A9CCA500A01BB8BE69635AE7EEA7FA837A27B20D488A08A29B121DD1617BC373390AD95D67E39
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Adak)]} {.. LoadTimeZoneFile America/Adak..}..set TZData(:America/Atka) $TZData(:America/Adak)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2012
                                                                                                                                                                                    Entropy (8bit):3.703391569010329
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5/ChlvEw6kSSx5H4a8tf3fku+da2XUd23t8VZDG8+GyOd:VIlvEwJSSxdF8tfMu+da2kdCt8VZy8+K
                                                                                                                                                                                    MD5:69DCC2477D8D81E2F49D295DB6907190
                                                                                                                                                                                    SHA1:3C6ED0CEF15D3265C962873480EE1809A4DCACA2
                                                                                                                                                                                    SHA-256:64F1EC14F6B43FF10B564F839152E88DF9262F0947D1DB347557FA902F6FD48C
                                                                                                                                                                                    SHA-512:71DEA6D47F267AA7326A011872FA74762FA4F8CD57EB149E3B56B3DE9097B0B9258BC4F6C29188B49FC60C1942869B92D9E59FEE6980A5DA5D0029C383D99F39
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bahia) {.. {-9223372036854775808 -9244 0 LMT}.. {-1767216356 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6847
                                                                                                                                                                                    Entropy (8bit):3.8753284304113196
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5pUSdFS1Y3FUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAqyQUrBbp7uos6u:DG1sehpYtpjyrz7nKED4KPddGEYA/Gx
                                                                                                                                                                                    MD5:E7EF08880C64C898BB7A5266EBF1A47A
                                                                                                                                                                                    SHA1:E2D2F36961C9CADB2736FFAF2DBA9A1F4B372DBD
                                                                                                                                                                                    SHA-256:B24AE5FA20F5329644529F660EEC8BAA3B966F9730AF58F1C21E94C02AE17228
                                                                                                                                                                                    SHA-512:6C47D875682CCE8B769EB0458CEC20FB8D4950A70D6904A32CED803D30F8B407828D7A12B4F560CF6B86541E985817B4394F9AEAAFEAA80593B5B42BA92D38CB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bahia_Banderas) {.. {-9223372036854775808 -25260 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):648
                                                                                                                                                                                    Entropy (8bit):4.251560000277241
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290eWmdH9Colj/uFkv/lC1/uFkOzQs/lps/Ozfah/OzT/lN/uFkX/ll/uFki:5TWeUo5Skv/Y1SkA/g/Bh/m/rSkX/zSt
                                                                                                                                                                                    MD5:DC4FA44B2174A4E6F0644FA8EA2E83F9
                                                                                                                                                                                    SHA1:C12DF8C862A05D569EAF189272F8BF44303595A1
                                                                                                                                                                                    SHA-256:FD5E04136506C6543A9ACDC890A30BCF0D561148E1063EC857E3913DE1EBA404
                                                                                                                                                                                    SHA-512:5AC307CD48132B57215CCBAF0BB63F7FA9C5B28DC9F6217C905885D75B0DF131238D4DB2AE707C3DDEE2EDE6C0914644B435FB1CDD9913600D8B69AE95578B0F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Barbados) {.. {-9223372036854775808 -14309 0 LMT}.. {-1841256091 -14400 0 AST}.. {-874263600 -10800 1 ADT}.. {-862682400 -14400 0 AST}.. {-841604400 -10800 1 ADT}.. {-830714400 -14400 0 AST}.. {-820526400 -14400 0 -0330}.. {-811882800 -12600 1 AST}.. {-798660000 -14400 0 -0330}.. {-788904000 -14400 0 AST}.. {234943200 -10800 1 ADT}.. {244616400 -14400 0 AST}.. {261554400 -10800 1 ADT}.. {276066000 -14400 0 AST}.. {293004000 -10800 1 ADT}.. {307515600 -14400 0 AST}.. {325058400 -10800 1 ADT}.. {338706000 -14400 0 AST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1031
                                                                                                                                                                                    Entropy (8bit):3.8842563546204225
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5fe300cChlrLPsw6kSS3h5R14eH8tf3xd:5+CChlvEw6kSSx5H4a8tf3xd
                                                                                                                                                                                    MD5:DFA5E50F6AEF1311A4CF74970477E390
                                                                                                                                                                                    SHA1:5B63676EB8039B2BE767BAA44820F2DAE5B62876
                                                                                                                                                                                    SHA-256:549625CCB30BD0E025BAC47668BA3AA0CDD8569E5887E483C8D62B5B7302FA50
                                                                                                                                                                                    SHA-512:4BBB43694E3B54339C549AC3A5488B77366DB1189D8D1834DCF618D9448084A950B575E207064521B1CDFD2E41F7D1D8C5CD9CEB4668D4459585649556136EB0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Belem) {.. {-9223372036854775808 -11636 0 LMT}.. {-1767213964 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3284
                                                                                                                                                                                    Entropy (8bit):3.8546064195941097
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5pKSxZwR9IVQU55DG5krgGN8wW+YeD1yyfCwoc:HKSjgIVzrG5krRN8wWheD1yu
                                                                                                                                                                                    MD5:4DA622B685B3B075CC94FC4E23322547
                                                                                                                                                                                    SHA1:DEB23F0A434549DAE1BE60ACF757BB212C907B92
                                                                                                                                                                                    SHA-256:E07F45264E28FD5AA54BD48CB701658509829CF989EC9BD79498D070A1BA270F
                                                                                                                                                                                    SHA-512:9B00BF8870BC4AAEF7F06FCDFEEEF54686A2CC890103696631EB4DEF5AEEAD051EC9069D70A2B22397F18C0067E03A54E75DA18474D6B1BD3BDA2D5313E0AD16
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Belize) {.. {-9223372036854775808 -21168 0 LMT}.. {-1822500432 -21600 0 CST}.. {-1616954400 -19800 1 -0530}.. {-1606069800 -21600 0 CST}.. {-1585504800 -19800 1 -0530}.. {-1574015400 -21600 0 CST}.. {-1554055200 -19800 1 -0530}.. {-1542565800 -21600 0 CST}.. {-1522605600 -19800 1 -0530}.. {-1511116200 -21600 0 CST}.. {-1490551200 -19800 1 -0530}.. {-1479666600 -21600 0 CST}.. {-1459101600 -19800 1 -0530}.. {-1448217000 -21600 0 CST}.. {-1427652000 -19800 1 -0530}.. {-1416162600 -21600 0 CST}.. {-1396202400 -19800 1 -0530}.. {-1384713000 -21600 0 CST}.. {-1364752800 -19800 1 -0530}.. {-1353263400 -21600 0 CST}.. {-1333303200 -19800 1 -0530}.. {-1321813800 -21600 0 CST}.. {-1301248800 -19800 1 -0530}.. {-1290364200 -21600 0 CST}.. {-1269799200 -19800 1 -0530}.. {-1258914600 -21600 0 CST}.. {-1238349600 -19800 1 -0530}.. {-1226860200 -21600
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):206
                                                                                                                                                                                    Entropy (8bit):4.938043196147077
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290F490ppv:MByMYbpwt290S90b
                                                                                                                                                                                    MD5:09FD8280CC890F238126F9641DB7C90E
                                                                                                                                                                                    SHA1:98AB4E0DE8173C2BB2532B07FAE2E71F588AB26F
                                                                                                                                                                                    SHA-256:FACD0A835D1F425CD323EE453ADE231810B2D1CF6EBA227BA1B50522AE3879F7
                                                                                                                                                                                    SHA-512:117C24389B7BFB079F4409B1FA6AA547654D7C69A6CBB19218BF2B96F6CFE3CBAAD400D4C2EFE8A9BFE25F44402057427FC8A62DC20A98018D23A7CF9B87401F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Blanc-Sablon) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1199
                                                                                                                                                                                    Entropy (8bit):3.7988385604912893
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5EThevwnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQZ:5EHSeSFESoSQSrSsCSeSPS1cSQSQlSsp
                                                                                                                                                                                    MD5:9529221F9B4E104CC598491703B10E6C
                                                                                                                                                                                    SHA1:5ACD61B525A18DE1919A7484C92EC5D787DF2F25
                                                                                                                                                                                    SHA-256:10592EA1CB0D02C06A61059EC601F70A706A5053AC923B9EED29388D5E71EF3A
                                                                                                                                                                                    SHA-512:66BEDB631469651A5E426155428764E3C1C14483E6FEE1505812E8676EB6E82CF0A88F6CC697F03FDA0AF906D91C7DE6E940DF3D33DD247BEF51DBD9A13DEE16
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Boa_Vista) {.. {-9223372036854775808 -14560 0 LMT}.. {-1767211040 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):246
                                                                                                                                                                                    Entropy (8bit):4.705337479465446
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/290bJhDm2OHDgoHvcuknov/zEXPKV2kR/uFVEV/KVg:MB86290bLmdHDgCvcukCz8O2Y/uF2/Og
                                                                                                                                                                                    MD5:DB019451A7D678C3E7AEE706283861F6
                                                                                                                                                                                    SHA1:57E63C5372F50CBD1A7FA32688C1B77ADDCC06EB
                                                                                                                                                                                    SHA-256:B6ADC16815DC95E537548CA3572D7F93626A6D1DC390DD4CBABAB5AB855BBA30
                                                                                                                                                                                    SHA-512:6C94B2D7EFA856E6BD41FC45B0E8D16A40E61D8B895397CD71230047FAD4793DDB9ABAAC57D2841549F161C9389D7E61D54D38F1BAC6F13ED3DD4C68CDD3272C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bogota) {.. {-9223372036854775808 -17776 0 LMT}.. {-2707671824 -17776 0 BMT}.. {-1739041424 -18000 0 -05}.. {704869200 -14400 1 -05}.. {733896000 -18000 0 -05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8605
                                                                                                                                                                                    Entropy (8bit):3.8563913604109064
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:eSwtktXNmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:/jXNDPlLv/PCenJzS6cy
                                                                                                                                                                                    MD5:005D0BF1320030A7E9CDC97D0C8BB44B
                                                                                                                                                                                    SHA1:CB236DA840A49B4BCD261114DCA38DADA567B091
                                                                                                                                                                                    SHA-256:93AF910CB2AD2203B71C1AD49D56DF4A4A14D07F885AFD4E755271F1372A517C
                                                                                                                                                                                    SHA-512:16A5483392741673BEC020EF6EBE963AB0FB12629D662C586C27A1E9A1BE3FEA8DC3D05A0E84917B8166E48CADA45C74DFABFDC897A6BC94D3C5058D31AD5126
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Boise) {.. {-9223372036854775808 -27889 0 LMT}.. {-2717640000 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-1471788000 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126255600 -25200 0 MST}.. {129114000 -21600 0 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):239
                                                                                                                                                                                    Entropy (8bit):4.821972751564724
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7/MQA+zAHAIgp/MQA+zE5N/290BFzk5h490/MQA+zd:MByMY/MV+zhp/MV+zE5t290rzy490/MW
                                                                                                                                                                                    MD5:6700956D5FE96CEC8D34EB49FF805374
                                                                                                                                                                                    SHA1:69B9973EF31AE204EFED7485E59CEA99E00815C8
                                                                                                                                                                                    SHA-256:DEFC5C9DA2D4D4146145A50D692A6BFF698C3B0A1F19EFD82AD0EE7678F39FCF
                                                                                                                                                                                    SHA-512:A80C03A519F00A4270248E885463090A34B3992B3DEBA94DD6AEBCC50736541655461E4AA10856125B8EF9B92CEB697429EE7088DBC6AB4FAE383FDF11521B7A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Buenos_Aires)]} {.. LoadTimeZoneFile America/Argentina/Buenos_Aires..}..set TZData(:America/Buenos_Aires) $TZData(:America/Argentina/Buenos_Aires)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7739
                                                                                                                                                                                    Entropy (8bit):3.8713679494465016
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:zsGaLV9T1sF7Lv/PCewtA8CzSPyDLbrcUia:h5lLv/PCenJzS6cy
                                                                                                                                                                                    MD5:E6AE12CDB55FED492C253E46E2690FE0
                                                                                                                                                                                    SHA1:CD3699E50BC1694827E51E4101C713E52FA646C8
                                                                                                                                                                                    SHA-256:3E0506A54B562DBC3AA6889DDD39B327FE0B85C63B00F0B39D606921A0936A59
                                                                                                                                                                                    SHA-512:BA3D5D5420210E74E74A581C9678224948266828A8FACE06383E41E13475C682F82D288426FB915D618FFE7ED95BD8F1C7E9D59D31CE5B464D5EC1363AB5E340
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cambridge_Bay) {.. {-9223372036854775808 0 0 -00}.. {-1577923200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}.. {671014800 -21600 1 MDT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2918
                                                                                                                                                                                    Entropy (8bit):3.6039149423727013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:591PSeSFESoSQSrSsCSeSPS1cSQSQlSsSyZS2SqLSwZS4vSoSUSLpSzS4X3/SxSs:5VsE3LMuJALTvn1ZdP7ZbvLfeAh+KIic
                                                                                                                                                                                    MD5:230A9F7A87BA56C30ACB3B1732F823F3
                                                                                                                                                                                    SHA1:8263EA723F2AEA7740C7EC54BE0000A06982D765
                                                                                                                                                                                    SHA-256:6D5BD1355016B03EDEA58DF98BEC26281CD372725B2DCB60B4D748D2FB4346C8
                                                                                                                                                                                    SHA-512:C357AA33833DBBDC6BC7DD3F23469EADDF08564AF17D7EE935C8AEA5F35B6E3BBDE1E181BC0DBF264051C4BE139261055633D191413DD610B0150AB3CDE161AF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Campo_Grande) {.. {-9223372036854775808 -13108 0 LMT}.. {-1767212492 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1412
                                                                                                                                                                                    Entropy (8bit):4.034087321254386
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5s5edTS/uVV3iVP/uaP/uAyAhbS+V8S+FfS+UvS+MS+FB3S+QS+rcS+kS+RS+dSB:5DziZAmELf0On9uhcinzPPoUlWQW3
                                                                                                                                                                                    MD5:7FBCA91F4B7100C4667F24A9AB263109
                                                                                                                                                                                    SHA1:163A77FF9EAC49B00B5F838DF4D47F079ECF6A83
                                                                                                                                                                                    SHA-256:FD6C370F82E5CFE374637E0E222E72570857AC3F85143BEEEF9C3D0E7A6C0D04
                                                                                                                                                                                    SHA-512:124A5D7F58B38F15A90BA48E63D1D38335371D98A2503E691EC6426EB51E87FD61CA05FCA83573DD1DC06DB9E599302C64D226D5DF13B8A62E0A6943318431BE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cancun) {.. {-9223372036854775808 -20824 0 LMT}.. {-1514743200 -21600 0 CST}.. {377935200 -18000 0 EST}.. {828860400 -14400 1 EDT}.. {846396000 -18000 0 EST}.. {860310000 -14400 1 EDT}.. {877845600 -18000 0 EST}.. {891759600 -14400 1 EDT}.. {902041200 -18000 0 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0 CST}.. {1207468800 -18000 1 CDT}.. {1225004400 -21600 0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):284
                                                                                                                                                                                    Entropy (8bit):4.588048586971241
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2909+ETlDm2OHXoHv8HkISlvFVFQVgVJUF/R/OXFxWnVVFQVgVVvR/e:MB86290XmdHXCvydSltvAUeFZ/O/qVva
                                                                                                                                                                                    MD5:5DDB49759D58931A06740A14F76B431C
                                                                                                                                                                                    SHA1:E9AC99265D42D140E12BB4DAAA24FABAC65E79FA
                                                                                                                                                                                    SHA-256:D558C25F165E956E980AA8F554AB3BF24E91B51EADBD2B1065EF6DFDA0E2F984
                                                                                                                                                                                    SHA-512:318804ED41F36A3A8746C8CD286116787A768B06CAD6057559D1C7105170DE6EAB807EFA52AA8A0E353491B6F8C47D623D4473C1AEAD20B5C00747E07BB282B2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Caracas) {.. {-9223372036854775808 -16064 0 LMT}.. {-2524505536 -16060 0 CMT}.. {-1826739140 -16200 0 -0430}.. {-157750200 -14400 0 -04}.. {1197183600 -16200 0 -0430}.. {1462086000 -14400 0 -04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):227
                                                                                                                                                                                    Entropy (8bit):4.666638841481612
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/29094SXAFB5290/MMXAy:MByMY/MYp/MrRt290mh5290/MK
                                                                                                                                                                                    MD5:EEB851BE330BCC44A4831763534058B9
                                                                                                                                                                                    SHA1:A5FC3E69DDBD3C40D9EB4317BBD5BB6C78751B36
                                                                                                                                                                                    SHA-256:37CD6BDAA6C6EEDFAC3288CA1C11F5CBBE8A17E5F2E790E7635A64B867AFBD87
                                                                                                                                                                                    SHA-512:7CD0BC822550325EB3198B4AD6CCD38938FA654A03A09C53117560D1FE3FDCD9C892D105F0D7AF44ED52DD7E0475721240D74A10C98619BE9EC4F5410B8FD87D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Catamarca) $TZData(:America/Argentina/Catamarca)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.832612867310476
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2IAcGE91INMXGm2OHEFvpoeoHsdR4FIUPvGXFkUwXvp3VVV:SlSWB9eg/2909qDm2OHEdGeoHm4vOXF6
                                                                                                                                                                                    MD5:6052E52C8E5A5F43102C47D895797A1F
                                                                                                                                                                                    SHA1:23DBD40AE96C84E44ADCD1AC33E7871D217C17BC
                                                                                                                                                                                    SHA-256:873285F3E13CB68DD28EB109ECAD8D260E11A9FF6DF6A4E8E0D4C00B0182695B
                                                                                                                                                                                    SHA-512:DDE89C70B6F24AD4F585DC5424A6D029E5C898254C9085C588AE699CED4C8316840FF7C87685D7CFAA2E689F01687985454A0C9E3886342E936C56AB688DF732
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cayenne) {.. {-9223372036854775808 -12560 0 LMT}.. {-1846269040 -14400 0 -04}.. {-71092800 -10800 0 -03}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.774923706273939
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE91mr4IAcGEu5pvn:SlSWB9vsM3y7oDSHAIgpdN/2909Yr49F
                                                                                                                                                                                    MD5:AD6E086BEDF05A0BEB66990BD9518BEE
                                                                                                                                                                                    SHA1:FA0B7E8D6931E79092A90F7EECBA2293AE886AE3
                                                                                                                                                                                    SHA-256:C38C49AE1C3E67BD2118002DCFCC3C0EFB6892FB9B0106908A9282C414D0BF2E
                                                                                                                                                                                    SHA-512:A1E40422D15DBCB24A6FE353639A1541FAD7F394D20F8AEB32D4E39667BA264C3E815BAA703B88B90D381540168016A0641CA220BACAF05E80EAA698642B6FFA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Cayman) $TZData(:America/Panama)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11372
                                                                                                                                                                                    Entropy (8bit):3.814348526052702
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:l6u30Ke1rdJ8SUklvgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:l1EKwdJ8SUkl4aUqtfA604qSBgI7DBch
                                                                                                                                                                                    MD5:763E23AA7FB20F8D7CB2F0E87FAFD153
                                                                                                                                                                                    SHA1:B131A10C1C208BB5E5E178ACD21A679FD0537AC5
                                                                                                                                                                                    SHA-256:C7707AF88D650F90839E7258356E39D85228B33B6DBCC5C065C3D8733AE28CEE
                                                                                                                                                                                    SHA-512:FE9C5D2EA253338DDFD79CC8ED2F94D6817BD770C0895752EFB1917E2313735C18475D67191C29BCCD53DEFFF35C1BF0CA5D98C92091DDCD1E97CD6302DC73A4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Chicago) {.. {-9223372036854775808 -21036 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1577901600 -21600 0 CST}.. {-1563724800 -18000 1 CDT}.. {-1551632400 -21600 0 CST}.. {-1538928000 -18000 1 CDT}.. {-1520182800 -21600 0 CST}.. {-1504454400 -18000 1 CDT}.. {-1491757200 -21600 0 CST}.. {-1473004800 -18000 1 CDT}.. {-1459702800 -21600 0 CST}.. {-1441555200 -18000 1 CDT}.. {-1428253200 -21600 0 CST}.. {-1410105600 -18000 1 CDT}.. {-1396803600 -21600 0 CST}.. {-1378656000 -18000 1 CDT}.. {-1365354000 -21600 0 CST}.. {-1347206400 -18000 1 CDT}.. {-1333904400 -21600 0 CST}.. {-1315152000 -18000 1 CDT}.. {-1301850000 -21600 0 CST}.. {-1283702400 -18000 1 CDT}.. {-1270400400 -21600 0 CST}.. {-1252252800 -18000 1 CDT}.. {-1238950800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6814
                                                                                                                                                                                    Entropy (8bit):3.8786702185951305
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:bo1GK5+yBEzg4GaaECHm3FL5TInckNSNi:m5+yBEzVWEaOkv
                                                                                                                                                                                    MD5:1C8647651377A373D573DCD21001CC0A
                                                                                                                                                                                    SHA1:EFFE86F9A5C55FAB00415DD0A103B00AA6B237C6
                                                                                                                                                                                    SHA-256:A816DC1C4C2FB7509A50CB209D748DAC27C5F858A2842D7E12B2EC620FEA988B
                                                                                                                                                                                    SHA-512:5E78696E68FD13F1C45D880E49D121A7761CC5747060ADA0756D805B9DB6816DBE7054C88EC5BA0ED4C05D8EA019388195520A4B231E36F47BE99C542108481A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Chihuahua) {.. {-9223372036854775808 -25460 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {820476000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {883634400 -21600 0 CST}.. {891766800 -21600 0 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -25200 0 MST}.. {1143968400 -
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):192
                                                                                                                                                                                    Entropy (8bit):4.844590153688034
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE9WtEaQXs+IAcGEi:SlSWB9vsM3y7oDSHAIgpdN/2909qEacn
                                                                                                                                                                                    MD5:A0BF04CD77026DC1D2749848AB0EE45E
                                                                                                                                                                                    SHA1:EA0F1BC11379DF2E421675BC5DE4805CE94B96D6
                                                                                                                                                                                    SHA-256:C8CBF5A29CC1D0827390CA6E98B2EFCF90743C6DD0ECA143B300050DD4164041
                                                                                                                                                                                    SHA-512:61968B4E42ECC60C801F959D18D13187AD39D9B81FA1A947F6B6862F99D73E3A30849AC4233DB5705D46F5373C42D8748B15BE9B82822971B4F47E601E5766D8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Coral_Harbour) $TZData(:America/Panama)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):219
                                                                                                                                                                                    Entropy (8bit):4.78887878252354
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7/MSHAIgp/M1ovN/29093+90/M7:MByMY/M7p/M16t290c90/M7
                                                                                                                                                                                    MD5:C7CCF5CEC7AA60D6063D1C30F4263ADC
                                                                                                                                                                                    SHA1:FD8E9AEEEE50656FD3C694CA051895DDC8E5590B
                                                                                                                                                                                    SHA-256:28B84710EADEF7AD5E7FA63EF519A9D93996D3BB91DD9018333DE3AC4D8FB8DD
                                                                                                                                                                                    SHA-512:6974F8B238977EE5222368C4B79327BB240580819FCA082261D6994781144D81E2E8843B4F1C9D07EFBEE27311C8930BDAC9C0D6D6718F6FB1600D0000576CDE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Cordoba) $TZData(:America/Argentina/Cordoba)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):431
                                                                                                                                                                                    Entropy (8bit):4.506976345480408
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290lnmdHd5CvZN/Mi3yvI8/uF+wSJz/uF+IA/uF+i/X8/uF+ZDVxNv:5mnedIvZN/e5S+w+S+LS+i0S+pB
                                                                                                                                                                                    MD5:0446EF1A6985A62EDFFB9FFAC7F1DE0E
                                                                                                                                                                                    SHA1:A43468E120E585E2DCC20205BA1D1E2CCB6C0BC2
                                                                                                                                                                                    SHA-256:E3061DC6FA9F869F013351A9FDF420448592D7F959C2B4404093432508146F7E
                                                                                                                                                                                    SHA-512:86D41B0C49489572C3EAEDD5466AA92319C721CCEC9437EBB0F2AAD772FB5ED91A2F2061E00448FB48096B0BAAE9A4E1E644F8AF595B76BE05DBC0C801E6D6ED
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Costa_Rica) {.. {-9223372036854775808 -20173 0 LMT}.. {-2524501427 -20173 0 SJMT}.. {-1545071027 -21600 0 CST}.. {288770400 -18000 1 CDT}.. {297234000 -21600 0 CST}.. {320220000 -18000 1 CDT}.. {328683600 -21600 0 CST}.. {664264800 -18000 1 CDT}.. {678344400 -21600 0 CST}.. {695714400 -18000 1 CDT}.. {700635600 -21600 0 CST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.8664633847782905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/2IAcGE9mM7x/h4y:SlSWB9vsM3y7OBHAIgpONYyHN/2909vr
                                                                                                                                                                                    MD5:0757DD22C0E297CCE8E6678ECA4B39C7
                                                                                                                                                                                    SHA1:81B31299F9A35C8BA2EC1F59EC21129FFCDCD52F
                                                                                                                                                                                    SHA-256:A01DDB460420C8765CE8EF7A7D031ABD7BDB17CFA548E7C3B8574C388AA21E17
                                                                                                                                                                                    SHA-512:F1AFC0F6371A10E4CB74FB2C8985610AEE6C3511861BC09384EDC99D250E9099A1F4430BFC3B0B396C2702BF9991A5A4ECFD53A82C92883460715FA2C1E04579
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:America/Creston) $TZData(:America/Phoenix)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2912
                                                                                                                                                                                    Entropy (8bit):3.588248620238414
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5tSeSFESoSQSrSsCSeSPS1cSQSQlSsSyZS2SqLSwZS4vSoSUSLpSzS4X3/SxS1S4:rVsE3LMuJALTvn1ZdP7ZbvLfeAh+KIil
                                                                                                                                                                                    MD5:264E0CEA9491B404993594E64F13479F
                                                                                                                                                                                    SHA1:6D4D277FA470A2C7AD0A59B5DA3CC15BEEB74E78
                                                                                                                                                                                    SHA-256:2D8281CF3FD9E859C5206F781E264854FA876CB36562A08C6C01343C65F8A508
                                                                                                                                                                                    SHA-512:759C19B4DD0E1F7F1176872806BFB1F17ADF9C992E41B96FEA67D77DD67E9DD3C1683E3B6D27FB092C731F534C6A7441BACFFF0301907217A064523B86992E23
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cuiaba) {.. {-9223372036854775808 -13460 0 LMT}.. {-1767212140 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200 -1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):201
                                                                                                                                                                                    Entropy (8bit):4.876961543280111
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2909C4e90ppv:MByMYbpwt290690b
                                                                                                                                                                                    MD5:9459043060E33E8EDC74E78332E96EDF
                                                                                                                                                                                    SHA1:27963FE063965584D0F226BAE9A08EB2954398F0
                                                                                                                                                                                    SHA-256:ACCF08CF53C9431E226714DF8BEDE3C91BAF62D5BD7B98CA8B50D7258124D129
                                                                                                                                                                                    SHA-512:215D9AFAA7227F4447177CE2ABA5A6F7F2F46A9D787845DD32F10D5C22BF9CBE4047AF5E0E66FA7A4F70EEE064A7EC7B67949E565C3C5C60C31F3C19D6915D76
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Curacao) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1128
                                                                                                                                                                                    Entropy (8bit):3.8794180227436557
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5geNrmFQqFi77FkiVFw1ZFt9SFUXDFH9vMF0mFdS/FyMF8AWXF7HFEJF7cSXHVFS:5/vx7O11pbzvZ+S0xAqe12vey
                                                                                                                                                                                    MD5:6E37A78AC686A6B48A78541E1900E33C
                                                                                                                                                                                    SHA1:D41F39FDB6D45921B57341E95A006251B4875961
                                                                                                                                                                                    SHA-256:968C56F1D0106E1D92C7B094EEF528B6EE1FFA3D7A18BE2F2BA59178C2C0F1E0
                                                                                                                                                                                    SHA-512:397623149D95FF9A094750EE697F62DF90124BBBE407FB49FBAE335A61629449F2A61EF4471DBD57745B323DFCF3628611CAE9295F2EF7E4A7412A697651FF68
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Danmarkshavn) {.. {-9223372036854775808 -4480 0 LMT}.. {-1686091520 -10800 0 -03}.. {323845200 -7200 0 -02}.. {338950800 -10800 0 -03}.. {354675600 -7200 1 -02}.. {370400400 -10800 0 -03}.. {386125200 -7200 1 -02}.. {401850000 -10800 0 -03}.. {417574800 -7200 1 -02}.. {433299600 -10800 0 -03}.. {449024400 -7200 1 -02}.. {465354000 -10800 0 -03}.. {481078800 -7200 1 -02}.. {496803600 -10800 0 -03}.. {512528400 -7200 1 -02}.. {528253200 -10800 0 -03}.. {543978000 -7200 1 -02}.. {559702800 -10800 0 -03}.. {575427600 -7200 1 -02}.. {591152400 -10800 0 -03}.. {606877200 -7200 1 -02}.. {622602000 -10800 0 -03}.. {638326800 -7200 1 -02}.. {654656400 -10800 0 -03}.. {670381200 -7200 1 -02}.. {686106000 -10800 0 -03}.. {701830800 -7200 1 -02}.. {717555600 -10800 0 -03}.. {733280400 -7200 1 -02}.. {749005200 -10800 0 -03}.. {764730000 -72
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2967
                                                                                                                                                                                    Entropy (8bit):3.9564096415565855
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5IeVvxBn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5zxKKpj/AOZFCARCeQbvb5wxMN6Ix
                                                                                                                                                                                    MD5:F494405F3B250668BE00DC3864B9A2DC
                                                                                                                                                                                    SHA1:20843AD6D95DD5D5950E2946BCAE4ECE2B676F70
                                                                                                                                                                                    SHA-256:30E875343C81C8DE473E6313A27C55315F38E7CCDBD2CEE5783EC54D269D5807
                                                                                                                                                                                    SHA-512:9102BD114436D5FE5A1942E31AE692ECE41F910AC1B6E52C02283801D5AA00CFF22D980C61E69928267D3DD34331E301C7324CA631B71AC2FBBDE06D7914F849
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Dawson) {.. {-9223372036854775808 -33460 0 LMT}.. {-2188996940 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800 0 P
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1940
                                                                                                                                                                                    Entropy (8bit):4.024810417421672
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5/eUv5wk7Zw9JmnRsw78wP+7bw+7zwN7SynwpBZ7Fwk47H+wW73wo5775w572Iwl:5DuY/YRRvkGZ+R64CjSUlTGS
                                                                                                                                                                                    MD5:7868720D39782147B2BD6B039A5BF7E0
                                                                                                                                                                                    SHA1:6F66404E5CCFF7F020269A316D792D5E7AD4C280
                                                                                                                                                                                    SHA-256:540804BECDEAB92340EF02D32A62BFD550B71A3DB8D829BE426EE4D210004643
                                                                                                                                                                                    SHA-512:9CCD124FF954CA2988F07286FFE9ED740E0CEF5F4D76BF090367B74A577E91BF5590EDFE12AFC83ACF5CBFC88C5A68867C58082A2777D08C326A7B18889B08E2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Dawson_Creek) {.. {-9223372036854775808 -28856 0 LMT}.. {-2713881544 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-725817600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400082400 -25200 1 PDT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8920
                                                                                                                                                                                    Entropy (8bit):3.8540632258197514
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:gjGtwmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:gUwDPlLv/PCenJzS6cy
                                                                                                                                                                                    MD5:0D649599A899ECB3FCF2783DCEE3E37B
                                                                                                                                                                                    SHA1:ACC796BE75F41A12FB1F8CCBD2B2839AF9876FFE
                                                                                                                                                                                    SHA-256:3FE2EE8C05C5D6F268B58BD9FC3E3A845DEA257473B29F7B3FB403E917448F3C
                                                                                                                                                                                    SHA-512:C10D41AB95439B8E978F12F9F58D1ACC9AD15404123FA5FBA0D1CC716E5CF5DA6BD2252450055AC3998DBCB8DD49F7A82ACD53413E3EE78CDA2C42F603DE2C56
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Denver) {.. {-9223372036854775808 -25196 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-1577898000 -25200 0 MST}.. {-1570374000 -21600 1 MDT}.. {-1551628800 -25200 0 MST}.. {-1538924400 -21600 1 MDT}.. {-1534089600 -25200 0 MST}.. {-883587600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-757357200 -25200 0 MST}.. {-147884400 -21600 1 MDT}.. {-131558400 -25200 0 MST}.. {-116434800 -21600 1 MDT}.. {-100108800 -25200 0 MST}.. {-94669200 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -2
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8430
                                                                                                                                                                                    Entropy (8bit):3.826664943157435
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:SGiS1A5tCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:SG/K5ItON0HY2iUmUFLqU
                                                                                                                                                                                    MD5:2BBA922E9377D257CBDF6E1367BBB1A2
                                                                                                                                                                                    SHA1:6F33A44834E8041E78660A326A5DDAF3D7F9DC2A
                                                                                                                                                                                    SHA-256:84F6897B87D3978D30D35097B78C55434CE55EB65D6E488A391DFC3B3BB5A8FE
                                                                                                                                                                                    SHA-512:D225824945C08A3521A8288B92B26DFFA712ED3505E72DEDE4A7D1777E58DEA79ADF3F042D22624E4142DD4203BAA4DFF8EB08B7033FDF00059F6C39954EA1A1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Detroit) {.. {-9223372036854775808 -19931 0 LMT}.. {-2051202469 -21600 0 CST}.. {-1724083200 -18000 0 EST}.. {-883594800 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-757364400 -18000 0 EST}.. {-684349200 -14400 1 EDT}.. {-671047200 -18000 0 EST}.. {-80506740 -14400 0 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {94712400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {157784400 -18000 0 EST}.. {167814000 -14400 0 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):202
                                                                                                                                                                                    Entropy (8bit):4.86856578093135
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290TL3290ppv:MByMYbpwt290Tr290b
                                                                                                                                                                                    MD5:398D8DBB24CEA2D174EF05F63869C94A
                                                                                                                                                                                    SHA1:6D0E04165952E873E6ECA33A0E54761B747F0A98
                                                                                                                                                                                    SHA-256:3DA98AA7D3085845779BE8ED6C93CCBDA92191F17CA67BBF779803E21DA2ABF3
                                                                                                                                                                                    SHA-512:2652AFD1A3F8A4B84078A964005FE10C64491EC2D47CDE57D5066D07D1D837308FD696F53B9E7B6B0E72F86F9A85128B8CBF5F302F91EADE6D840DF946DE85CD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Dominica) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8600
                                                                                                                                                                                    Entropy (8bit):3.8579895970456137
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:7SabOGaLm911sF7Lv/PCewtA8CzSPyDLbrcUia:7vf4lLv/PCenJzS6cy
                                                                                                                                                                                    MD5:EBD169ECA4D45EED28BF7B27809361BC
                                                                                                                                                                                    SHA1:E89C8484A29D792FB6349CFDFDD30C2FA6B78B6B
                                                                                                                                                                                    SHA-256:026D51D73D30A3710288F440E0C337E44E3A14D0AA2D7B6C6E53AF43FC72A90C
                                                                                                                                                                                    SHA-512:45C936ED7D4AF95261180547013454AAEC9FA7672B52AC6077DD99D9FEB6DDD57652FE4EC67BF81F1588384F3027A1872E0C72D9CAEB980B66D2CB6EE9B8ABB0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Edmonton) {.. {-9223372036854775808 -27232 0 LMT}.. {-1998663968 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1600614000 -21600 1 MDT}.. {-1596816000 -25200 0 MST}.. {-1567954800 -21600 1 MDT}.. {-1551628800 -25200 0 MST}.. {-1536505200 -21600 1 MDT}.. {-1523203200 -25200 0 MST}.. {-1504450800 -21600 1 MDT}.. {-1491753600 -25200 0 MST}.. {-1473001200 -21600 1 MDT}.. {-1459699200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {136371600 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {167821200 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {23072
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1230
                                                                                                                                                                                    Entropy (8bit):3.7989525000422963
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5OXUepdkZss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6w:5OXCZsMw57XJh4CxUF/A6GTrtSUUhfL0
                                                                                                                                                                                    MD5:6766E75702D8C2D1C986DFCEFCE554F9
                                                                                                                                                                                    SHA1:39553F80D82BC0134FAF70C9830B96BDCBCEFF1C
                                                                                                                                                                                    SHA-256:48FC987E5999EA79F24797E0450FE4DAB7CF320DFAD7A47A8A1E037077EC42C9
                                                                                                                                                                                    SHA-512:A812D0D4254BB0B7DB7AE116652D2A8F97D22C59F2709A17D1CE435FCFB38B807A4E0ED6EA114A66897E29D85226875FA84D28B254A5D17BD1CBA95FAD8349B7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Eirunepe) {.. {-9223372036854775808 -16768 0 LMT}.. {-1767208832 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {571204800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):279
                                                                                                                                                                                    Entropy (8bit):4.760311149376001
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/29078iPDm2OHvJ4YoHxHhgdrV/uF+IcmJ3/uF+ivNv:MB8629078AmdHx4YCJSB/uF+QV/uF+w9
                                                                                                                                                                                    MD5:CEF7277443EB6990E72C7EA7F79A122C
                                                                                                                                                                                    SHA1:1D3FEA364B3DC129DE3998A1455D5588EBAA6FF8
                                                                                                                                                                                    SHA-256:C02C6E79398553BD07BEA0BE4B7F0EBDD8BC821595909CFFB49DE4290A0D1D0F
                                                                                                                                                                                    SHA-512:E6FC530B2CCF010B8D38BC3F49A6859B5C68F4AB604E6305CE75FBE4FC9FF3FCD0187DEBEF6DAE652EEF9695568DBDE31F426E404CC3CC206D78183E0D919234
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/El_Salvador) {.. {-9223372036854775808 -21408 0 LMT}.. {-1546279392 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.836337676384058
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qfSfXHAIg20qfORL/2IAcGE7JM7QIAcGEqfBn:SlSWB9vsM3y7ekHAIgpeON/2907390eB
                                                                                                                                                                                    MD5:005D9C0E50291616A727CFB74A9FD37E
                                                                                                                                                                                    SHA1:846AE6720382B4F67B37B4256E45246C81DAF899
                                                                                                                                                                                    SHA-256:3E363BF82545F24CCE8CFA6EEC97BA6E1C2A7730B2A9CE6C48F784821D308A5D
                                                                                                                                                                                    SHA-512:452326D11D01825764BC40A77D17444D822F3AA202582233DD8B122798478FA83E3A27A02508EAC4CF0C7922AC2563742D773AA870562AE496B34FBB41FBAD63
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Ensenada) $TZData(:America/Tijuana)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4578
                                                                                                                                                                                    Entropy (8bit):3.8944281193962818
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5QIgsB/YRRvkGZ+R64CjSUlTG5Al5pj/A1ZFCARCeQbvb5+:6IgzR864CjSETG5sjgZkR/bvt+
                                                                                                                                                                                    MD5:4A4E023F635C4202018EA9E8F85B5047
                                                                                                                                                                                    SHA1:38E121FE2D419413E9E791B6C22BFC8D9F7554BC
                                                                                                                                                                                    SHA-256:AB15023807E7C7D1026C9970D190F1B405D48952464025242C2BB6C6BBB8391A
                                                                                                                                                                                    SHA-512:F10D21A2C841224879D1C817FC7F477DF582E1BC3603666B55199C098D51D1D5429F8C088C1083C07FC7588AE5C42A1DFBCC6B7C636AD1BE84ED657807A229E5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Fort_Nelson) {.. {-9223372036854775808 -29447 0 LMT}.. {-2713880953 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-725817600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):231
                                                                                                                                                                                    Entropy (8bit):4.778858143786314
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/290HXYAp4903GK8:MByMY3GK7Kp3GKnt290Hz4903GK8
                                                                                                                                                                                    MD5:24C369A3091452DCA7AAEBF4F48F5289
                                                                                                                                                                                    SHA1:2C2174CB16F490689E6FAC17B6D18F4A0DBD2DC9
                                                                                                                                                                                    SHA-256:C8948616262CF6990739343ABBBD237E572DB49310099E21DD8F9E317F7D11B3
                                                                                                                                                                                    SHA-512:80F579572754579706B4EEA49BF30456F3231A308E0616DC430E2428A04992412773421542E4F7FE4E4C7491BA88942FA44B49E87E95A2183211AC2AB523B231
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:America/Fort_Wayne) $TZData(:America/Indiana/Indianapolis)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1423
                                                                                                                                                                                    Entropy (8bit):3.784027854102512
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5MeajcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaIBXR8nd:5rChlvEw6kSSx5H4a8tf3fkuoYVZDNRo
                                                                                                                                                                                    MD5:E7939C9A3F83D73B82A6DE359365EFD4
                                                                                                                                                                                    SHA1:06D6E257DA7C317CAFAF6C0B04567A2453CC1660
                                                                                                                                                                                    SHA-256:C0A836BDAF07F0376B7B0833A0AB3D52BA6E3E1D6F95E247E1AD351CD1096066
                                                                                                                                                                                    SHA-512:E2BEA04084489B26ADD9A768D2580C1FF7EBAC8A3EA36818F49E85FB14E01500D59D53904F5A17F4DABEF27B4CC2FC3F977EE4C125E5CE739BBE90C130ED3B07
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Fortaleza) {.. {-9223372036854775808 -9240 0 LMT}.. {-1767216360 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8372
                                                                                                                                                                                    Entropy (8bit):3.8225708746657316
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:w4lTPB10KvnpNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/BI:wKCC
                                                                                                                                                                                    MD5:1C8B0B85BB5578E84A4867546111F946
                                                                                                                                                                                    SHA1:E08A96F5B369FA53BC1F3F839EC14FF9D334F727
                                                                                                                                                                                    SHA-256:58C207CBD9DE7A7BB15E48A62CEA9F15DA184B945133DEE88EFF29FD8B66B29E
                                                                                                                                                                                    SHA-512:54CFBF208AB3E58AFB6BEC40265A452A3C4C684D7F278F51D6495FCA544652A1A5E05BC45F600911191B33C936E5D7D43A28FD2B0884AAB9F63B7AD5EFD574A1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Glace_Bay) {.. {-9223372036854775808 -14388 0 LMT}.. {-2131646412 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-536443200 -14400 0 AST}.. {-526500000 -10800 1 ADT}.. {-513198000 -14400 0 AST}.. {-504907200 -14400 0 AST}.. {63086400 -14400 0 AST}.. {73461600 -10800 1 ADT}.. {89182800 -14400 0 AST}.. {104911200 -10800 1 ADT}.. {120632400 -14400 0 AST}.. {126244800 -14400 0 AST}.. {136360800 -10800 1 ADT}.. {152082000 -14400 0 AST}.. {167810400 -10800 1 ADT}.. {183531600 -14400 0 AST}.. {199260000 -10800 1 ADT}.. {215586000 -14400 0 AST}.. {230709600 -10800 1 ADT}.. {247035600 -14400 0 AST}.. {262764000 -10800 1 ADT}.. {278485200 -14400 0 AST}.. {294213600 -10800 1 ADT}.. {309934800 -14400 0 AST}.. {325663200 -10800 1 ADT}
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.973070790103308
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wQbSeyXHAIg20wQboAFARL/2IAcGE5GZJ4IAcGEH:SlSWB9vsM3y7lbSeSHAIgplbLFAN/291
                                                                                                                                                                                    MD5:8263D2B39C2EC3B38A179F8BAD5972DD
                                                                                                                                                                                    SHA1:18D3462F6846768E16036E860DE90FB345C93047
                                                                                                                                                                                    SHA-256:5FB2CFBA25CE2F49D4C3911AFF8E7E1FF84EFC2D01F5783772E88246BFBC56AC
                                                                                                                                                                                    SHA-512:C175CAF972459759553001D48921268E9C6268CED56021BA6339F8CE3DD032DA6180E2B82974D3DCD0DC5F21566DFDBFBE1B6CF24E5E893F2335A449452DB27F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Nuuk)]} {.. LoadTimeZoneFile America/Nuuk..}..set TZData(:America/Godthab) $TZData(:America/Nuuk)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10353
                                                                                                                                                                                    Entropy (8bit):3.864463676759425
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:zfSacO8f7/ewzlrfFj18KvnpNWMPm4bPJvSuYUHgA0G19OBYEi/B51B7/Bm6BTdW:zfSacOI7/V3SuYUHgAuCC
                                                                                                                                                                                    MD5:0D646C67105FD0525E7CCC79585CE9DF
                                                                                                                                                                                    SHA1:06D91FDD8FEEDC299E40079569372F97A9AC6F04
                                                                                                                                                                                    SHA-256:52D2478289682BF95BFB93D64D679E888C9D23C0F68DFFF7E6E34BFC44B3D892
                                                                                                                                                                                    SHA-512:FD672613C2B65E12425415630A2F489917EB80DDED41338C9AA7D5D3C6B54E52C516A32493593F518DACF22A91D7A9D2C96DB9C5F1BE2C3BB9842D274BDC04FF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Goose_Bay) {.. {-9223372036854775808 -14500 0 LMT}.. {-2713895900 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1096921748 -12600 0 NST}.. {-1072989000 -12600 0 NST}.. {-1061670600 -9000 1 NDT}.. {-1048973400 -12600 0 NST}.. {-1030221000 -9000 1 NDT}.. {-1017523800 -12600 0 NST}.. {-998771400 -9000 1 NDT}.. {-986074200 -12600 0 NST}.. {-966717000 -9000 1 NDT}.. {-954624600 -12600 0 NST}.. {-935267400 -9000 1 NDT}.. {-922570200 -12600 0 NST}.. {-903817800 -9000 1 NDT}.. {-891120600 -12600 0 NST}.. {-872368200 -9000 0 NWT}.. {-769395600 -9000 1 NPT}.. {-765401400 -12600 0 NST}.. {-757369800 -12600 0 NST}.. {-746044200 -9000 1 NDT}.. {-733347000 -12600 0 NST}.. {-714594600 -9000 1 NDT}.. {-701897400 -12600 0 NST}.. {-683145000 -9000 1 NDT}.. {-67044
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7522
                                                                                                                                                                                    Entropy (8bit):3.84007813579738
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:pGStCt/cL1BRv0HY2iU7KKdFL6Aa2K4gSLf8e:pvItOx0HY2iUmUFLqU
                                                                                                                                                                                    MD5:A17723CE27EC99D1506C45AB1531085B
                                                                                                                                                                                    SHA1:A83ED7BD09514A829CC8F2EA47BA113F5DCA1090
                                                                                                                                                                                    SHA-256:560B39485CED4C2A0E85A66EB875331E5879104187D92CB7F05C2F635E34AC99
                                                                                                                                                                                    SHA-512:110D1253D6915DB046247E4FD3BA9B881146BC3896DE779215E0CC6D1DCC59958C355441955509F5D38E3A3BA166DFD0F2F277000E9E89D6551FBEA0C16974B9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Grand_Turk) {.. {-9223372036854775808 -17072 0 LMT}.. {-2524504528 -18430 0 KMT}.. {-1827687170 -18000 0 EST}.. {284014800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}.. {483519600 -14400 1 EDT}.. {499240800 -18000 0 EST}.. {514969200 -14400 1 EDT}.. {530690400 -18000 0 EST}.. {544604400 -14400 1 EDT}.. {562140000 -18000 0 EST}.. {576054000 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607503600 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638953200 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671007600 -14400 1 EDT}.. {688543200 -18000 0 EST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):201
                                                                                                                                                                                    Entropy (8bit):4.892013473075135
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2905Qb90ppv:MByMYbpwt290Ob90b
                                                                                                                                                                                    MD5:4B9ABEA103F55509550F8B42D88E84B7
                                                                                                                                                                                    SHA1:E3AA1BCE5E260264E74F77E59C4071B7E496AB41
                                                                                                                                                                                    SHA-256:EBED070E8E67C5F12FF6E03FE508BE90789F17C793DFE61237B4045B8222580F
                                                                                                                                                                                    SHA-512:568E375464FF264C5048CB35995945BDE1D5BCC3A108B2A4D0F8389EBF18B4C58EBB1C2122F10BA777D512504A59C7EFDF6069EABD2A5DEA3189204B7F7A6EB4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Grenada) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):4.9138787435596765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2905AJLr490ppv:MByMYbpwt290qJLr490b
                                                                                                                                                                                    MD5:92B091A06198E233B73DF12DFCD818D5
                                                                                                                                                                                    SHA1:C529488D09F86755E4F22CB4F0E3013C3A1B978D
                                                                                                                                                                                    SHA-256:6CB1930532831D12057FCB484C60DB64A60A4F6D8195DAFD464826923116A294
                                                                                                                                                                                    SHA-512:55EAE03CDECAC43BEDD3AA1A32C632A46808F29FF4D97A330F818544E4D10B9E9BA909D6627C38065EB7AC8E2C395FA37797F532CCFC8AB89D4698CCDE17F985
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Guadeloupe) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):399
                                                                                                                                                                                    Entropy (8bit):4.513185345162455
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862906GGmdHKznC972f/uF+mP/uF+K67Jqd3/uF+eBxE/uF+DAWNv:5neQCgfS+6S+K67Yd3S+e0S+1
                                                                                                                                                                                    MD5:569CDE7CE1AB84C0F16A25E85A418334
                                                                                                                                                                                    SHA1:EADE79AB6EDD98C7FE8B10B480C5C530CA014F5C
                                                                                                                                                                                    SHA-256:14F6A98D602F3648C816B110F3A0BA375E1FFE8FA06BEEAB419DC1ABFA6EDCAF
                                                                                                                                                                                    SHA-512:AE2ACBF09EED857906811BE2984D6BF92BF2955A9FE2F9F3FFEBB6790902F5C2C870F8561CA13AD9CB7826EECA434BED7CFE7D0D2739996BACEE506D0EB730DC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guatemala) {.. {-9223372036854775808 -21724 0 LMT}.. {-1617040676 -21600 0 CST}.. {123055200 -18000 1 CDT}.. {130914000 -21600 0 CST}.. {422344800 -18000 1 CDT}.. {433054800 -21600 0 CST}.. {669708000 -18000 1 CDT}.. {684219600 -21600 0 CST}.. {1146376800 -18000 1 CDT}.. {1159678800 -21600 0 CST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):249
                                                                                                                                                                                    Entropy (8bit):4.745656594295655
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2905xDm2OHHjGeoHv5laITicKpKV0EX/uFhfF/KVg:MB86290jmdHHLCv5FT/gOR/uFpF/Og
                                                                                                                                                                                    MD5:DF661E312C6CE279CD6829120BE33CF2
                                                                                                                                                                                    SHA1:4ACDB31E27EF9175C5452BF95F94F9BC280A237F
                                                                                                                                                                                    SHA-256:6806AA5814BDC679C6EF653C518D2699114BE71D973F49C0864F622038DC2048
                                                                                                                                                                                    SHA-512:04E7FD01F4DAD981EE8A02487F4A889015C41D07D6DCF420183D387E2188FF3239E345B5D65FB195CA485F5C7B4AD8CFEF51FFFC11EE0C91F0C88FF7B7EF17C1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guayaquil) {.. {-9223372036854775808 -19160 0 LMT}.. {-2524502440 -18840 0 QMT}.. {-1230749160 -18000 0 -05}.. {722926800 -14400 1 -05}.. {728884800 -18000 0 -05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):248
                                                                                                                                                                                    Entropy (8bit):4.673559445766137
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2905R3SDm2OHRLx5oH8ZOXFxSyZ1yV/KMMdVVFAKFZ4KVR/ON:MB86290LGmdHBnC8ZODhyV/4d/OeZ4Ke
                                                                                                                                                                                    MD5:F06C226D8D53EF8859AD91D7EBA5959C
                                                                                                                                                                                    SHA1:E0B4E6F4ADCB10F1D79FFD928E8684FFE0C0DC5F
                                                                                                                                                                                    SHA-256:4078D2E361D04A66F22F652E3810CDF7F630CF89399B47E4EC7B1D32B400FD85
                                                                                                                                                                                    SHA-512:B4385650A0C69B7BD66415CC4BB9FCA854DBB1427E9F2D6C1D8CDB8CCEF9ECBD699C66A83A9AC289DABC5CDBB0A2B044E4097E9A2977AE1802B3BF6E2BB518CF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guyana) {.. {-9223372036854775808 -13959 0 LMT}.. {-1843589241 -14400 0 -04}.. {-1730577600 -13500 0 -0345}.. {176096700 -10800 0 -03}.. {701841600 -14400 0 -04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11124
                                                                                                                                                                                    Entropy (8bit):3.8106487461849885
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:YpQamC9XD81iWQSufutTLBCN8RWnWQ7Z/xVpmtBwXiCDLxcGMe++wzlrfFj10Kvn:2kXCvNc/1/CC
                                                                                                                                                                                    MD5:6FB9E47841FF397CE36A36C8280E2089
                                                                                                                                                                                    SHA1:DA210300DC3D94FC3D8BA0A4531341BCA5C5936C
                                                                                                                                                                                    SHA-256:01E11C7B07925D05E9E1876C310A2B87E0E80EF115D062225212E472B7A964F1
                                                                                                                                                                                    SHA-512:F61B5A8A7532BBD54A4976DF17A1C6CF51BCC6DC396482FBE169C3081AF27B6CA863F0CDE3E483C59F5A5BD3365592F6984A97173C736B41D3CEEDAD4263A4E5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Halifax) {.. {-9223372036854775808 -15264 0 LMT}.. {-2131645536 -14400 0 AST}.. {-1696276800 -10800 1 ADT}.. {-1680469200 -14400 0 AST}.. {-1640980800 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-1609444800 -14400 0 AST}.. {-1566763200 -10800 1 ADT}.. {-1557090000 -14400 0 AST}.. {-1535486400 -10800 1 ADT}.. {-1524949200 -14400 0 AST}.. {-1504468800 -10800 1 ADT}.. {-1493413200 -14400 0 AST}.. {-1472414400 -10800 1 ADT}.. {-1461963600 -14400 0 AST}.. {-1440964800 -10800 1 ADT}.. {-1429390800 -14400 0 AST}.. {-1409515200 -10800 1 ADT}.. {-1396731600 -14400 0 AST}.. {-1376856000 -10800 1 ADT}.. {-1366491600 -14400 0 AST}.. {-1346616000 -10800 1 ADT}.. {-1333832400 -14400 0 AST}.. {-1313956800 -10800 1 ADT}.. {-1303678800 -14400 0 AST}.. {-1282507200 -10800 1 ADT}.. {-1272661200 -14400 0 AST}.. {-1251057600
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8729
                                                                                                                                                                                    Entropy (8bit):3.8227313494100867
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:BEsWduCtQA/gF6Y3Umjm67yLb5RCzhV28I:BBWACb/gF6Y3UmjBy7
                                                                                                                                                                                    MD5:564980AECB32F5778422EA15E8956879
                                                                                                                                                                                    SHA1:545209C95043721C1839CCE5FEFD1A6F2DE3FE5F
                                                                                                                                                                                    SHA-256:96B62BFBF0C05CF970245597C691F89EBF631175796459642A85287F131D0215
                                                                                                                                                                                    SHA-512:25FE5DAA55E3466EAE1CDC73918F189403C3360D4E82D72D745FA04A374DE04F479AA9811D6154FC70CC8EA620F18035EA6A3074116806D4405936FA017CE8E6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Havana) {.. {-9223372036854775808 -19768 0 LMT}.. {-2524501832 -19776 0 HMT}.. {-1402813824 -18000 0 CST}.. {-1311534000 -14400 1 CDT}.. {-1300996800 -18000 0 CST}.. {-933534000 -14400 1 CDT}.. {-925675200 -18000 0 CST}.. {-902084400 -14400 1 CDT}.. {-893620800 -18000 0 CST}.. {-870030000 -14400 1 CDT}.. {-862171200 -18000 0 CST}.. {-775681200 -14400 1 CDT}.. {-767822400 -18000 0 CST}.. {-744231600 -14400 1 CDT}.. {-736372800 -18000 0 CST}.. {-144702000 -14400 1 CDT}.. {-134251200 -18000 0 CST}.. {-113425200 -14400 1 CDT}.. {-102542400 -18000 0 CST}.. {-86295600 -14400 1 CDT}.. {-72907200 -18000 0 CST}.. {-54154800 -14400 1 CDT}.. {-41457600 -18000 0 CST}.. {-21495600 -14400 1 CDT}.. {-5774400 -18000 0 CST}.. {9954000 -14400 1 CDT}.. {25675200 -18000 0 CST}.. {41403600 -14400 1 CDT}.. {57729600 -18000 0 CST}.. {73458000 -14400 1 CD
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):616
                                                                                                                                                                                    Entropy (8bit):4.348926042114513
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290e2mdH5NCtXwl3UXbTMmxL+voudQCvX70qKOV9kYNv:5Ie5k9WUuwuz/Vyu
                                                                                                                                                                                    MD5:A2192F251D5A62466AF87B90E0EC5ECF
                                                                                                                                                                                    SHA1:F86DEC1E79FA877F50DAC1B06FEA870D3C9AA741
                                                                                                                                                                                    SHA-256:7391A186F8DE1FDD5A61B3887E65DCDB4A2186BFD36BBFFB464B63D9775E922A
                                                                                                                                                                                    SHA-512:AF3E5C13397C315FA7CB7EDB97510283900414A1B9A25EC9C91115D5F80267162FDD2220D8E49D57561A4B331D70706BC0A37E8BFF0D8922CD344E3A1BCCECA5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Hermosillo) {.. {-9223372036854775808 -26632 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {915174000 -25200 0 MST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7230
                                                                                                                                                                                    Entropy (8bit):3.882344472808608
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:nys0KHK1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:nyBKHkN0HY2iUmUFLqU
                                                                                                                                                                                    MD5:7824B3F2D20F16A9DCC8E0F7DC45C1B8
                                                                                                                                                                                    SHA1:77014A0502DA1342EFA41B64C5613839B627354B
                                                                                                                                                                                    SHA-256:4B114545167326F066AB3A798180896B43AC6FDC3B80D32BCC917B5A4A2359EB
                                                                                                                                                                                    SHA-512:03F6A18C03E79E9177D16CD7AB75AC117197638370FA675BC2854A5A563021F865F3F0672B237B83098787AB9D419AC33D67F28324B1E25AD8560B5838F70807
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Indianapolis) {.. {-9223372036854775808 -20678 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1577901600 -21600 0 CST}.. {-900259200 -18000 1 CDT}.. {-891795600 -21600 0 CST}.. {-883591200 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8755
                                                                                                                                                                                    Entropy (8bit):3.8394539560522585
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:+q2KeNrdJ8SvAgahLi8hDlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:+FKUdJ8SvPaUqbA604qSBgI7DBch
                                                                                                                                                                                    MD5:8AF080A022DA0737E94742C50EAAC62E
                                                                                                                                                                                    SHA1:704F0565B53AA8A20F70B79A7958D4D07085E07A
                                                                                                                                                                                    SHA-256:F1253F5F3F5AACD1A5E1F4636DD4E083F4B2A8BD995CF3E684CDD384641849F1
                                                                                                                                                                                    SHA-512:26AAF6D24B2E2B60451E19A514533DFAEC74F01F9B1AEB9F86690669C14130D77AE1CBFB9FC9091E1CD1FC1CBC2799BB05026DB68768C3CCB960355C18D111ED
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Knox) {.. {-9223372036854775808 -20790 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-725824800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.. {-447267600 -21600 0 CST}.. {-431539200 -18000 1 CDT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7273
                                                                                                                                                                                    Entropy (8bit):3.8700915866109535
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:7qvrv7+X1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:7Kv7+bN0HY2iUmUFLqU
                                                                                                                                                                                    MD5:C1A10440E6CCE4C5052E2510182D9AA7
                                                                                                                                                                                    SHA1:56D4F3CCA1245D626BADA74CF3F6BAE8034BF58D
                                                                                                                                                                                    SHA-256:675162381639598E7100E90663D42780F8EE1CB62BD6DA5B948B494F98C02FE3
                                                                                                                                                                                    SHA-512:96B71472AD38ECFC589F935D9F5F1C8D42C8E942D8772FB6A77F9B9C0E2BD7A07FA61729E57EC02356121518E33797A784679F8DED2FCA3FC79F5C114783DD57
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Marengo) {.. {-9223372036854775808 -20723 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-599594400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {-21488400 -14400 1 EDT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7611
                                                                                                                                                                                    Entropy (8bit):3.87971256165061
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:TqervJ8SUklggahyBRP0HY2iU7KKdFL6Aa2K4gSLf8e:TpvJ8SUklvaQN0HY2iUmUFLqU
                                                                                                                                                                                    MD5:A86042668CD478AFFC05D3383EDEE8FF
                                                                                                                                                                                    SHA1:6476526F94A247C0ECF3B2813F2C5A4FB93E457E
                                                                                                                                                                                    SHA-256:23B8FA75CE0A9555DFD84549723A12679FF7FC5FAA58E4B745BA3C547071FF53
                                                                                                                                                                                    SHA-512:07A5487A087108E6D6E88580865885CA6243EF04BE8263FC913F38CADB8EA016386E8BBAD39F65FD081F1A2F14316FEAF008855E9CF2019B169D9511916AFF67
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Petersburg) {.. {-9223372036854775808 -20947 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-473364000 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 1 CDT}.. {-257965200 -21600 0 CST}.. {-242236800 -18000 1 CDT}.. {-226515600 -21600 0 CST}.. {-210787200 -18000 1 CDT}.. {-195066000 -21600 0 CST}.. {-179337600 -18000 1 CD
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7100
                                                                                                                                                                                    Entropy (8bit):3.8613085681914607
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:yqxrvJ8SUklLgzNA604qSScBgN+4ctDzIVQ/c/3hNxTh:yUvJ8SUkl8BA604qSBgI7DBch
                                                                                                                                                                                    MD5:E7FE9B7CFBC6505C446056967DEBC87B
                                                                                                                                                                                    SHA1:81ADAD89F040F62E87D2F26D1D98B3E52710F695
                                                                                                                                                                                    SHA-256:D368123DB703B55244700876906775837D408C274C5A5801D80B77EADB6D5853
                                                                                                                                                                                    SHA-512:9C0746DE18C80B548AA443D59BB9971BDC304975717C5FCDEBDE72828ACF408FA1D687F87C42E7B8D6D0284C9F792EA236BF79C815947BE773D07364B630AC99
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Tell_City) {.. {-9223372036854775808 -20823 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 1 CDT}.. {-257965200 -21600 0 CST}.. {-242236800 -18000 1 CDT}.. {-226515600 -21600 0 CST}.. {-210787200 -18000 1 CDT}.. {-195066000 -21600 0 CST}.. {-179337600 -18000 0 EST
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6563
                                                                                                                                                                                    Entropy (8bit):3.866646181493734
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:juqv01BRP0HY2iU7KKdFL6Aa2K4gSLf8e:CoKN0HY2iUmUFLqU
                                                                                                                                                                                    MD5:2CCFC3980C321ED8A852759C0BCCB12C
                                                                                                                                                                                    SHA1:A8BFE02E4E71B28EF8E284E808F6EDE7C231F8FF
                                                                                                                                                                                    SHA-256:0623233AA39A1A82038A56DF255ADF49E648777375B8499491C8897EBEA1CDF1
                                                                                                                                                                                    SHA-512:A4C77689BC9BF871C756D05BAC4157F0FD324D10AC7D15F3543344C6F8C7FC9218AB7ADFBCE70C8ECCDD6EC15FD7960503FC7A8223FECE6D4227BF0BB04190C7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Vevay) {.. {-9223372036854775808 -20416 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-495043200 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {94712400 -18000 0 EST}.. {1136091600 -18000 0 EST}.. {1143961200 -14400 1 EDT}.. {1162101600 -18000 0 EST}.. {1173596400 -14400 1 EDT}.. {1194156000 -18000 0 EST}.. {1205046000 -14400 1 EDT}.. {1225605600 -18000 0 EST}.. {1236495600 -14400 1 EDT}.. {1257055200 -18000 0 EST}.. {1268550000 -144
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7226
                                                                                                                                                                                    Entropy (8bit):3.879195938909716
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Vq8rdJ5UklpRBRP0HY2iU7KKdFL6Aa2K4gSLf8e:VbdJ5Uklp/N0HY2iUmUFLqU
                                                                                                                                                                                    MD5:56D1930F5FAE2456DEC6C9AB1B0233E1
                                                                                                                                                                                    SHA1:F6ED52EF769DF2C015C181BCFF3DC0E24497C768
                                                                                                                                                                                    SHA-256:B8452B6AA739A78AC6D03806463B03D4175639593E19FAA3CA4B0D0FB77F18C9
                                                                                                                                                                                    SHA-512:AFCFF383DB441DA9154B639A88700D0604F487A20E830146B14061E485A991AD8DC279AF8C0C2329265CF14C901207B9058157FAA1C039082EB7630916834156
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Vincennes) {.. {-9223372036854775808 -21007 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-289414800 -21600 0 CST}.. {-273686400 -18000 1 CDT
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7410
                                                                                                                                                                                    Entropy (8bit):3.8775722319777968
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:uq0KeKrv7c1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:unKxv7yN0HY2iUmUFLqU
                                                                                                                                                                                    MD5:880526DC23E7BDB00506D7EC2A885907
                                                                                                                                                                                    SHA1:DB3B13A2A4BF80E7B71C7F0604A0A80EF070B9BA
                                                                                                                                                                                    SHA-256:4B293FDB7680C4597B8C885333719214492ECF09BD5EA342D1EC15F2BF9C8605
                                                                                                                                                                                    SHA-512:42EEDC5EA28781D62A457F4843F38D0A3FEFCAD83BA01B07CEF0FA169C6440960E04BABD272C5E9AF2F4B0DBB2A786EF9221A48F084F16752E6D0EA66C31911E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Winamac) {.. {-9223372036854775808 -20785 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):233
                                                                                                                                                                                    Entropy (8bit):4.7047837427916095
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/2903GfJ4903GK8:MByMY3GK7Kp3GKnt2903GfJ4903GK8
                                                                                                                                                                                    MD5:DEE404D54FD707C4A27F464B5F19D135
                                                                                                                                                                                    SHA1:AD95D04738F6B15A93DED1DE6B5FA9F47C8E38CB
                                                                                                                                                                                    SHA-256:437DA148B94DBA4CEA402169878541DB9C3419ABAB6750D1C36625DD3053019E
                                                                                                                                                                                    SHA-512:421D6AF30F0C64EA6CB9F9DC4E7EF9E8EE5945F81A5E82A6D959D32AD69F325770DB6A07D8F52EFE7EE7F6C3AD4E1F34AA30A6B5E006C928119A54E746D6FE6B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:America/Indianapolis) $TZData(:America/Indiana/Indianapolis)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7638
                                                                                                                                                                                    Entropy (8bit):3.8629745113156004
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/nGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:/GPlLv/PCenJzS6cy
                                                                                                                                                                                    MD5:DBF9C2CCF786A593C9D6E4F4BB37ACE9
                                                                                                                                                                                    SHA1:4D2332A530A36E6DB2802DD9FA2DAF5C0594D5EA
                                                                                                                                                                                    SHA-256:5A1F7F5EDAD0251B73C33E7B5DDEE194646E9D3992B169DC1A64D155765D472C
                                                                                                                                                                                    SHA-512:70D75371497CED3B6C731C95299CDD5F8F49C3C6EEDDF31EB05D008769D76ACFE8BFA9A2ECE45BD0BA2E279BBEF65945955791EFC04A569F5CAA13665CD2545F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Inuvik) {.. {-9223372036854775808 0 0 -00}.. {-536457600 -28800 0 PST}.. {-147888000 -21600 1 PDDT}.. {-131558400 -28800 0 PST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}.. {671014800 -21600 1 MDT}.. {688550400 -25200 0 MST}.. {702464400 -21600 1 MDT}.. {7200000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7671
                                                                                                                                                                                    Entropy (8bit):3.832645570123566
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:7FE5Ct/cQ1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:7FEct/N0HY2iUmUFLqU
                                                                                                                                                                                    MD5:8020712BBA127EA8AB52E8F5DB14286E
                                                                                                                                                                                    SHA1:DAEBC76FE10770D3FC2B5E1C14823B2B5543BA35
                                                                                                                                                                                    SHA-256:AFC4627879F4A618F5E3BA9EA123F3212E161F4CCFD0DF46F3B6B7CD2E2C0D7E
                                                                                                                                                                                    SHA-512:2F5C63F427A5DEDD5BF2B3867BE4C13774E9276C1472BF4170BCB2DA462B848CC8088743D032765133EE138388DF4217E4FC1475B12D2C8AF657A45ED6FEDE93
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Iqaluit) {.. {-9223372036854775808 0 0 -00}.. {-865296000 -14400 0 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-147898800 -10800 1 EDDT}.. {-131569200 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}.. {483519600 -14400 1 EDT}.. {499240800 -18000 0 EST}.. {514969200 -14400 1 EDT}.. {530690400 -18000 0 EST}.. {544604400 -14400 1 EDT}.. {562140000 -18000 0 EST}.. {576054000 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607503600 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638953200 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671007600 -14400 1 EDT}.. {688543200 -18000 0 EST}.. {7024
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):847
                                                                                                                                                                                    Entropy (8bit):4.206296468996689
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5seRvZGjFS/uk1p/uue/udYR/u+zN5hi/uW9/uoUF0/u8Bb/u33RU/uMZ8/unuR3:5jUjFo1pFGzfAYFqB43RMER3
                                                                                                                                                                                    MD5:95B59E3EA2A270A34BDF98AA899203C8
                                                                                                                                                                                    SHA1:93599597797F4BAFE5C75179FB795058B1E3527D
                                                                                                                                                                                    SHA-256:4B9D5177CBA057CD53D53120A49B8A47ECCB00150018581A84851E9D5437D643
                                                                                                                                                                                    SHA-512:032BC07F9E92B756A0732AECC2DFEC4C89A58B3D6D3CA57A0F99F2AD1D51676804C7B6CE50EB3B37BB8A1EF382168AC83989D609D37C57308E29B51F1FDEFB1E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Jamaica) {.. {-9223372036854775808 -18430 0 LMT}.. {-2524503170 -18430 0 KMT}.. {-1827687170 -18000 0 EST}.. {126248400 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {441781200 -18000 0 EST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):211
                                                                                                                                                                                    Entropy (8bit):4.94277888588308
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7/MI6HAIgp/MIwRN/290pPGe90/MIz:MByMY/Myp/M9Rt290h390/M4
                                                                                                                                                                                    MD5:E020D4F9CB1AF91D373CD9F3C2247428
                                                                                                                                                                                    SHA1:0ADF2E9F8D9F8641E066764BA1BAF068F0332CE9
                                                                                                                                                                                    SHA-256:4A0495852CD4D0652B82FB57024645916DB8F192EEF9A82AFD580D87F4D496ED
                                                                                                                                                                                    SHA-512:03190F0E7EC35A358670B1617CB5C17EA3DD41195B2C4B748479D80ABAB4DB395293F688D94B87662D0469F6C5885CF7E7C9A995493A191905753F740DF659E1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Jujuy)]} {.. LoadTimeZoneFile America/Argentina/Jujuy..}..set TZData(:America/Jujuy) $TZData(:America/Argentina/Jujuy)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8682
                                                                                                                                                                                    Entropy (8bit):3.9620285142779728
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/fCG0rHPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:/aG0rq9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                    MD5:8160A0D27EECEF40F6F34A06D5D02BE6
                                                                                                                                                                                    SHA1:7CAA64F83BAA0C23EE05A72BB1079AA552FA2F3D
                                                                                                                                                                                    SHA-256:5FBE6A1FA2D3DFE23C7378E425F32BEBCA44735DA25EA075A7E5CE24BFD4049D
                                                                                                                                                                                    SHA-512:59B8D04595007B45E582E6D17734999074CA67A93F5DF742EFE1EB78DB8ABD359D4C3B213B678C6A46040A13AAB709A994B6A532D720D3EF6FCA2730ABF4885E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Juneau) {.. {-9223372036854775808 54139 0 LMT}.. {-3225223727 -32261 0 LMT}.. {-2188954939 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {309949
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9553
                                                                                                                                                                                    Entropy (8bit):3.853353361425414
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:tfTwKdrdJ9+StCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:tfUKNdJ9+SItON0HY2iUmUFLqU
                                                                                                                                                                                    MD5:D721B38F1FFF1A6F5C02B72ECC06CDE5
                                                                                                                                                                                    SHA1:E70D99A9FC1DA9F30389129EE00FE20FA79D66A8
                                                                                                                                                                                    SHA-256:9EB1F2B19C44A55D6CC9FD1465BAF6535856941C067831E4B5E0494665014BF5
                                                                                                                                                                                    SHA-512:3C82A8C27026228F359FD96A4306F1BC337DE655FD1BA02C4399162E44DE59AD58CE569DA5AEA36E586C3BDEE7256420AABB84B44D277E244FE5AD771B4BE307
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Kentucky/Louisville) {.. {-9223372036854775808 -20582 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1546279200 -21600 0 CST}.. {-1535904000 -18000 1 CDT}.. {-1525280400 -21600 0 CST}.. {-905097600 -18000 1 CDT}.. {-891795600 -21600 0 CST}.. {-883591200 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747251940 -18000 1 CDT}.. {-744224400 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8558
                                                                                                                                                                                    Entropy (8bit):3.869494272122571
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:4F8qMahLi8hR1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:4F8HaUqJN0HY2iUmUFLqU
                                                                                                                                                                                    MD5:AED6497590DA305D16AC034979C8B1E9
                                                                                                                                                                                    SHA1:AD6F1788310A3A5A761873FEF1A32416B7DBCA89
                                                                                                                                                                                    SHA-256:1C6C7FB0AE628EB6BB305B51859C4E5594A6B0876C386ED9C1C3355E7CB37AE1
                                                                                                                                                                                    SHA-512:58D960AB5F2D9F8E4DD0171E5E36CE2E072F74A7AFDBC43F9340BBCF0CDC0D060AC895F9FCF551F4CC7EB6DBF2E9835C8C3D58E87CA4FBC98C720F51C462EDCD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Kentucky/Monticello) {.. {-9223372036854775808 -20364 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-63136800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):4.8670778268802195
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y73GKaHAIgp3GKIN/2901iZ903GKT:MByMY3GKDp3GKIt290Q903GKT
                                                                                                                                                                                    MD5:50434016470AC512A8E2BEBA0BCEBC15
                                                                                                                                                                                    SHA1:F3541F6EE201FA33C66042F5C11A26434D37D42C
                                                                                                                                                                                    SHA-256:D66E77E6FF789D4D6CA13CDB204B977E1FE64BE9AFEE7B41F2C17ED8217FD025
                                                                                                                                                                                    SHA-512:EB1FF97050B7E067DCB68FF7C8F912C8A0C02144BB8E2EAA58C1136C6CC4A2B98C897DD23BB1E9C82D9AF6D028EE45227F97676CB34B6B830CDF5D707B990E57
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Knox)]} {.. LoadTimeZoneFile America/Indiana/Knox..}..set TZData(:America/Knox_IN) $TZData(:America/Indiana/Knox)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):4.9362668992592456
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/2901Qv090ppv:MByMYbpwt290ev090b
                                                                                                                                                                                    MD5:FE9CEC6C50DF451B599B98AE8A434FF7
                                                                                                                                                                                    SHA1:60F997825766662B2C5415FBE4D65CEA6D326537
                                                                                                                                                                                    SHA-256:5AF9B28C48661FDC81762D249B716BA077F0A40ECF431D34A893BB7EABA57965
                                                                                                                                                                                    SHA-512:1311605021871BAFAF321AA48B352262C6BA42149101CCD4FDD4000435B2584AC564E0F76D481BB181767C010FD922BAA4E4EBB401AC2FF27B21874D89332872
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Kralendijk) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):218
                                                                                                                                                                                    Entropy (8bit):4.902526230255025
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/290WDm2OHphvoHvKZdcyFXmBVVON:MB86290ymdHphvCvKfcyy/ON
                                                                                                                                                                                    MD5:3BC04900A19D0152A31B353C6715A97B
                                                                                                                                                                                    SHA1:58A6D49E0B6FA00CBEAFD695D604D740AD63C54E
                                                                                                                                                                                    SHA-256:5488D98AA3C29D710C6AF92C42ACE36550A5BFF78C155CDF8769EE31F71CF033
                                                                                                                                                                                    SHA-512:65302935090F98A81443A1E1158911F57C3A1564564CD401CA72DDBF66D967DB564EF5AE8A4083D83984B9EF55AB53159010EFE2DB5D7A723F7EA61A1795322D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/La_Paz) {.. {-9223372036854775808 -16356 0 LMT}.. {-2524505244 -16356 0 CMT}.. {-1205954844 -12756 1 BST}.. {-1192307244 -14400 0 -04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):460
                                                                                                                                                                                    Entropy (8bit):4.2444415392593875
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290B2mdH4VCvvCOt/Os/OCQXR/uFfC3/O3e/uFbs/OX/OqF/O+8/OOS1F5/D:59etvqOVLOR/uGD/utsg38xSP5r
                                                                                                                                                                                    MD5:5F41E848D2DDE91261F45CB577B1B0A9
                                                                                                                                                                                    SHA1:DF284499CF57479ADE5E1D3DC01D6DCCF6AFDFE1
                                                                                                                                                                                    SHA-256:6E01002F264DF9A6FC247F95399F4F42DCCC7AB890B0C259DE93DCC97DEC89CE
                                                                                                                                                                                    SHA-512:2F5472F812734E892182632B8A34A4AD7B342541D0C3F1107BD95FFBE25D9351A0CDF5F58F35A1F37365DDF8A8A5D883C89C3CC40A9AD09D54CA152DC6BE1A09
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Lima) {.. {-9223372036854775808 -18492 0 LMT}.. {-2524503108 -18516 0 LMT}.. {-1938538284 -14400 0 -05}.. {-1002052800 -18000 0 -05}.. {-986756400 -14400 1 -05}.. {-971035200 -18000 0 -05}.. {-955306800 -14400 1 -05}.. {-939585600 -18000 0 -05}.. {512712000 -18000 0 -05}.. {544248000 -18000 0 -05}.. {638942400 -18000 0 -05}.. {765172800 -18000 0 -05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9726
                                                                                                                                                                                    Entropy (8bit):3.8515163794355916
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:/uX68CWSgG0U9bFzN6IkWq/WHQt/RY4yP:/uX68CWSgGVbGBt/M
                                                                                                                                                                                    MD5:4D4F198238E4E76753411896239041C3
                                                                                                                                                                                    SHA1:AD41D199DF0B794B5AB7F165C8A141787FAAC9A9
                                                                                                                                                                                    SHA-256:DA3F7572F04E6AE78B8F044761E6F48D37EE259A9C1FE15A67072CC64A299FDB
                                                                                                                                                                                    SHA-512:BA39D174B73B1D4B09E8AC07291BED0B9658A4330AE50881080F0E37C35BD8A6F55C49F1D649ED1F19CE47002435D8724048759DFC813BF9C2E9B06B581486FF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Los_Angeles) {.. {-9223372036854775808 -28378 0 LMT}.. {-2717640000 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-687967140 -25200 1 PDT}.. {-662655600 -28800 0 PST}.. {-620838000 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589388400 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557938800 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526489200 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):228
                                                                                                                                                                                    Entropy (8bit):4.911677030377383
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y71PiKp4o2HAIgp1PiKp4BvN/290hp4901PiKp44v:MByMYPyApPydt290P490Pyi
                                                                                                                                                                                    MD5:ACE87B25FE5604C83127A9F148A34C8C
                                                                                                                                                                                    SHA1:25C8D85B4740C53F40421D0DADCA95225EAB7829
                                                                                                                                                                                    SHA-256:F85C1253F4C1D3E85757D3DEA4FD3C61F1AA7BE6BAAE8CB8579278412905ACB2
                                                                                                                                                                                    SHA-512:AC0662B19F336474B146E06778E1FB43B941ABC8FD51BDB31B2640C94CCDFBE7659960EF4FD18329AFA7AD11316FC08D3CF33BB27931EA70AA7218667A8D0737
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Kentucky/Louisville)]} {.. LoadTimeZoneFile America/Kentucky/Louisville..}..set TZData(:America/Louisville) $TZData(:America/Kentucky/Louisville)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):207
                                                                                                                                                                                    Entropy (8bit):4.900350318979456
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290h48h490ppv:MByMYbpwt290/490b
                                                                                                                                                                                    MD5:83CE86174ADB5F276AABD26FE132BB55
                                                                                                                                                                                    SHA1:925E3F4A5DB1A2C33B3A537C8DBC9CFE309FA340
                                                                                                                                                                                    SHA-256:1E786229B84CE86DB6316B24C85F7CF4CFE66011F973053AD0E108BFCC9A9DE2
                                                                                                                                                                                    SHA-512:BA2AC5571D772B577735BC8E43FF8023228BC61A974DCCE0EAE20EC9B11FC757E56CABDAE00933A99834108114E598B7EC149BB017EB80BE18301A655F341A36
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Lower_Princes) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1539
                                                                                                                                                                                    Entropy (8bit):3.7453889877550512
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5QChlvEw6kSSx5H4a8tf3fkuoLdNYVZDNR8nd:OIlvEwJSSxdF8tfMuoLdNYVZJR8nd
                                                                                                                                                                                    MD5:EB0EDF4E075E3CF9F8EDF2B689C2FE54
                                                                                                                                                                                    SHA1:9713D7E8AA0E7164824657D00DE6C49483D2BD19
                                                                                                                                                                                    SHA-256:F65C5957D434A87324AAD35991E7666E426A20C40432540D9A3CB1EEE9141761
                                                                                                                                                                                    SHA-512:0A0D1E4E0BD7D854E8F139E6F7A9BBC66422B73F7A6C2E1F1B6D2CA400B24B3D220AB519B6AEAA743443E9A4B748709CDF2C276BF52C5382669B12734A469125
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Maceio) {.. {-9223372036854775808 -8572 0 LMT}.. {-1767217028 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):611
                                                                                                                                                                                    Entropy (8bit):4.303621439025158
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290znTjmdHOYCvprv5EU/dLAyW+/uF+kX8/uF+RZ//dAWcP/QAWcx/uF+rbE:5GnPeOdvhxD1pLS+S8S+RVqzo4xS+3SJ
                                                                                                                                                                                    MD5:FB09D1F064C30F9E223FA119A8875098
                                                                                                                                                                                    SHA1:C66173FEB21761AEA649301D77FBB77ACF3A6FB1
                                                                                                                                                                                    SHA-256:F0F0CCE8DE92D848A62B56EF48E01D763B80153C077230C435D464CF1733BA38
                                                                                                                                                                                    SHA-512:BC3D841FF48FD0DE7C9ABF5DAE3A42C876BD4D7FBD6684B4513EC7ECC92D938A7133BCC873AD46E453DD1863E843E5C7DD14FFDB41B593E90BEB5CD8F7E66202
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Managua) {.. {-9223372036854775808 -20708 0 LMT}.. {-2524500892 -20712 0 MMT}.. {-1121105688 -21600 0 CST}.. {105084000 -18000 0 EST}.. {161758800 -21600 0 CST}.. {290584800 -18000 1 CDT}.. {299134800 -21600 0 CST}.. {322034400 -18000 1 CDT}.. {330584400 -21600 0 CST}.. {694260000 -18000 0 EST}.. {717310800 -21600 0 CST}.. {725868000 -18000 0 EST}.. {852094800 -21600 0 CST}.. {1113112800 -18000 1 CDT}.. {1128229200 -21600 0 CST}.. {1146384000 -18000 1 CDT}.. {1159682400 -21600 0 CST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1166
                                                                                                                                                                                    Entropy (8bit):3.7842934576858482
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5GnqeKwnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQz:5mSeSFESoSQSrSsCSeSPS1cSQSQlSsSQ
                                                                                                                                                                                    MD5:E42719A9B0165490BB9E0E899EFB3643
                                                                                                                                                                                    SHA1:2991D7EC31F47E32D2C8DB89A0F87D814122DD1B
                                                                                                                                                                                    SHA-256:DC54E6D4FE14458B0462FA0E15B960FD4290930ADC0D13453BF49B436ED8C143
                                                                                                                                                                                    SHA-512:F75024E27A2D679A667EA70EC948F983C7B823FDA5962DD88697D61147A6C2B1499E58BA8B01170653C4D025900491AE8E21925500DE39EACBAF883F7E62D874
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Manaus) {.. {-9223372036854775808 -14404 0 LMT}.. {-1767211196 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200 -1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):201
                                                                                                                                                                                    Entropy (8bit):4.900738604616686
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290zzJ/90ppv:MByMYbpwt290zzN90b
                                                                                                                                                                                    MD5:8C60DE8E522FE5D51EACD643FD8EA132
                                                                                                                                                                                    SHA1:2E09A71DF340ECA6F7AEBD978070D56A627049EC
                                                                                                                                                                                    SHA-256:5C26D7CE93F91CC4F5ED87E9388B1B180EF9D84681044FD23CC01A628A1284CA
                                                                                                                                                                                    SHA-512:D2D522D041AFA638542F6FF00F5F40325E3F117C5035BA71F676B4956B054542C67A753055D17E2E2EEA925F13EACC0969D01EC18E40D274D8EA408F92777EA2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Marigot) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):251
                                                                                                                                                                                    Entropy (8bit):4.849143012086458
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/290zlEDm2OHfueoHv9dMIqR5lRfT/VVFUFkmR/lAov:MB86290zimdHfnCv9dMIqR5lVb/uFkmD
                                                                                                                                                                                    MD5:CFE10EE56115D3A5F44E047B3661D8ED
                                                                                                                                                                                    SHA1:03F598CFC9AEDE2F588339B439B2361F2EBDE34F
                                                                                                                                                                                    SHA-256:D411FB42798E93B106275EC0E054F8F3C4E9FB49431C656448739C7F20C46EDE
                                                                                                                                                                                    SHA-512:25D6760FDF2F1B0DD91A41D29BDB7048FAE27A03F7B9D9C955ECF4C32E8402836D007B39FE62B93E7BEA017681A0C8AFC1C4CAFD823B0A6C41EDAF09DDF3435D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Martinique) {.. {-9223372036854775808 -14660 0 LMT}.. {-2524506940 -14660 0 FFMT}.. {-1851537340 -14400 0 AST}.. {323841600 -10800 1 ADT}.. {338958000 -14400 0 AST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6745
                                                                                                                                                                                    Entropy (8bit):3.842851851460931
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:nD5NA604qSScBgN+4ctDzIVQ/c/3hNxTh:nDbA604qSBgI7DBch
                                                                                                                                                                                    MD5:2CE5A1AA4D5AEC9B94FA980FAA0222AB
                                                                                                                                                                                    SHA1:40838538813002C9E69F8FD244E77D4C22CF654F
                                                                                                                                                                                    SHA-256:6738B94878D0CF4D88206858ABA03D18B0A2DE71D8F051B7D19C2C367DD59D79
                                                                                                                                                                                    SHA-512:C6097A3EEDB0E68F3FE9E97816AF76631D0239EF843DEBA87096D8DB6B0E9787FA3820062871A9B22F58833B7B36F51F25B738AD671A21665BE49EAD71CC17F6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Matamoros) {.. {-9223372036854775808 -24000 0 LMT}.. {-1514743200 -21600 0 CST}.. {568015200 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {599637600 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6841
                                                                                                                                                                                    Entropy (8bit):3.872535525478649
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:WNG1GK5+yBEzg4GaaECHm3FL5TInckNSNi:/5+yBEzVWEaOkv
                                                                                                                                                                                    MD5:CBCB4A9A77EE76C16C8EC9DDD3231ABC
                                                                                                                                                                                    SHA1:270B2C3C8F5A2EFD47E4DFA22521E36CEFD5A774
                                                                                                                                                                                    SHA-256:F1E4E853758A3D79013D5B24AE45FDFD41A7C110949A5C5DB96CF14B479FA741
                                                                                                                                                                                    SHA-512:F64FFDA679E360E50C95DFA45CE866E51DC87B440E984CCABDD57E2C1C3F2FAD44256AE44FAA84E0F577B22CD1A80F891E14BF811D6D83ADA9B19DE32692175F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Mazatlan) {.. {-9223372036854775808 -25540 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -2520
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):219
                                                                                                                                                                                    Entropy (8bit):4.812188311941308
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7/MeHAIgp/MSvYovN/290zpH+90/MX:MByMY/M/p/MSA6t290zpe90/MX
                                                                                                                                                                                    MD5:2A3BFEEFBB684FB3B420A6B53B588BDC
                                                                                                                                                                                    SHA1:CC5C0BB90D847CCBB45688A8DA460AD575D64617
                                                                                                                                                                                    SHA-256:D6B308A1619F2DE450DACBFEF0E11B237DF7375A80C90899DD02B827688CB4B8
                                                                                                                                                                                    SHA-512:4A35C80D3454E039383FFEB06DC84933B3201BE2487C42A448AF3DA5ABAEEB9882263C011CDD3194E121EC1C31FC80120BF7829F280A79996E376CFA828EE215
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Mendoza)]} {.. LoadTimeZoneFile America/Argentina/Mendoza..}..set TZData(:America/Mendoza) $TZData(:America/Argentina/Mendoza)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8410
                                                                                                                                                                                    Entropy (8bit):3.8311875423131534
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:6quShLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:6lSUqtfA604qSBgI7DBch
                                                                                                                                                                                    MD5:C74D31382279219F805D2B138C58FBF7
                                                                                                                                                                                    SHA1:06E2FED0A3BDF62F3D390A4054B6A2D7C1863DD3
                                                                                                                                                                                    SHA-256:B0863F8B66F0848020651B69E7997307D62209259AE653FDC1A0FAFC8E793068
                                                                                                                                                                                    SHA-512:7B42CBDC119651E2B2EE8B8F934801D3147A8B72EE060A0D0EA1C0C12CA9ABD03F1A102A85BF8E7424B45620151CE107D16A9173F4AA7597EDB3109840C1B2AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Menominee) {.. {-9223372036854775808 -21027 0 LMT}.. {-2659759773 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-116438400 -18000 1 CDT}.. {-100112400 -21600 0 CST}.. {-21484800 -18000 0 EST}.. {104914800 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200 -18000 1 CDT}.. {278492400 -21600 0 CST}.. {294220800 -18000 1 CDT}.. {309942000 -2160
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6651
                                                                                                                                                                                    Entropy (8bit):3.8421369120684714
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5bu36fELf0On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAqy6:1qehpYtpjyrz7nKED4KPddGEYA/Gx
                                                                                                                                                                                    MD5:BEA04423DB05D122622807857EFD2B36
                                                                                                                                                                                    SHA1:EE2A2AB89DFFFE2880801E8667AF2AD627E641EC
                                                                                                                                                                                    SHA-256:2B4FACFC69A195C646842A8B47AFE76D755CEEDAD536DEE7ECE79302BAF97223
                                                                                                                                                                                    SHA-512:D860332F4A50F886600E9DCF3F0ACA6CC6FAD1421ECCAF0E67D0CB76F5FBFA1DC0F243F0B312A3CFB0614BD76C6A76C45E5C6F582073B23FEC4B72E77950E2EC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Merida) {.. {-9223372036854775808 -21508 0 LMT}.. {-1514743200 -21600 0 CST}.. {377935200 -18000 0 EST}.. {407653200 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0 CST}.. {1207468800 -18000 1 CDT}.. {1225004400 -21600 0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6705
                                                                                                                                                                                    Entropy (8bit):3.985641709481311
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:4DCG0haiaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:42G0IiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                    MD5:4999FE49C1640402CB432BC1EB667479
                                                                                                                                                                                    SHA1:2ED0044927A66856090793ED6E5FF634617C8C40
                                                                                                                                                                                    SHA-256:2574831391092AD44D7B2806EEF30D59CE3BAE872111917DD39EC51EFDD62E5F
                                                                                                                                                                                    SHA-512:39DE1D24037F3FFA3101BBAA885939074E596479F68013CDA9CE53A061EA704F63FB55C15B68B66B0E29E3F07ADC0BDC2D78A2D289277E75D2EF95F54988DB74
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Metlakatla) {.. {-9223372036854775808 54822 0 LMT}.. {-3225223727 -31578 0 LMT}.. {-2188955622 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {30
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7035
                                                                                                                                                                                    Entropy (8bit):3.8457960083650584
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5CBU/UI+n36fELf5On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10B:EBNqehpYtpjyrz7nKED4KPddGEYA/Gx
                                                                                                                                                                                    MD5:8688CD1F2C071314E56666D70DAD8261
                                                                                                                                                                                    SHA1:32F9C882D148BB9568F719099B3DCE25B53FB43C
                                                                                                                                                                                    SHA-256:3458EAF721C1CDF565B5ADDB487B4F1B93FA46744E9E5FC91D74787173B233A4
                                                                                                                                                                                    SHA-512:02A110943B2458DA20BC6D2568B19819B4831DAAD6968EC9D1A523DD81D5499AB21630F865C9CF70AEBE54D39CE72A0F833B91492E694F3117E32E06432F30DB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Mexico_City) {.. {-9223372036854775808 -23796 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-975261600 -18000 1 CDT}.. {-963169200 -21600 0 CST}.. {-917114400 -18000 1 CDT}.. {-907354800 -21600 0 CST}.. {-821901600 -18000 1 CWT}.. {-810068400 -21600 0 CST}.. {-627501600 -18000 1 CDT}.. {-612990000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001836800 -21600 0 CST}.. {1014184800 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {10357020
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7080
                                                                                                                                                                                    Entropy (8bit):3.5379714312244217
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:2UViR+iORv7bw1aW5AnMyxH5e+fHbxMfOp6D7bF8qMmqyiqV1mjZe7JhlgXY7FWN:02l5qJZS
                                                                                                                                                                                    MD5:C68889AA813C399939FCFA54E9CE0DFB
                                                                                                                                                                                    SHA1:F3D58D7BEFF2D1CB94FECE00C31FEF5BDF58C231
                                                                                                                                                                                    SHA-256:1B131AC968F95652667BD7EB1F6D667C8F679B31270D82B4B4271E787386CCCA
                                                                                                                                                                                    SHA-512:EBAF8210919E34668E9DDFCB546E5A62F35954957AAE956B6302BF296C7D4CF51E1B10FB13217CB3EEB430DAC246217EB4E9250CB4109C95D8A4367457D02771
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Miquelon) {.. {-9223372036854775808 -13480 0 LMT}.. {-1850328920 -14400 0 AST}.. {326001600 -10800 0 -03}.. {536468400 -10800 0 -02}.. {544597200 -7200 1 -02}.. {562132800 -10800 0 -02}.. {576046800 -7200 1 -02}.. {594187200 -10800 0 -02}.. {607496400 -7200 1 -02}.. {625636800 -10800 0 -02}.. {638946000 -7200 1 -02}.. {657086400 -10800 0 -02}.. {671000400 -7200 1 -02}.. {688536000 -10800 0 -02}.. {702450000 -7200 1 -02}.. {719985600 -10800 0 -02}.. {733899600 -7200 1 -02}.. {752040000 -10800 0 -02}.. {765349200 -7200 1 -02}.. {783489600 -10800 0 -02}.. {796798800 -7200 1 -02}.. {814939200 -10800 0 -02}.. {828853200 -7200 1 -02}.. {846388800 -10800 0 -02}.. {860302800 -7200 1 -02}.. {877838400 -10800 0 -02}.. {891752400 -7200 1 -02}.. {909288000 -10800 0 -02}.. {923202000 -7200 1 -02}.. {941342400 -10800 0 -02}.. {954651600 -7200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10507
                                                                                                                                                                                    Entropy (8bit):3.8204583916930557
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:X9+FPHyXFRsivcQYM+T7Z/xVQzxmtBWIXrObx29x8sLxcGMe++wzlrfFjxKvnpNM:gF6L0d0F2TzNc/1cYUH+CC
                                                                                                                                                                                    MD5:80B88F57B837CD2478815796618A6AC6
                                                                                                                                                                                    SHA1:CC2BE0213E9F0D3B307A8311D7A1013582E8A338
                                                                                                                                                                                    SHA-256:D977D045DE5CDAEB41189B91963E03EF845CA4B45E496649B4CB541EE1B5DD22
                                                                                                                                                                                    SHA-512:9410CBD706CAABFFF88DFF75235597D844B45A061EBD796F6708D7CEAB680273571A17935B7CCFC7C466ABF293C286D0886F47880E692F74C4E8BFB41729C73C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Moncton) {.. {-9223372036854775808 -15548 0 LMT}.. {-2715882052 -18000 0 EST}.. {-2131642800 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-1167595200 -14400 0 AST}.. {-1153681200 -10800 1 ADT}.. {-1145822400 -14400 0 AST}.. {-1122231600 -10800 1 ADT}.. {-1114372800 -14400 0 AST}.. {-1090782000 -10800 1 ADT}.. {-1082923200 -14400 0 AST}.. {-1059332400 -10800 1 ADT}.. {-1051473600 -14400 0 AST}.. {-1027882800 -10800 1 ADT}.. {-1020024000 -14400 0 AST}.. {-996433200 -10800 1 ADT}.. {-988574400 -14400 0 AST}.. {-965674800 -10800 1 ADT}.. {-955396800 -14400 0 AST}.. {-934743600 -10800 1 ADT}.. {-923947200 -14400 0 AST}.. {-904503600 -10800 1 ADT}.. {-891892800 -14400 0 AST}.. {-883598400 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-757368000 -14400 0 AST
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6714
                                                                                                                                                                                    Entropy (8bit):3.843663571428462
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5JZKy36fELf0On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAO:XwDqehpYtpjyrz7nKED4KPddGEYA/Gx
                                                                                                                                                                                    MD5:7BAF644224F6045B791D64A3AA41B515
                                                                                                                                                                                    SHA1:FCB940F91B8A7AE599433460C27953890FA38F27
                                                                                                                                                                                    SHA-256:63813975BC90A2AE8A6500D7A3173A3C81C060F8B5AAA3E86D5FDC4D5F06ABD8
                                                                                                                                                                                    SHA-512:F2DD85E8F1875274A6ACD3B9F90869ABA0539CFD564DC7DEA490AE3B7DC66B83D6F76EC3F1389FD3DFC111E5A198B7AB9AEE54CCE9A3B9C6871BE0DB211FEB76
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Monterrey) {.. {-9223372036854775808 -24076 0 LMT}.. {-1514743200 -21600 0 CST}.. {568015200 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {599637600 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2936
                                                                                                                                                                                    Entropy (8bit):3.6410670126139046
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5JgQkS4SaEcSyS0sZSUS2kSVSXSulSASX5kAXJMsCXrUari3akaWCa3M+lafpI6L:X5kH4c9GT0E01jm5keJMRXrUEi3akaWO
                                                                                                                                                                                    MD5:D78DEBC7C0B15B31635DDC34C49248BC
                                                                                                                                                                                    SHA1:DB2FF76DB3A79BE52E2DFD4C7B8B6592946772F9
                                                                                                                                                                                    SHA-256:214F97A3BCB2378CCE23D280EA6A3B691604F82E383628F666BE585BB8494932
                                                                                                                                                                                    SHA-512:E5FCD0B54F61910E70B1D0EE9911C5B4AFF850F16B651A01D69A63A97880913B0BAB99B0D864C4E613594734FA72CCA0E9607B1ADB6E75957C790990114FD0A4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Montevideo) {.. {-9223372036854775808 -13491 0 LMT}.. {-1942690509 -13491 0 MMT}.. {-1567455309 -14400 0 -04}.. {-1459627200 -10800 0 -0330}.. {-1443819600 -12600 0 -0330}.. {-1428006600 -10800 1 -0330}.. {-1412283600 -12600 0 -0330}.. {-1396470600 -10800 1 -0330}.. {-1380747600 -12600 0 -0330}.. {-1141590600 -10800 1 -0330}.. {-1128286800 -12600 0 -0330}.. {-1110141000 -10800 1 -0330}.. {-1096837200 -12600 0 -0330}.. {-1078691400 -10800 1 -0330}.. {-1065387600 -12600 0 -0330}.. {-1047241800 -10800 1 -0330}.. {-1033938000 -12600 0 -0330}.. {-1015187400 -10800 1 -0330}.. {-1002488400 -12600 0 -0330}.. {-983737800 -10800 1 -0330}.. {-971038800 -12600 0 -0330}.. {-954707400 -10800 1 -0330}.. {-938984400 -12600 0 -0330}.. {-920838600 -10800 1 -0330}.. {-907534800 -12600 0 -0330}.. {-896819400 -10800 1 -0330}.. {-853621200 -9000 0 -03}.. {-84
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.748877320903638
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEzQ21h4IAcH:SlSWB9vsM3y7RQtHAIgpRQPN/290zQgp
                                                                                                                                                                                    MD5:9130CD86BD6417DB877BF9D8F3080CE1
                                                                                                                                                                                    SHA1:76C37982C37FE54ED539AC14B5A513817E42937C
                                                                                                                                                                                    SHA-256:97F48948EF5108FE1F42D548EA47C88D4B51BF1896EE92634C7ED55555B06DBD
                                                                                                                                                                                    SHA-512:EE036350AF95414392BD93DFF528F67D9A93EB192A30056ECBC3D2396AB4B2938B3C096C3EC2BC739294D4C4B7261C427B0AAEB9559F5381CB7F375892781820
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Montreal) $TZData(:America/Toronto)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):4.878534808314885
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290zQ1HK90ppv:MByMYbpwt290zQ490b
                                                                                                                                                                                    MD5:CB5988A2508285B42C2BD487B8F9D6E1
                                                                                                                                                                                    SHA1:EAD740A566245B682CE5E284D389DFAE66DF05D9
                                                                                                                                                                                    SHA-256:6C3EE46983A3DAA91C9ADF4B18D6B4B80F1505B0057569B66D5B465D4C09B9C1
                                                                                                                                                                                    SHA-512:48796213A67F0E3BC56B54CE4D8BE098E74BA5808C9A1082D9381CB729ADFA2ACB9CE9E39A3244B3901405761C97AEE28D44C3BF7239ECC71175C62E152029C4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Montserrat) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.785765433607229
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEwEzEeIAcGu:SlSWB9vsM3y7RQtHAIgpRQPN/290xzEf
                                                                                                                                                                                    MD5:F7DAD684104D917E0F29F6951EA627AC
                                                                                                                                                                                    SHA1:E57B5CA730D90C5865CF32FEC4872F71E033D21C
                                                                                                                                                                                    SHA-256:A889810B8BB42CD206D8F8961164AD03CCFBB1924D583075489F78AFA10EAF67
                                                                                                                                                                                    SHA-512:8284F2A357A32B2F5A211904F65E3B5C37B77C9BF38C85DFA0A95A73457F3076EC12F09BC767B4D0B8FC86BF69D01A17A7BF685BAB72F3E519A397D050DA0C3B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Nassau) $TZData(:America/Toronto)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11373
                                                                                                                                                                                    Entropy (8bit):3.8110553140357086
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:HeohzORhK1a8phYvNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:+uORhK1a8phYloSItON0HY2iUmUFLqU
                                                                                                                                                                                    MD5:385C3BDD3E41E5E75CEF0658322B5CDE
                                                                                                                                                                                    SHA1:0334C21C8316ED2EE16FC98B1E8867D5E0916C00
                                                                                                                                                                                    SHA-256:7BA7DA179AA7DF26AC25E7ACCD9BD83784174445285A0D9CCBD7D6A9AA34F4BC
                                                                                                                                                                                    SHA-512:764B680FB8414B5AC8FB110247C19B1004A4453DD2BAC94BF3CFD80281FF3679A5B1D212238509165E022269503ED14A54B0EF73AF7014344752E6A627657D1F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/New_York) {.. {-9223372036854775808 -17762 0 LMT}.. {-2717650800 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-1577905200 -18000 0 EST}.. {-1570381200 -14400 1 EDT}.. {-1551636000 -18000 0 EST}.. {-1536512400 -14400 1 EDT}.. {-1523210400 -18000 0 EST}.. {-1504458000 -14400 1 EDT}.. {-1491760800 -18000 0 EST}.. {-1473008400 -14400 1 EDT}.. {-1459706400 -18000 0 EST}.. {-1441558800 -14400 1 EDT}.. {-1428256800 -18000 0 EST}.. {-1410109200 -14400 1 EDT}.. {-1396807200 -18000 0 EST}.. {-1378659600 -14400 1 EDT}.. {-1365357600 -18000 0 EST}.. {-1347210000 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-123895440
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8100
                                                                                                                                                                                    Entropy (8bit):3.8314265228376105
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:xhZ8gEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:xAgEItON0HY2iUmUFLqU
                                                                                                                                                                                    MD5:54722EA33AAC411AA1D51D5E00423937
                                                                                                                                                                                    SHA1:C6D1E5EAC6A72CCE738E465C8AA32CC76FD1DDC7
                                                                                                                                                                                    SHA-256:BB4BA3C15C626F6F94AC026A7C3D5DFE3854B17CBFA3F540FFAFFD9D5B491083
                                                                                                                                                                                    SHA-512:E66F7C2AEFB483526A7F11292B4F5E9C972DB12BAEF42110A45C49DCA5EA1DA2482A9FACA223D9F543F5ABE92CC54311ADA1852332DB184AE49CCFCED8D9405C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nipigon) {.. {-9223372036854775808 -21184 0 LMT}.. {-2366734016 -18000 0 EST}.. {-1632070800 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-923252400 -14400 1 EDT}.. {-880218000 -14400 0 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {136364400 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {167814000 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8680
                                                                                                                                                                                    Entropy (8bit):3.965662913874442
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:OrBvOs5vzC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:OrBvOsM9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                    MD5:9A5F536932FED5A93E2C3DEB81960CD1
                                                                                                                                                                                    SHA1:8E78396D280DD3A9564CEFC7FB722437F3C4D003
                                                                                                                                                                                    SHA-256:8E971C9560CCE548B46626D072E62AB0F4C9682BF6A6ABFB4D0E8D63745402FE
                                                                                                                                                                                    SHA-512:60CFDBCE87F9CD7F27E071D66B97E60F62E56F413DC867BC809490B30D00045D0757710D6B5724148E2A28BD1E45FB662391820E6350D998002BF67B16776645
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nome) {.. {-9223372036854775808 46702 0 LMT}.. {-3225223727 -39698 0 LMT}.. {-2188947502 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1397
                                                                                                                                                                                    Entropy (8bit):3.78056049136398
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5TenykFxCFbF3YCFE2FBCFDFr9CFaFPBCFoF2CFTFKCFDuF1CF2F1CFWFhCFGF3a:5quY9EmFYBosNZNW/bWsBzgCccq7JYN9
                                                                                                                                                                                    MD5:B4F4530FCE4BF5690042A2DA40413D56
                                                                                                                                                                                    SHA1:52D5F2102485F5B326C888A287ED83CA18833BBC
                                                                                                                                                                                    SHA-256:9011C76295E6B17CC1973876B497BEE21B9E6562FB25DF66140F811A1FFA9765
                                                                                                                                                                                    SHA-512:08CAF75226D190D9FF0AA62AD84B13F1BF9047338A690847DF5B448BDB731A877F3E186298AFD704F4F4E133FF3F3128B098F9D90AE9A8E726AE52F84A7DA2E3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Noronha) {.. {-9223372036854775808 -7780 0 LMT}.. {-1767217820 -7200 0 -02}.. {-1206961200 -3600 1 -02}.. {-1191366000 -7200 0 -02}.. {-1175378400 -3600 1 -02}.. {-1159830000 -7200 0 -02}.. {-633823200 -3600 1 -02}.. {-622072800 -7200 0 -02}.. {-602287200 -3600 1 -02}.. {-591836400 -7200 0 -02}.. {-570751200 -3600 1 -02}.. {-560214000 -7200 0 -02}.. {-539128800 -3600 1 -02}.. {-531356400 -7200 0 -02}.. {-191368800 -3600 1 -02}.. {-184201200 -7200 0 -02}.. {-155167200 -3600 1 -02}.. {-150073200 -7200 0 -02}.. {-128901600 -3600 1 -02}.. {-121129200 -7200 0 -02}.. {-99957600 -3600 1 -02}.. {-89593200 -7200 0 -02}.. {-68421600 -3600 1 -02}.. {-57970800 -7200 0 -02}.. {499744800 -3600 1 -02}.. {511232400 -7200 0 -02}.. {530589600 -3600 1 -02}.. {540262800 -7200 0 -02}.. {562125600 -3600 1 -02}.. {571194000 -7200 0 -02}.. {592970400 -
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8557
                                                                                                                                                                                    Entropy (8bit):3.8810445182855253
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:WEktwmGaLV911sF9A604qSScBgN+4ctDzIVQ/c/3hNxTh:WBwDPPA604qSBgI7DBch
                                                                                                                                                                                    MD5:10AF9E9461DD03DA4F0AF0595EB36E6C
                                                                                                                                                                                    SHA1:57AC9BDE3AC665E49D9D2463A4BFA38C053A4A54
                                                                                                                                                                                    SHA-256:D0D8B108453265B60F525A4EC04DE9555087CD6AC5DDBA980B3A96CF0FCD68D1
                                                                                                                                                                                    SHA-512:B6DC7D2709A19B911E086C988DB8346F42DBF7601D9E51E3093C6AF897570E43E5F1C101FE88BC5251F3DCC3B532DB22FFE8A12A4D0151BC52AF3E6DDEA7D23A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/Beulah) {.. {-9223372036854775808 -24427 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8557
                                                                                                                                                                                    Entropy (8bit):3.867423227197841
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ZEktwmGaLV9tZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:ZBwD6fA604qSBgI7DBch
                                                                                                                                                                                    MD5:33C03AD65753D7ADB45FC4899B504D1A
                                                                                                                                                                                    SHA1:ED719BB67A64DB49901BA38A945A6BA998646B8D
                                                                                                                                                                                    SHA-256:ABC2B6C97D9E9FBA37AC582ADBA2CE996890D090060E083405D75CDAED9EABE0
                                                                                                                                                                                    SHA-512:69592E8A370C8A5173827500CDDF8190AB44EA87CD7E0C416055CB7958B13A737801EA6B0FFE6032CB3F14F05001BF9DA83E4AEB20F385019B2985ECE7ACB40E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/Center) {.. {-9223372036854775808 -24312 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8560
                                                                                                                                                                                    Entropy (8bit):3.879452555978431
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:GEktwmGaLV9nlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:GBwD2fA604qSBgI7DBch
                                                                                                                                                                                    MD5:3D3DC12209293086FD843738A4FE87FB
                                                                                                                                                                                    SHA1:8103DFA18B5F3F36AF0B53FA350E0F2D300E6289
                                                                                                                                                                                    SHA-256:8803FF7C81C933B57178B9D3C502FB4268D9AA594A3C638A7F17AF60B12D300D
                                                                                                                                                                                    SHA-512:39BB939780A71B817F82D2B7F56815D33926D150525161051A9950E5A98BA9184670AFC884A1C69D56EADBD6198E3082975448EFBA5FE8A336DB071E6BAB8EF2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/New_Salem) {.. {-9223372036854775808 -24339 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -2160
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7429
                                                                                                                                                                                    Entropy (8bit):3.5470060859729253
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:0ixKXpbzvZ+FxAqe12voJ0euJFNgIHc/QEeF5Z1V8tCSfifK3facfzQWWLQelXuC:0LRJq9LstgV
                                                                                                                                                                                    MD5:FC9CEA4B9654D0957F55CB0E1B25A3E7
                                                                                                                                                                                    SHA1:8BFC3E8CEC34C4087579D3DA727143E3EC045B77
                                                                                                                                                                                    SHA-256:12917DAAA60134BFE56E6979BB27B58A3F295C32BAE02B233E849BCED6B8BCA2
                                                                                                                                                                                    SHA-512:355628F2EFF86605653A1EE7D976CE8B3229A4169D35576F6007FABAB37DD280D8F296EE88BECE3D84D3A1C476F23275D1D77CAF157E9A98672CBF14801D7292
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nuuk) {.. {-9223372036854775808 -12416 0 LMT}.. {-1686083584 -10800 0 -03}.. {323845200 -7200 0 -02}.. {338950800 -10800 0 -03}.. {354675600 -7200 1 -02}.. {370400400 -10800 0 -03}.. {386125200 -7200 1 -02}.. {401850000 -10800 0 -03}.. {417574800 -7200 1 -02}.. {433299600 -10800 0 -03}.. {449024400 -7200 1 -02}.. {465354000 -10800 0 -03}.. {481078800 -7200 1 -02}.. {496803600 -10800 0 -03}.. {512528400 -7200 1 -02}.. {528253200 -10800 0 -03}.. {543978000 -7200 1 -02}.. {559702800 -10800 0 -03}.. {575427600 -7200 1 -02}.. {591152400 -10800 0 -03}.. {606877200 -7200 1 -02}.. {622602000 -10800 0 -03}.. {638326800 -7200 1 -02}.. {654656400 -10800 0 -03}.. {670381200 -7200 1 -02}.. {686106000 -10800 0 -03}.. {701830800 -7200 1 -02}.. {717555600 -10800 0 -03}.. {733280400 -7200 1 -02}.. {749005200 -10800 0 -03}.. {764730000 -7200 1 -0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6843
                                                                                                                                                                                    Entropy (8bit):3.877923791759769
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5gUq33FS1YluOQiLvf3PCeq5r3xod8CzSP2IZ5Sy4DLbrc6HiviVN:So1c7Lv/PCewtA8CzSPyDLbrcUia
                                                                                                                                                                                    MD5:32BDE9C2C59F2A34D3B9F98BC9894A99
                                                                                                                                                                                    SHA1:04A24DC4A3C2A0D7C9C8E0001E320662778A78BF
                                                                                                                                                                                    SHA-256:549E92BDEC98D21C5C4A996F954671A2F0262463415BF294D122500246309BC4
                                                                                                                                                                                    SHA-512:A33E583EC5B2B274C4247C109F37F9A4495ED9094849F6A8E68145EBF6A1906B3DD0B31BB7690261FEDA9C72F2288F4D1121365F544B9EC1343E208B472D0660
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Ojinaga) {.. {-9223372036854775808 -25060 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {820476000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {883634400 -21600 0 CST}.. {891766800 -21600 0 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -25200 0 MST}.. {1143968400 -21
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.970379147398626
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2IAcGEu5YfMXGm2OHGf8xYoHv5BidhZvFsc1HRX1va0v:SlSWB9eg/290ZDm2OHDxYoHv5GhZd93p
                                                                                                                                                                                    MD5:AA408A43079EC8933DE271BE3DA2B502
                                                                                                                                                                                    SHA1:421A867DB3FD4779C5F759D0B657D8EB5FB2218B
                                                                                                                                                                                    SHA-256:990213DDE00ADCEB74C8D1ECAF81B9C77963E4AB1F35767F7349236FC8E917DF
                                                                                                                                                                                    SHA-512:1FB740527555A8E128E05709D05720A249BCBA4B6434D00226C07426E6283AA48973F75268F36E6044F0F0650E012781C8E5519B7EA916C625BBF018B29E9961
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Panama) {.. {-9223372036854775808 -19088 0 LMT}.. {-2524502512 -19176 0 CMT}.. {-1946918424 -18000 0 EST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7736
                                                                                                                                                                                    Entropy (8bit):3.8533019559841972
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:tTqPm4bPJWXtRbALtuO/N0HY2iUmUFLqU:Izod
                                                                                                                                                                                    MD5:6BA298F9CEB6406802A01C13313F8EF1
                                                                                                                                                                                    SHA1:D77C113CFA927EF65461781FD080F590C8CFCBB9
                                                                                                                                                                                    SHA-256:1FB962ECC1E5F02E1001C70460FFF720B114554F9AA7956D6DA154DBEA87B4D7
                                                                                                                                                                                    SHA-512:C7F4E2DA503A3167098CFAB7AEC8D75A32D6B081E6777DE7BA3D6B4558D0C44D2CD8A0F1626968295031BABFD2CB96B031B4C00A44F2C554B5B217AE67E69EB4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Pangnirtung) {.. {-9223372036854775808 0 0 -00}.. {-1546300800 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-147902400 -7200 1 ADDT}.. {-131572800 -14400 0 AST}.. {325663200 -10800 1 ADT}.. {341384400 -14400 0 AST}.. {357112800 -10800 1 ADT}.. {372834000 -14400 0 AST}.. {388562400 -10800 1 ADT}.. {404888400 -14400 0 AST}.. {420012000 -10800 1 ADT}.. {436338000 -14400 0 AST}.. {452066400 -10800 1 ADT}.. {467787600 -14400 0 AST}.. {483516000 -10800 1 ADT}.. {499237200 -14400 0 AST}.. {514965600 -10800 1 ADT}.. {530686800 -14400 0 AST}.. {544600800 -10800 1 ADT}.. {562136400 -14400 0 AST}.. {576050400 -10800 1 ADT}.. {594190800 -14400 0 AST}.. {607500000 -10800 1 ADT}.. {625640400 -14400 0 AST}.. {638949600 -10800 1 ADT}.. {657090000 -14400 0 AST}.. {671004000 -10800 1 ADT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):253
                                                                                                                                                                                    Entropy (8bit):4.784405839512086
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/290olofDm2OHekeoHXFIV/1Vw/9vVOzFZg/VVFAKV:MB86290oloLmdHeVCXqV/k/9v4zW/OW
                                                                                                                                                                                    MD5:BFCE7E2618D6935031D6941AD6DDD8E3
                                                                                                                                                                                    SHA1:1953CD224FB2363B10372C0476760F3FB020CB00
                                                                                                                                                                                    SHA-256:B3EE44B3526BEDFC25B806371D3C465FDBD6CC647F30BF093750651E4A0C1BE4
                                                                                                                                                                                    SHA-512:31262DF034E084DA4CDB57B99178594C29129F61F3535E5D8245B8BB4AB6BF314307B0F5E58B74C349684CD761C9CDE44EB10407FB135BA6427D3D1E9DA99B40
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Paramaribo) {.. {-9223372036854775808 -13240 0 LMT}.. {-1861906760 -13252 0 PMT}.. {-1104524348 -13236 0 PMT}.. {-765317964 -12600 0 -0330}.. {465449400 -10800 0 -03}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):496
                                                                                                                                                                                    Entropy (8bit):4.444598497301421
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290OXmdH514YCvb8o1W4S9xRvhhHRVxORBYUNv:5tekdvYP1x52yq
                                                                                                                                                                                    MD5:062ECA57C0B795780240CD7AFE70BDA0
                                                                                                                                                                                    SHA1:89D71A11DD8D4E000F7FADBDDC77C4C1DC1195F7
                                                                                                                                                                                    SHA-256:DFA0EC91804B789A1A7E1B1977710435D2589A5B54C1579C8E1F5BF96D2FD007
                                                                                                                                                                                    SHA-512:7D123AA872E0B8286A26E338AE0F8E0D7A6F0F2EA8B1EBEC6DBB59477C812985CB246AD397D0901A58FDB7FF14171CF60169DC15C538B95C58BD2D46106A7A4D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Phoenix) {.. {-9223372036854775808 -26898 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-820519140 -25200 0 MST}.. {-796841940 -25200 0 MST}.. {-94669200 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-56221200 -25200 0 MST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6613
                                                                                                                                                                                    Entropy (8bit):3.8549788442269395
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5Ux+E2p3T6ZqrNSMEBPMcywh4NF5zCC7IOTWa1HW1241UWK9BDL+3XC4BMrS2LxP:KOfS0HY2iU7KKdFL6Aa2K4gSLf8e
                                                                                                                                                                                    MD5:A720323DF122C70C1530788DB24700BA
                                                                                                                                                                                    SHA1:20674BD7D84CC686ABBB5D6B36B520A5E9C813ED
                                                                                                                                                                                    SHA-256:A89C580899AD2FF8DF45A783BB90D501DC32C28B92931CA18ABD13453E76244B
                                                                                                                                                                                    SHA-512:02B71E537B9FDAF1B68E381F0007CCBBA53EB70719ED38F51B56C5BFA64C7E3D9797053C9DE3A920E5CAFA09BBC062FCED62B5D6B9213AFA8286B95DEDAB0532
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Port-au-Prince) {.. {-9223372036854775808 -17360 0 LMT}.. {-2524504240 -17340 0 PPMT}.. {-1670483460 -18000 0 EST}.. {421218000 -14400 1 EDT}.. {436334400 -18000 0 EST}.. {452062800 -14400 1 EDT}.. {467784000 -18000 0 EST}.. {483512400 -14400 1 EDT}.. {499233600 -18000 0 EST}.. {514962000 -14400 1 EDT}.. {530683200 -18000 0 EST}.. {546411600 -14400 1 EDT}.. {562132800 -18000 0 EST}.. {576050400 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607500000 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638949600 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671004000 -14400 1 EDT}.. {688543200 -18000 0 EST}.. {702453600 -14400 1 EDT}.. {719992800 -18000 0 EST}.. {733903200 -14400 1 EDT}.. {752047200 -18000 0 EST}.. {765352800 -14400 1 EDT}.. {783496800 -18000 0 EST}.. {796802400 -14400 1 EDT}.. {814946400 -18000 0 EST}.. {828856800 -14400 1 EDT}
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):207
                                                                                                                                                                                    Entropy (8bit):4.919510214047913
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290e7490ppv:MByMYbpwt290190b
                                                                                                                                                                                    MD5:4AB394CB233B101627136EB5E070CF9B
                                                                                                                                                                                    SHA1:F00600CD2DB10FE157C3696F665B9759EEA85F99
                                                                                                                                                                                    SHA-256:A4952380C89A6903FFE5BF8707B94B1BB72568FFD03DB04BF4D98E38AC82EEB7
                                                                                                                                                                                    SHA-512:58F4AD08FA10F1884FA641C4EA778C0FC013EABBD68DF5DE04D5B301227396260C3D669DB33DD6A6B33F1550C24BBD7777D756DF0D61CEEAF5EC6541EDFA296C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Port_of_Spain) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):201
                                                                                                                                                                                    Entropy (8bit):4.866417687745155
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7thteSHAIgpth9RN/290msh490th4:MByMYdIp7t290v490I
                                                                                                                                                                                    MD5:6B570E79FA2AA7D6CB1E56A11EE0A37C
                                                                                                                                                                                    SHA1:396A2C9BBE4F264DD5A4F2E44D3E63C57F52186B
                                                                                                                                                                                    SHA-256:52921EEA2A1925DF06CEA4638ED4128FAAA8FBA40ED4E0741650B419E5152DCB
                                                                                                                                                                                    SHA-512:FA75A179664BED02A0F5BC1B7C3DD5F3E986544A151634BA4C4401476F5999714C89E240D9AF805484D1BEC04A1A562157FAEECA1603C4FF8CFFB424B9DEB560
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:America/Porto_Acre) $TZData(:America/Rio_Branco)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051
                                                                                                                                                                                    Entropy (8bit):3.851275104153641
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5Xe4QJnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/8:5kSeSFESoSQSrSsCSeSPS1cSQSQlSsSX
                                                                                                                                                                                    MD5:03046BA6F8344C32AD7A22748DC871AB
                                                                                                                                                                                    SHA1:AB9ED078D80AE99EF6DE4BF34AC45359B82D1284
                                                                                                                                                                                    SHA-256:E6E6F6753E7D443052A64D4DB07B8D443CE13A573946E7D0A19CDD4BBA4A2F04
                                                                                                                                                                                    SHA-512:620953BB4C8CF203262EC0C1F807543D24B9894C3B531AE57F7CEF630452CC9AC7CA41D43A6D8891F9CF17594E9EE34CF501F8508E7C0669A8E5EF9C70B6EAA3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Porto_Velho) {.. {-9223372036854775808 -15336 0 LMT}.. {-1767210264 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {5712012
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):283
                                                                                                                                                                                    Entropy (8bit):4.781646667761219
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/290piDm2OH9VoHvMlFoeVVF70ZVVFUFkzk/lLJpR/lAov:MB862908mdHvCvMlGe/J0Z/uFkzk/lL1
                                                                                                                                                                                    MD5:E2E2E0D6677FFF2E37BBFC3522F2A9AA
                                                                                                                                                                                    SHA1:4C1C93E14FBC00B8B1E78B8D9631599164305EB1
                                                                                                                                                                                    SHA-256:2981248A9F14EBFC8791EC5453170376CBD549557E495EA0E331CC18556C958E
                                                                                                                                                                                    SHA-512:F056B03EB9945823F5284C840E06E298DD2DE854F1555CD16D0BB19D962B73EF34A05683E6369B0D89CB7C3F7D082C312CCA6F8C6A0BB53F5C75FE4A863FCD95
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Puerto_Rico) {.. {-9223372036854775808 -15865 0 LMT}.. {-2233035335 -14400 0 AST}.. {-873057600 -10800 0 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-757368000 -14400 0 AST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3698
                                                                                                                                                                                    Entropy (8bit):3.6242875066986078
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:22SW+xUQjzoMUBI0nuUoDKlHslPlgiot7JC/Xk8NWse4r4g5xCEmSdLkUsZOn+ZW:28+xUQjzoMUBI0nuUoDK6lPlgiot7JCV
                                                                                                                                                                                    MD5:11B8DD9FB854C62D7692EDD2445C6F90
                                                                                                                                                                                    SHA1:51F2ABF95D73CA21674D1AA1C5F50501F76A7F3D
                                                                                                                                                                                    SHA-256:22418567D55A0E38CAB005665271D9279A384856FDF0CE5A9AEABDCD66CCBC72
                                                                                                                                                                                    SHA-512:B657DE13FF71268ABA1790AED7D60CC1DA867434CE78421AD023BDECCC5E1BA9863952029E07FB577B57A3247FA9157B2C0AA9F894658B3F032CC36DDE701887
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Punta_Arenas) {.. {-9223372036854775808 -17020 0 LMT}.. {-2524504580 -16966 0 SMT}.. {-1892661434 -18000 0 -05}.. {-1688410800 -16966 0 SMT}.. {-1619205434 -14400 0 -04}.. {-1593806400 -16966 0 SMT}.. {-1335986234 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}.. {37767600 -14400 0 -04}.. {55915200 -10800 1 -04}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8104
                                                                                                                                                                                    Entropy (8bit):3.8351355650290304
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:InJkLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:IJ3qtfA604qSBgI7DBch
                                                                                                                                                                                    MD5:98E0F428A3773CE6FF0CEBF2F88EA81A
                                                                                                                                                                                    SHA1:3DFA7D21A31C99078A139C5F41740B8EAD4085C2
                                                                                                                                                                                    SHA-256:B1630FA919D652F30D23253E1C561BB76FB4D28844A2F614D08B0A25B17CFB27
                                                                                                                                                                                    SHA-512:11C8E1F15B3FDC36DAD12229038BE10DA231872F804BD9FFF1786192541C4ABAFB27099C24EC3122F92A0D94D7D4A6E1ACD0A05845EC614982176A859B74E9FF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rainy_River) {.. {-9223372036854775808 -22696 0 LMT}.. {-2366732504 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-923248800 -18000 1 CDT}.. {-880214400 -18000 0 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {136368000 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {167817600 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200 -18000 1 CDT}.. {278492400 -21600 0 CST}.. {294220800 -18000 1 CDT}.. {309942000 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CS
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7614
                                                                                                                                                                                    Entropy (8bit):3.8349162993762267
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Wi8h4ZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:bqOfA604qSBgI7DBch
                                                                                                                                                                                    MD5:793DAEDB7E3077DE52DCC3C8A7CBEC5B
                                                                                                                                                                                    SHA1:37562E9F28D51DED41FFD5FF2FF19E2E4E453B7A
                                                                                                                                                                                    SHA-256:AA8866D58BEAB07548180628FF423887BBF48AADB1B55392B288F7310F94A9B1
                                                                                                                                                                                    SHA-512:68A32B41DC2D3E730D6BE53656B0D566AB1BCC1E189A2FFDB5687A947EF4F4008BC17456F8CE0D59C838EEA87A44400231A44E6AB35BEDBF5D7779E1CD7EFD8A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rankin_Inlet) {.. {-9223372036854775808 0 0 -00}.. {-410227200 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {7
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1420
                                                                                                                                                                                    Entropy (8bit):3.78262494063765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5aLexyGcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaI1kR8nd:5eTChlvEw6kSSx5H4a8tf3fkuoYVZDm+
                                                                                                                                                                                    MD5:4D12651CEE804EB9F29567CB37F12031
                                                                                                                                                                                    SHA1:54B2613475B8BDB1DBCCA53A4895DA021F66BDC0
                                                                                                                                                                                    SHA-256:A36AD4614FC9A2A433712B555156EDE03980B88EB91D8DC7E8B10451D6D7F7D3
                                                                                                                                                                                    SHA-512:E6690F6B6DF613C8B7289A2DB71FBC9B87B997707A6C3B4B45BDE8F347082AE8C69F212BAACE50F3C04E325ABE0976AF1F61107BDF8A15D5B88F11FAE11A9D00
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Recife) {.. {-9223372036854775808 -8376 0 LMT}.. {-1767217224 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1781
                                                                                                                                                                                    Entropy (8bit):4.034282439637634
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290hjmdHfCv24Q1NAvHaE+YB+Q4kRcMxIeRUVX/SEQd1rRR9xRv0+Ro/wPjp:5EjeavTGOtAVvSRBpx0yq1epwD+yz+
                                                                                                                                                                                    MD5:14B29B4391B643E5707096ADCC33C57E
                                                                                                                                                                                    SHA1:B3F875ABB79C634C74307B7CB7B276B13AEE11D1
                                                                                                                                                                                    SHA-256:50105E788288CF4C680B29BBDCDE94D8713A5361B38C6C469FD97CF05503FF7D
                                                                                                                                                                                    SHA-512:D92A51547DF2C1AB6E6CDEFF34C07B755D3F6BB5E7DD1907693E7658EDE4D2BADC5DEFDB658ADD0F8D8F14B3B87CEA17BC00DAC364C5CB7ACBF8778C245276A9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Regina) {.. {-9223372036854775808 -25116 0 LMT}.. {-2030202084 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1251651600 -21600 1 MDT}.. {-1238349600 -25200 0 MST}.. {-1220202000 -21600 1 MDT}.. {-1206900000 -25200 0 MST}.. {-1188752400 -21600 1 MDT}.. {-1175450400 -25200 0 MST}.. {-1156698000 -21600 1 MDT}.. {-1144000800 -25200 0 MST}.. {-1125248400 -21600 1 MDT}.. {-1111946400 -25200 0 MST}.. {-1032714000 -21600 1 MDT}.. {-1016992800 -25200 0 MST}.. {-1001264400 -21600 1 MDT}.. {-986148000 -25200 0 MST}.. {-969814800 -21600 1 MDT}.. {-954093600 -25200 0 MST}.. {-937760400 -21600 1 MDT}.. {-922039200 -25200 0 MST}.. {-906310800 -21600 1 MDT}.. {-890589600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-748450800 -21600 1 MDT}.. {-732729600 -25200 0 MST
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7610
                                                                                                                                                                                    Entropy (8bit):3.8312000314798085
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:li8h4Z80NA604qSScBgN+4ctDzIVQ/c/3hNxTh:EqOzA604qSBgI7DBch
                                                                                                                                                                                    MD5:541EACD872723603971058CB205121D7
                                                                                                                                                                                    SHA1:8F7DFD5ECA2913846D9342839AE1C60882153DA0
                                                                                                                                                                                    SHA-256:643CC43E3F906779C040E1F0C20E78D6E95CC7301B3C7370A8ADBCBD76A8C5E8
                                                                                                                                                                                    SHA-512:971D06D3FB67B7AE79EEDB6D3EBB805B5992C2BF4A7166016B405E21BFB25D9A87A757E8065073D5FBEB9084F6F742269A5BF432BF2F03D30913DB092E1AB3A1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Resolute) {.. {-9223372036854775808 0 0 -00}.. {-704937600 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {73391
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1112
                                                                                                                                                                                    Entropy (8bit):3.8413073465060457
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5Ybe/k5Yss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6Gs:505YsMw57XJh4CxUF/A6GTrtSUDwr
                                                                                                                                                                                    MD5:7E23FDE0E158E8ED2E7536EDE70D2588
                                                                                                                                                                                    SHA1:319052BE076DC79F130E807D68B11CCAA0636340
                                                                                                                                                                                    SHA-256:28082D20872B61D6098D31D1C40F12464A946A933CD9AF74475C5AF384210890
                                                                                                                                                                                    SHA-512:BE078ED12F05AB5CEE5D77212EB76A01A1BC52EEAA17E3B91D93B88D75E5281B6AF164E712A9AB0F57A21B3CDB20F6FCCADB73CAC4745B5D2E665D18F9F06B55
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rio_Branco) {.. {-9223372036854775808 -16272 0 LMT}.. {-1767209328 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {57120480
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):219
                                                                                                                                                                                    Entropy (8bit):4.801485647578614
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7/MSHAIgp/M1ovN/290rI5290/M7:MByMY/M7p/M16t290r190/M7
                                                                                                                                                                                    MD5:90830F3B1F91FE48AC2944C7C92A3F6E
                                                                                                                                                                                    SHA1:777377AE4959DDD2B472EB6041A23A5B93D64BB6
                                                                                                                                                                                    SHA-256:0117D33D4F326AA536162D36A02439FBD5F2EB3B4F540B5BA91ED7747DDAC180
                                                                                                                                                                                    SHA-512:20A371E4550E402AFEB83EF19EFFF6B3C0D7A68DCAA06AD894D04DB63B7096560E701C45B455B23A98BB20FE3B590F920219152415CA506AEDA427BB1381B826
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):194
                                                                                                                                                                                    Entropy (8bit):4.869058214823402
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7ekHAIgpeON/290tX2U490eBn:MByMYMpJt290c90m
                                                                                                                                                                                    MD5:F4E62378AA05771D348AA6DA516CD386
                                                                                                                                                                                    SHA1:07FCA813693F7944CBCBB128F2F2FE32929D37A2
                                                                                                                                                                                    SHA-256:3B4C2F3A5B9CD22A73F05187C032723D07BB53C9946D04D35E1BA1CB90CA0A62
                                                                                                                                                                                    SHA-512:E9F6CEB824D656CA25A72BF8EB4347A22E1A8E40410F01E0C2EDE19ACAF32D76540399796B3EBC7781C8B5D48C1A6B2C856CA06158AE37D95C95CF0567DFA2E5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Santa_Isabel) $TZData(:America/Tijuana)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1079
                                                                                                                                                                                    Entropy (8bit):3.8200568741699223
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5zeUdunSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/h:52SeSFESoSQSrSsCSeSPS1cSQSQlSsSU
                                                                                                                                                                                    MD5:7F2658032008F2C1308F121C2EBF2479
                                                                                                                                                                                    SHA1:B6F24E818B4424C0DEF818C103D1DA5359958932
                                                                                                                                                                                    SHA-256:4A397BD937DE1D7E6A941D18001B34D4CD195AEFD08951C30C7EE8E48656AA0E
                                                                                                                                                                                    SHA-512:F78853AA75F58A85555DD79E08A7487E5161854650DBF480189790D855738FEDCBDA936870067DE40FE000861008A9E9AAF61DF02B6B30B96038C61B5E1F1C1D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santarem) {.. {-9223372036854775808 -13128 0 LMT}.. {-1767212472 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8871
                                                                                                                                                                                    Entropy (8bit):3.5333393351633897
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:5Gv/IxUQjzoMUBI0nuUoDK6lPlgiot7JC/k8NWse4r4g5xCEmMQUs8nCxvisEbzQ:5Aa9TzDCjg32+E
                                                                                                                                                                                    MD5:0659C7482FC6121AF4714DA6E2188069
                                                                                                                                                                                    SHA1:79D8B13C54AEDE9EDC191EB92F8CD6BE936490F4
                                                                                                                                                                                    SHA-256:B2D7FD4DB34800C9EF9BD73CDDB1105543CCED05F3E2AC99F3E5E2F6CF340AE2
                                                                                                                                                                                    SHA-512:C138C580648D7EAAB22828EA4318F6FAEEF618B994C2E05AF23ACF03A279506053C85BFDBC03B9E32B1CA5826713D7FFC249CE33B3F0EA734A2E4CE626AAB3A3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santiago) {.. {-9223372036854775808 -16966 0 LMT}.. {-2524504634 -16966 0 SMT}.. {-1892661434 -18000 0 -05}.. {-1688410800 -16966 0 SMT}.. {-1619205434 -14400 0 -04}.. {-1593806400 -16966 0 SMT}.. {-1335986234 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-740520000 -10800 1 -03}.. {-736376400 -14400 0 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):616
                                                                                                                                                                                    Entropy (8bit):4.330655351784895
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290/StmdHhvCvuCY/h/uFkS/5MVvMrW//MVvMrpx/m0XVvMr4UB/47VvMr/d:5+seQvuCY5/u/REfk+xxdbUBQpu652GO
                                                                                                                                                                                    MD5:FAD0621010889164ADC4472003C9391F
                                                                                                                                                                                    SHA1:C4EE0B8D6925338D17D5745DE9D45FA3C628DFC5
                                                                                                                                                                                    SHA-256:2217E72B11A90F2D679C175DE3CC0F2FED4C280C9FF9707CFFAF118BF9A06A4B
                                                                                                                                                                                    SHA-512:90E8E5A109CD72458C7796CF0324F63E543CCD63D13A09A3DD28EDC8B2793C964C18E79FDF0C5067C5A481B7FB03E8413139C32F59DA07E9D7893378ABBBD2B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santo_Domingo) {.. {-9223372036854775808 -16776 0 LMT}.. {-2524504824 -16800 0 SDMT}.. {-1159773600 -18000 0 EST}.. {-100119600 -14400 1 EDT}.. {-89668800 -18000 0 EST}.. {-5770800 -16200 1 -0430}.. {4422600 -18000 0 EST}.. {25678800 -16200 1 -0430}.. {33193800 -18000 0 EST}.. {57733200 -16200 1 -0430}.. {64816200 -18000 0 EST}.. {89182800 -16200 1 -0430}.. {96438600 -18000 0 EST}.. {120632400 -16200 1 -0430}.. {127974600 -18000 0 EST}.. {152082000 -14400 0 AST}.. {975823200 -14400 0 AST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2900
                                                                                                                                                                                    Entropy (8bit):3.6548008349990755
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5uFChlvEwR9xSSx5H4a8tf3fku+da2XUd23t8VZDG8+w/ghBPWTRz908a9zRgwun:cFIlvEwZSSxdF8tfMu+da2kdCt8VZy8n
                                                                                                                                                                                    MD5:F6B732A862659EB131C2E6FEC00E9734
                                                                                                                                                                                    SHA1:49517DF63BC5B6FEC875CE9477BBF84F4072FA31
                                                                                                                                                                                    SHA-256:0E7BA1C5A3FA3DABDAA226BFE1E8D797A3835EA554828881AB5E365EDA09B92E
                                                                                                                                                                                    SHA-512:670A5B604B5EA0F5FA15083BC1EA115B7EFD449F9EAC4518E109493591893DD3627AFC6628E0EDD1953E932E2A7AD9B5A379526548677158EC445366E4ED7166
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sao_Paulo) {.. {-9223372036854775808 -11188 0 LMT}.. {-1767214412 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-195429600 -7200 1 -02}.. {-189381600 -7200 0 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6839
                                                                                                                                                                                    Entropy (8bit):3.565857684485945
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:9OgtbdF7TI7nYUYXg9W/OAcv7vuShytWi0PnvLrqPoKR2XszXckXtogYN4Ezlk0X:PJr9Q7TMq+ML
                                                                                                                                                                                    MD5:D1BF579FE8123E8EE9248A51E794CC78
                                                                                                                                                                                    SHA1:BF9CB9BED143C7529719E0C1E2F88BE1AC9F8DD4
                                                                                                                                                                                    SHA-256:158BD9E4EB0B9DFF3F2D3E2DBA72F217B73423012DD33A688FD57852124E884A
                                                                                                                                                                                    SHA-512:78192AC38912021F848592D0B208CB122EFFC6DDB326540FFAADA4FD3322B7A442FD1116F408D64B8788520B46545DFAE571EA42046D62A282A97ECCD5663655
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Scoresbysund) {.. {-9223372036854775808 -5272 0 LMT}.. {-1686090728 -7200 0 -02}.. {323841600 -3600 0 -01}.. {338961600 -7200 0 -02}.. {354679200 0 0 +00}.. {370400400 -3600 0 -01}.. {386125200 0 1 +00}.. {401850000 -3600 0 -01}.. {417574800 0 1 +00}.. {433299600 -3600 0 -01}.. {449024400 0 1 +00}.. {465354000 -3600 0 -01}.. {481078800 0 1 +00}.. {496803600 -3600 0 -01}.. {512528400 0 1 +00}.. {528253200 -3600 0 -01}.. {543978000 0 1 +00}.. {559702800 -3600 0 -01}.. {575427600 0 1 +00}.. {591152400 -3600 0 -01}.. {606877200 0 1 +00}.. {622602000 -3600 0 -01}.. {638326800 0 1 +00}.. {654656400 -3600 0 -01}.. {670381200 0 1 +00}.. {686106000 -3600 0 -01}.. {701830800 0 1 +00}.. {717555600 -3600 0 -01}.. {733280400 0 1 +00}.. {749005200 -3600 0 -01}.. {764730000 0 1 +00}.. {780454800 -3600 0 -01}.. {796179600 0 1 +00}.. {8
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):187
                                                                                                                                                                                    Entropy (8bit):4.888573146674231
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/2IAcGEtOFBx+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/290tO09Z
                                                                                                                                                                                    MD5:2FF74846ADF32AA3A9418376775B7F25
                                                                                                                                                                                    SHA1:130D7548DFFEBCE74969962E335B40299D7C5C54
                                                                                                                                                                                    SHA-256:BF4FAB3AE72CC7FA4F9E34CF0551A85C54A084CD826DF5D9CC684DE6188E84DB
                                                                                                                                                                                    SHA-512:9E52C017E595EEF1C68C8A1943416A9109D7DB4C32D25F83D05213C4200869A50E2E726894E39ECA364C558BB7F5566F6150CEA5D3CB14D1DEAE28C3D8C810E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:America/Shiprock) $TZData(:America/Denver)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8651
                                                                                                                                                                                    Entropy (8bit):3.959337076866423
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:IGCG0hPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:I5G0A9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                    MD5:7CCB6902749079A0496F1E2E2137448E
                                                                                                                                                                                    SHA1:3D0ED7BF1C26659F6794E26AE3869F8AB925B6DF
                                                                                                                                                                                    SHA-256:ABB08435CAE80119068A85984BFFE9C1596F4FB90F07CC01124C907E5162C189
                                                                                                                                                                                    SHA-512:0B5B2DCECC70F357DB6D590AB63E600C572EA6B3F430565EFEB29777B1901AAC55CACC7495C668F739201076B180402141BC1B2ED2357E9B4DFBABF3B122AB44
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sitka) {.. {-9223372036854775808 53927 0 LMT}.. {-3225223727 -32473 0 LMT}.. {-2188954727 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {3099492
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):207
                                                                                                                                                                                    Entropy (8bit):4.932842207797733
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290txP90ppv:MByMYbpwt2907P90b
                                                                                                                                                                                    MD5:CBFA61DBF6F7459CF8D517402B29998E
                                                                                                                                                                                    SHA1:A562B29C9470DBD25480966B0462433124BA4164
                                                                                                                                                                                    SHA-256:353CDBD46BA8C7472A93E9E800A69105801F6784B22EC50A59294CDC3BE40E18
                                                                                                                                                                                    SHA-512:00B333EAA2C32EDDA8F06457AD0E10013A0147B20F504F4F1096656F731A7C1896D5ABD83E7EDBD5D4E7DA587EE9BFA796539EB1E9F4056D75D1FDF203251150
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Barthelemy) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11289
                                                                                                                                                                                    Entropy (8bit):3.8713946894934614
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:PmxVjd1cO8f7/EjUhSicN6zvfwb+8YbTE0M0J:PmrcOI7/EjiskY01J
                                                                                                                                                                                    MD5:8F068899DA75663128320633E1881333
                                                                                                                                                                                    SHA1:E9161B45D7B11A2DD6E9679AC080E84EC51561E3
                                                                                                                                                                                    SHA-256:E2917204B0C843C32051BB371CF6D0AD272C02720B9C0D913AC072C8ABE1EC64
                                                                                                                                                                                    SHA-512:2200E9B9D816157330ADAEA7383635876E5A37329B1AF9613D38BCFBE8143835837A25132A94E44A61DB8058ED98B1A33F295EA64BC1F4CE30966D52BB0B673D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/St_Johns) {.. {-9223372036854775808 -12652 0 LMT}.. {-2713897748 -12652 0 NST}.. {-1664130548 -9052 1 NDT}.. {-1650137348 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1598650148 -9052 1 NDT}.. {-1590100148 -12652 0 NST}.. {-1567286948 -9052 1 NDT}.. {-1551565748 -12652 0 NST}.. {-1535837348 -9052 1 NDT}.. {-1520116148 -12652 0 NST}.. {-1503782948 -9052 1 NDT}.. {-1488666548 -12652 0 NST}.. {-1472333348 -9052 1 NDT}.. {-1457216948 -12652 0 NST}.. {-1440883748 -9052 1 NDT}.. {-1425767348 -12652 0 NST}.. {-1409434148 -9052 1 NDT}.. {-1394317748 -12652 0 NST}.. {-1377984548 -9052 1 NDT}.. {-1362263348 -12652 0 NST}.. {-1346534948 -9052 1 NDT}.. {-1330813748 -12652 0 NST}.. {-1314480548 -9052 1 NDT}.. {-1299364148 -12652 0 NST}.. {-1283030948 -9052 1 ND
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):202
                                                                                                                                                                                    Entropy (8bit):4.907031043022691
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tMp490ppv:MByMYbpwt290g490b
                                                                                                                                                                                    MD5:D521F2D9B28C5374FC3BD540C6B6F40D
                                                                                                                                                                                    SHA1:39A3D86CB71F742F33B02F50B316638815B3CD4E
                                                                                                                                                                                    SHA-256:EDB9457A7C64E47062BDC6458FD3BCFCD6C37820F1A2BC89DFE99ED77355011F
                                                                                                                                                                                    SHA-512:05C1BE92550A962904ED3BB7DECCAC16FCB54D258F24F2AEDF755FCC44E4FEF5F86AB663945809F5D7AFA64178E807BBDAE77048270ED516DFF2C7720A746D52
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Kitts) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):202
                                                                                                                                                                                    Entropy (8bit):4.9037013606484905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tY90ppv:MByMYbpwt290a90b
                                                                                                                                                                                    MD5:9392E5A7BD198B0308F9271E4C7E59B2
                                                                                                                                                                                    SHA1:A902440920A0318BC930957C74804A9A51EF7818
                                                                                                                                                                                    SHA-256:6727A509BB937CB3446D41B57826DE70C7028E96F088AB5B7F803BEAA18279E8
                                                                                                                                                                                    SHA-512:6DA1EAC390E72905DF1A14D82362B499D20FAD6D85F3DF116AE01E566D5D19C6D16E56DA72C458BB6143345EF45F35A53B245488C641D80BFBA200B16A59719E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Lucia) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):203
                                                                                                                                                                                    Entropy (8bit):4.919272465019375
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tXIMFJ490ppv:MByMYbpwt290tJ490b
                                                                                                                                                                                    MD5:49D0C8DAFCA053C9967EDCC4C0A484B1
                                                                                                                                                                                    SHA1:7B4999D4B9AD93306BD411DF2946D741EC597770
                                                                                                                                                                                    SHA-256:974AEED3D79124B50265C83D84F23CBE4F0328D00C75F42DD3ABC5D4C0A78DE1
                                                                                                                                                                                    SHA-512:378E3657B26C5A039FF82ECCAC7797FF45CBC6479596629B3048164EE4E035F4ECFC557AA9EAF6848E78999B4FF8C63E53C7163BDF6F626ED6111004490D6F80
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Thomas) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):4.909053768717241
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290tzb+Q90ppv:MByMYbpwt290xyQ90b
                                                                                                                                                                                    MD5:6CFB23E7164605CDE380FB7C4D88DF11
                                                                                                                                                                                    SHA1:CC513B29AD7B59E600DBCBC97927EB632558F657
                                                                                                                                                                                    SHA-256:6B19404D295964EF66F47802836BB728FCE8E6481115797C0B5F200C354D7C8A
                                                                                                                                                                                    SHA-512:728987D0925B6E12E8A220920BEDF94180880E78F3F08F6AC740E6304B22D446846068CEA499F61E7032ADB2E700CE31954921D478C9A8B6CB599E05A6292EA3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Vincent) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):874
                                                                                                                                                                                    Entropy (8bit):4.253846650171654
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86290hEbmdHLCvYX4Q19xRv0+RmwPj+uLkQOzL3+ORL4FXgenM7RSslKA1PyKp:5zeOvT4xuyqoYaAxt7l
                                                                                                                                                                                    MD5:C91F801CC5E9F78B966D1DF2259C38A8
                                                                                                                                                                                    SHA1:D29C970CBFC74684D46AAAD543B73B520775632C
                                                                                                                                                                                    SHA-256:939B25C9412B9E25D73F552E87826999FC8C929770E66491D1E4530046D3E758
                                                                                                                                                                                    SHA-512:093378E61DE9310F9C48170CBB0FDBD3C79E184DA1489F759B20BCE410006A9D5A793C82E79A46E0AFF0DAA47D9DBAFD605959E491BA9ED4E55D26F293642D32
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Swift_Current) {.. {-9223372036854775808 -25880 0 LMT}.. {-2030201320 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-747241200 -21600 0 MDT}.. {-732729600 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {-684342000 -21600 1 MDT}.. {-671040000 -25200 0 MST}.. {-652892400 -21600 1 MDT}.. {-639590400 -25200 0 MST}.. {-631126800 -25200 0 MST}.. {-400086000 -21600 1 MDT}.. {-384364800 -25200 0 MST}.. {-337186800 -21600 1 MDT}.. {-321465600 -25200 0 MST}.. {-305737200 -21600 1 MDT}.. {-292435200 -25200 0 MST}.. {-273682800 -21600 1 MDT}.. {-260985600 -25200 0 MST}.. {73472400 -21600 0 CST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):341
                                                                                                                                                                                    Entropy (8bit):4.638828647226646
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2903fDm2OHskeoHxbV1ULhgdrV/uF+IcmJ3/uF+ivi9/uF+SNv:MB862903LmdHsVCn1ULSB/uF+QV/uF+q
                                                                                                                                                                                    MD5:4C4034ABAB9E4804CCB23E51694044C9
                                                                                                                                                                                    SHA1:7DB24CE83AB2C07E6F6784D27C4E3AC0F149D080
                                                                                                                                                                                    SHA-256:1F0503579B0DDDBAF88814A278127D9CD7019EDD3C35F4CBFC0EF11C0EDAFE5B
                                                                                                                                                                                    SHA-512:0BC366CD3AB2E1388D11770DC8DEC1FC94C48FDC846ABB6C487828BF9FF15CD9A1C15B33E08F6E48B7F4A6F2AD1617FF12B359784CA4C32256D72422E6825105
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tegucigalpa) {.. {-9223372036854775808 -20932 0 LMT}.. {-1538503868 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}.. {1146981600 -18000 1 CDT}.. {1154926800 -21600 0 CST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6890
                                                                                                                                                                                    Entropy (8bit):3.8331465442823704
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mJInJuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/Bm6BTd69xK7KjhVbHyR3h1gOZM:miFCC
                                                                                                                                                                                    MD5:D93B62D5F7EEBC28AC047BED2307CAE8
                                                                                                                                                                                    SHA1:8B3E02240A01B5AA42D30E86005E880916432227
                                                                                                                                                                                    SHA-256:7FB0CBB101D3B6FBB6B9DAD5446BBF9E6AEC65EC38472739E604F68F6AA9AB7B
                                                                                                                                                                                    SHA-512:3648106F4DF84CFD94AAD4E9430F8D3BBCB38A9196DE9A59246DFBBC170FADBF106DD1FD08FE2E4F7319BFFB1C2607E4F5D563C222CED8267483D1A0C388CCE5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thule) {.. {-9223372036854775808 -16508 0 LMT}.. {-1686079492 -14400 0 AST}.. {670399200 -10800 1 ADT}.. {686120400 -14400 0 AST}.. {701848800 -10800 1 ADT}.. {717570000 -14400 0 AST}.. {733903200 -10800 1 ADT}.. {752043600 -14400 0 AST}.. {765352800 -10800 1 ADT}.. {783493200 -14400 0 AST}.. {796802400 -10800 1 ADT}.. {814942800 -14400 0 AST}.. {828856800 -10800 1 ADT}.. {846392400 -14400 0 AST}.. {860306400 -10800 1 ADT}.. {877842000 -14400 0 AST}.. {891756000 -10800 1 ADT}.. {909291600 -14400 0 AST}.. {923205600 -10800 1 ADT}.. {941346000 -14400 0 AST}.. {954655200 -10800 1 ADT}.. {972795600 -14400 0 AST}.. {986104800 -10800 1 ADT}.. {1004245200 -14400 0 AST}.. {1018159200 -10800 1 ADT}.. {1035694800 -14400 0 AST}.. {1049608800 -10800 1 ADT}.. {1067144400 -14400 0 AST}.. {1081058400 -10800 1 ADT}.. {1099198800 -14400 0 AST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8330
                                                                                                                                                                                    Entropy (8bit):3.832494305415669
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:tDbEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:tvEItON0HY2iUmUFLqU
                                                                                                                                                                                    MD5:8DD2E298AEB672F32AD8B44A0A84431A
                                                                                                                                                                                    SHA1:9687C478FC6803F4FFCA125D921DF821181B8E75
                                                                                                                                                                                    SHA-256:0F95CE0A36415B43E7B5E6CD790D3BD9EF6D53F4B7AA0235360C0847CBB3F0C1
                                                                                                                                                                                    SHA-512:9380327C04FC48A61423F161DFD4AC1C431278D5B392F585DCEB1D893CB8212C4093A92D5D089BC23DF0B5BB6F99595937999A6B1E843DAE1AF36D76B0858281
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thunder_Bay) {.. {-9223372036854775808 -21420 0 LMT}.. {-2366733780 -21600 0 CST}.. {-1893434400 -18000 0 EST}.. {-883594800 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {18000 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {94712400 -18000 0 EST}.. {126248400 -18000 0 EST}.. {136364400 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {167814000 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {35711
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8755
                                                                                                                                                                                    Entropy (8bit):3.8517632099398114
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:c4uS6mjvZk53mtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:J6jFOzN6IkWq/WHQt/RY4yP
                                                                                                                                                                                    MD5:8F912B1F7E3144EE787E4386B1AE2AF1
                                                                                                                                                                                    SHA1:60236FC9AB9C06F614C76357915B57B286721BC6
                                                                                                                                                                                    SHA-256:FE3681F580ED7F3F2FD21F510DFF1BEF81BD521737F5846FA15FD309E44E69BE
                                                                                                                                                                                    SHA-512:87EA33079EEFED848150884BC41131B2CC49B0AAA5FA10C0700818A8C292F1F3AD928E98C98EF34EFC48F0E3AFB3CBBBE3D09C483A2CDA545DFF7CB77D29CB3E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tijuana) {.. {-9223372036854775808 -28084 0 LMT}.. {-1514736000 -25200 0 MST}.. {-1451667600 -28800 0 PST}.. {-1343062800 -25200 0 MST}.. {-1234803600 -28800 0 PST}.. {-1222963200 -25200 1 PDT}.. {-1207242000 -28800 0 PST}.. {-873820800 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-761677200 -28800 0 PST}.. {-686073600 -25200 1 PDT}.. {-661539600 -28800 0 PST}.. {-504892800 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}.. {-355330800 -28800 0 PST}.. {-337186800 -25200 1 PDT}.. {-323881200 -28800 0 PST}.. {-305737200 -25200 1 PDT}.. {-292431600 -28800 0 PST}.. {-283968000 -28800 0 PST}.. {189331200 -28800 0 PST}.. {19
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11248
                                                                                                                                                                                    Entropy (8bit):3.8061065077303926
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:lBew85RnK1a8phYBNXEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:lBq5RnK1a8phYTXEItON0HY2iUmUFLqU
                                                                                                                                                                                    MD5:0D906EC3F658730131A65C5A770D885F
                                                                                                                                                                                    SHA1:BFA72C43BCE0F37F795E974457FBE4A664687B38
                                                                                                                                                                                    SHA-256:5A98C6BEDDA4DF608051D702A8E037093A8068E1B85F8F55D42B4468F45662A5
                                                                                                                                                                                    SHA-512:CC634DAF4EEC7F57E3AB0C20D891380A7F96DE79602A7B57C6C2BF229DD76A69B399A689FA6D0675380B1432C2115B0C8577DC49C3C9E567A08CAD6FCC3599BC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Toronto) {.. {-9223372036854775808 -19052 0 LMT}.. {-2366736148 -18000 0 EST}.. {-1632070800 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1609441200 -18000 0 EST}.. {-1601753400 -14400 1 EDT}.. {-1583697600 -18000 0 EST}.. {-1567357200 -14400 1 EDT}.. {-1554667200 -18000 0 EST}.. {-1534698000 -14400 1 EDT}.. {-1524074400 -18000 0 EST}.. {-1503248400 -14400 1 EDT}.. {-1492365600 -18000 0 EST}.. {-1471798800 -14400 1 EDT}.. {-1460916000 -18000 0 EST}.. {-1440954000 -14400 1 EDT}.. {-1428861600 -18000 0 EST}.. {-1409504400 -14400 1 EDT}.. {-1397412000 -18000 0 EST}.. {-1378054800 -14400 1 EDT}.. {-1365962400 -18000 0 EST}.. {-1346605200 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-1238954400
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):201
                                                                                                                                                                                    Entropy (8bit):4.864308662322047
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290RRKl290ppv:MByMYbpwt290V90b
                                                                                                                                                                                    MD5:21D152A2359A4EFDE6DCC304F16096F3
                                                                                                                                                                                    SHA1:961B3CFB351615604981114A115D396D1F2006A2
                                                                                                                                                                                    SHA-256:46A236EC38F3A122D414208328A462B2A937392ECC6C55F673FB7A402F118D96
                                                                                                                                                                                    SHA-512:04A2AD6DDC2E7B0D3F95DA1C731FF553F8CBC0DD6BDFC36FB2EDCE755612103E3B4EA6F3AB7FE63CA60976538EFABF40827539DFC35B7E83129BD48471FE514B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Tortola) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9815
                                                                                                                                                                                    Entropy (8bit):3.8481935495337356
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:sOR864CjSAG5a9bFzN6IkWq/WHQt/RY4yP:sO664CjSAGYbGBt/M
                                                                                                                                                                                    MD5:9423BC81647BC4C37888860CE0518BBB
                                                                                                                                                                                    SHA1:37E6E6554576D1DD36C3494EAF0BD169003D870D
                                                                                                                                                                                    SHA-256:00B5FB8F37DFF43925C501AEAB039F39F058E002572C4203286317046CC1D700
                                                                                                                                                                                    SHA-512:1830CA2B62B7CA6EEB5A924D2148925DF7DD87A7B93B21F4F023E4678EF42DC20BFF57F702923E10F4382FE6757323D21414D094E99FEEB43316DE4A7E5A909E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Vancouver) {.. {-9223372036854775808 -29548 0 LMT}.. {-2713880852 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-747237600 -25200 1 PDT}.. {-733935600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-4
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):200
                                                                                                                                                                                    Entropy (8bit):4.914983069791254
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7p5oeSHAIgppON/290RXgr490ppv:MByMYbpwt290xg090b
                                                                                                                                                                                    MD5:9F7DA15BE387B8F7DEC5DFFE069F3505
                                                                                                                                                                                    SHA1:D298B963B0048E9ECA3BC7B85248506AB1388479
                                                                                                                                                                                    SHA-256:561D9D04B0CE0F96A9C351C7D5C30AA1D5A42A3D70066CD9AF0DA6CBC5388DBE
                                                                                                                                                                                    SHA-512:606C2A918633C74BD2954D39B00EFA2CD9DA852BC7034F129A04258A65DC74942FA0826E9BC6E4433926E7F1375612554B04845077E434D0CD3BD15832DC6B95
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Virgin) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2971
                                                                                                                                                                                    Entropy (8bit):3.9652694533791917
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5CeFvmpn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5BmCKpj/AOZFCARCeQbvb5wxMN6Ix
                                                                                                                                                                                    MD5:2F2D39B5FB844E170FA7B6AF11B948CA
                                                                                                                                                                                    SHA1:3D89672134D979FCF65225A58249380D9C8A4A65
                                                                                                                                                                                    SHA-256:8E0BC71BD7146145DDE3C064AE205DF08124FE2402853A9655B0EB799E90F31F
                                                                                                                                                                                    SHA-512:6C046D1133C8CCF697C8FB553A1F539948F71FA80BA447B87AA8D1D1D7113B32A6B764C5C1734C615319A27961B6116FCA087EB571869119BE87656FCA351498
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Whitehorse) {.. {-9223372036854775808 -32412 0 LMT}.. {-2188997988 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9695
                                                                                                                                                                                    Entropy (8bit):3.8209220355628766
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:pOEhc8/rvNZONqXXyIjNA604qSScBgN+4ctDzIVQ/c/3hNxTh:pY8DvbO+A604qSBgI7DBch
                                                                                                                                                                                    MD5:E8DB00D2B99B308018F4F5E48AC47C3A
                                                                                                                                                                                    SHA1:8841467CB264DC9F87FABAADBE90EE2C8DACC80F
                                                                                                                                                                                    SHA-256:F3FC5F6D93D1D9EB0F3DED33873F33C47F841797D96439966F8E0A5A189941FA
                                                                                                                                                                                    SHA-512:5D684B07332ED53F9F8CB71FFF3B6D0F848426A5E4D9E7DA84E49E358C666F1C3BB9CF21352D939B35B558FC691839E24BC84656317F73C768B474AF5AC480EB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Winnipeg) {.. {-9223372036854775808 -23316 0 LMT}.. {-2602258284 -21600 0 CST}.. {-1694368800 -18000 1 CDT}.. {-1681671600 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1029686400 -18000 1 CDT}.. {-1018198800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-746035200 -18000 1 CDT}.. {-732733200 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620755200 -18000 1 CDT}.. {-607626000 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8683
                                                                                                                                                                                    Entropy (8bit):3.957710943557426
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:po1acs6yyyxC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:p4acsW9DiaJCUbPI+D/iMpCIBSuk
                                                                                                                                                                                    MD5:18EC35FCEC15CE9304818E22222411EF
                                                                                                                                                                                    SHA1:F4A04B3E2B5F55C9582F578C3142E706C4EB6BD6
                                                                                                                                                                                    SHA-256:79B44F245D86A4EC299D1A9A2EDB2AB92D50AB5A7C1C03759D283AC4070F9005
                                                                                                                                                                                    SHA-512:40AC47AC278DF22C7ECFF568456E7C3767B38701B9A2E2639C2201DC53CDD794CF7521BCB773A8AF2A8D4A034D3BBD35BF9788FB5B4E4D51A7A139B3B3353479
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yakutat) {.. {-9223372036854775808 52865 0 LMT}.. {-3225223727 -33535 0 LMT}.. {-2188953665 -32400 0 YST}.. {-883580400 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-757350000 -32400 0 YST}.. {-31503600 -32400 0 YST}.. {-21474000 -28800 1 YDT}.. {-5752800 -32400 0 YST}.. {9975600 -28800 1 YDT}.. {25696800 -32400 0 YST}.. {41425200 -28800 1 YDT}.. {57751200 -32400 0 YST}.. {73479600 -28800 1 YDT}.. {89200800 -32400 0 YST}.. {104929200 -28800 1 YDT}.. {120650400 -32400 0 YST}.. {126702000 -28800 1 YDT}.. {152100000 -32400 0 YST}.. {162385200 -28800 1 YDT}.. {183549600 -32400 0 YST}.. {199278000 -28800 1 YDT}.. {215604000 -32400 0 YST}.. {230727600 -28800 1 YDT}.. {247053600 -32400 0 YST}.. {262782000 -28800 1 YDT}.. {278503200 -32400 0 YST}.. {294231600 -28800 1 YDT}.. {30995
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7737
                                                                                                                                                                                    Entropy (8bit):3.8656193813344064
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:42GaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:uPlLv/PCenJzS6cy
                                                                                                                                                                                    MD5:A7606AE597027C26BC90702B2BCC80E9
                                                                                                                                                                                    SHA1:7B2AB2E0A23B8D770D1305A171DBCCE2D471EF2F
                                                                                                                                                                                    SHA-256:B33838F12640C64BA4F10F50657EC4D8D5B30FD226DA4ACA21B169B53AD30576
                                                                                                                                                                                    SHA-512:B18711B4110D6DB0CC7A6EF66639E1B38323F0B61DA4F5287A51BC9EC8534133568C6D3E4F18F6328564DAD291E0CA707768DE4478DD502A40FFD189C08114A1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yellowknife) {.. {-9223372036854775808 0 0 -00}.. {-1104537600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):478
                                                                                                                                                                                    Entropy (8bit):4.205595904143294
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2L09xSDm2OHE5QMFUH+KNUoTVsBEE0ZZICxZbDtVby:MB862LcUmdHE5QMFi+KdTVPZIwXDy
                                                                                                                                                                                    MD5:7D8132A23238C14CCEDD520BBEB49F77
                                                                                                                                                                                    SHA1:A8BAE9269DAA2AC535B292E1AE8632B451A0BBA5
                                                                                                                                                                                    SHA-256:04247ACB2B4FA126D13F4573FF74D15A89CF42B2C5CD7E688D5BB1C1FD3972BF
                                                                                                                                                                                    SHA-512:74FCB14037B0AE11A95B036791D69037590F8EC7F09D90A866E6A6CAAD6D58E4EC3723A3BB356FBF0E25ED1239A5820A8513EBF6653578E4BFB8988D6D20EF13
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Casey) {.. {-9223372036854775808 0 0 -00}.. {-31536000 28800 0 +08}.. {1255802400 39600 0 +11}.. {1267714800 28800 0 +08}.. {1319738400 39600 0 +11}.. {1329843600 28800 0 +08}.. {1477065600 39600 0 +11}.. {1520701200 28800 0 +08}.. {1538856000 39600 0 +11}.. {1552752000 28800 0 +08}.. {1570129200 39600 0 +11}.. {1583596800 28800 0 +08}.. {1601740860 39600 0 +11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                                    Entropy (8bit):4.360007144607037
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2L0mDm2OHEfwz0/MVSYyF/KZ7VoX/MVSYyF/VpVQVF9RXhNXSMVSYy6:MB862LVmdHEIjsF/KZOksF/Vp6v9RRFl
                                                                                                                                                                                    MD5:97AA556F7EF06786B76316133794F4E9
                                                                                                                                                                                    SHA1:B3CDA284DE80987B954E2CC9BFA3ED33462CDD4F
                                                                                                                                                                                    SHA-256:2F36D2E13D7E251322B7A7B30F39645393525CEB49A2B5C26F27797F2AAF4D7F
                                                                                                                                                                                    SHA-512:14C6F17252C2AC89D86FE00BD8A8934D627C85478B0AB08AB6237988922D18616B00878498FFFC0E1978308BC6D775E2DC3ADCEF827AB0A06B214BE4DDABAB52
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Davis) {.. {-9223372036854775808 0 0 -00}.. {-409190400 25200 0 +07}.. {-163062000 0 0 -00}.. {-28857600 25200 0 +07}.. {1255806000 18000 0 +05}.. {1268251200 25200 0 +07}.. {1319742000 18000 0 +05}.. {1329854400 25200 0 +07}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):214
                                                                                                                                                                                    Entropy (8bit):4.938579775653117
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yci/452HAIgObi/4oA6N/2L0/3Zp5/4pv:MByMdNXiU5t2Lkwv
                                                                                                                                                                                    MD5:CC22302B9FAE52E36A2A35C0361E774B
                                                                                                                                                                                    SHA1:45CFD95A5821C4C4FDF2E1519F08029FF0BE664B
                                                                                                                                                                                    SHA-256:96F2AB9A9FFCD10598FDF105F68460CC4B4EBC1F18054D1BC8E39DF6AD24D1AC
                                                                                                                                                                                    SHA-512:FC9084D7B16EAA985681762F2658D32C77EE186D8D3C7225093CC5CB4A6AEB74A3D0A41A904EB6C8AEF7DB110A89497BAFAF811BBC26103F96E5E1D4D4E1002A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Port_Moresby)]} {.. LoadTimeZoneFile Pacific/Port_Moresby..}..set TZData(:Antarctica/DumontDUrville) $TZData(:Pacific/Port_Moresby)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8447
                                                                                                                                                                                    Entropy (8bit):3.850137279218428
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:s1qigkx6WsYyS391QiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:s1q05h1QiAmcOM6e0pj
                                                                                                                                                                                    MD5:81C612A1544910544173687C416841C6
                                                                                                                                                                                    SHA1:4A707B403F0B9556A3D3D50B08BE0F56660F3F0B
                                                                                                                                                                                    SHA-256:C4EA7F1C0B5A0FAE653419F1C6D058BDDD745A3CDBA11900005C157DF23DDC01
                                                                                                                                                                                    SHA-512:122E2DC3D8D61CCDB83E03C9487DD29AABE7AB3F71FE4F6315209AF0BBCFD01FBDC3A1E3F6D910FB0D690378DF852170A9819D8C1EF96BE6BC8C0811BFB453A9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Macquarie) {.. {-9223372036854775808 0 0 -00}.. {-2214259200 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1669892400 39600 0 AEDT}.. {-1665388800 36000 0 AEST}.. {-1601719200 0 0 -00}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {28932480
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.7511104559982
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2L0GRHEzyeyFNMXGm2OHvavFeVU/VPKVVFSTVF9svUX0VQr:SlSWB9eg/2L0zyfXDm2OHEVy/Ur9s/Vg
                                                                                                                                                                                    MD5:7A2AD9BD8F8DEE5C600CABF2D5E9D07B
                                                                                                                                                                                    SHA1:CF5D230A29946B7FA3ECD8EB99F1EF1BF0FA5B50
                                                                                                                                                                                    SHA-256:ACA533B8BC82296373EDEC82F6E0AA45A34D817C7C18FF5E8E94B81C0BD30259
                                                                                                                                                                                    SHA-512:95F8FA68735E88AB15C403191928FA4AA5D1628453BE64B87EE7E8DF9F35FB5DA74A3CED5F5289A13D84A8A12BBB86734E578059CA8B6405399CFF5E33C9384C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Mawson) {.. {-9223372036854775808 0 0 -00}.. {-501206400 21600 0 +06}.. {1255809600 18000 0 +05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):195
                                                                                                                                                                                    Entropy (8bit):4.880387042335617
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3ycqXHAIgObOvRN/2L0z6/fy:MByMdTiYt2LrK
                                                                                                                                                                                    MD5:88EE32AE5C538AEBFDE2D1D944ED5B2B
                                                                                                                                                                                    SHA1:55E7234E6FFF298182A6C8889A9F506CDCE7C959
                                                                                                                                                                                    SHA-256:E9D99293C5B275D8E0D7B066084177EDF670D5B52B81E87608BAB02025F33155
                                                                                                                                                                                    SHA-512:45A3EA146CA719BA6F22E99EAA57AC1DED1C762E19BDFBA176E5FEAC36EC58586F771572DD16ACE09E660F97DEB91A701BA1B1F1AEF3BD8688F3451C0772420A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/McMurdo) $TZData(:Pacific/Auckland)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2613
                                                                                                                                                                                    Entropy (8bit):3.6082359166067905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5fzJS6S4wRSenSOaf7HSKSkSqS7STslSmSMSCSxygSiXS/SrS+S9SfShS7SoSlSL:jdeRtnxaf7HlPlgiot7JC/Xk8NWse4rf
                                                                                                                                                                                    MD5:BDFA5908E735F866FEC16F6B481AD385
                                                                                                                                                                                    SHA1:524AEE21BB97D923A8812A5722AF2FEA43B4D971
                                                                                                                                                                                    SHA-256:1637381A20E9D5C6A530F110BDB08D9515E675C9206F000407D8511074948E61
                                                                                                                                                                                    SHA-512:3D65C7941BA15A698264848F9B6F43ED5B63D4CF86D495334E8E1DC381D63435E9424BBBC389229693D20044FDB8425A7CC805AB5EA055F59D3E0DD4C7AC2A28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Palmer) {.. {-9223372036854775808 0 0 -00}.. {-157766400 -14400 0 -04}.. {-152654400 -14400 0 -04}.. {-132955200 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-101419200 -10800 1 -04}.. {-86821200 -14400 0 -04}.. {-71092800 -10800 1 -04}.. {-54766800 -14400 0 -04}.. {-39038400 -10800 1 -04}.. {-23317200 -14400 0 -04}.. {-7588800 -10800 0 -03}.. {128142000 -7200 1 -03}.. {136605600 -10800 0 -03}.. {389070000 -14400 0 -04}.. {403070400 -10800 1 -04}.. {416372400 -14400 0 -04}.. {434520000 -10800 1 -04}.. {447822000 -14400 0 -04}.. {466574400 -10800 1 -04}.. {479271600 -14400 0 -04}.. {498024000 -10800 1 -04}.. {510721200 -14400 0 -04}.. {529473600 -10800 1 -04}.. {545194800 -14400 0 -04}.. {560923200 -10800 1 -04}.. {574225200 -14400 0 -04}.. {592372800 -10800 1 -04}.. {605674800 -14400 0 -04}.. {624427200 -10800 1 -04}.. {63712
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):151
                                                                                                                                                                                    Entropy (8bit):4.829975802206526
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2L0GRHEsKRsMXGm2OHvavFN/H3VVFVGAvFv:SlSWB9eg/2L0rRsDm2OHEN/VVFAKV
                                                                                                                                                                                    MD5:C330982049AA053DA62B926627D2F2FA
                                                                                                                                                                                    SHA1:050CE68265F1A183F0173C825AC59EAE8B6AB9EB
                                                                                                                                                                                    SHA-256:943F10D8E836773F0B7ACD13ED8422C0B27813C7BBE0B09B57697D1D70D21ECE
                                                                                                                                                                                    SHA-512:DE9953D0E505D6B110C0CC4E756B5B0311646C9CA4703A33B92147D36CFB4C288D73851E6766CE1432F41AB51B5D0A1D58680BDB4E28F067E1D36F670B4A192E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Rothera) {.. {-9223372036854775808 0 0 -00}.. {218246400 -10800 0 -03}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):198
                                                                                                                                                                                    Entropy (8bit):4.906125935761354
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3ycqXHAIgObOvRN/2L0tlo+ply:MByMdTiYt2LMq+p8
                                                                                                                                                                                    MD5:8095A3749DBDE05377836D74A4EEFE33
                                                                                                                                                                                    SHA1:6987CA972B63AE26A65654961588D51D3EF2166C
                                                                                                                                                                                    SHA-256:88057832175BB642B23FC99F788A2F78A24005CF1F84A7B1B5E8C84FB8F4D4C1
                                                                                                                                                                                    SHA-512:9066104C9C16D2AB88523D651C74CE268468E093A497D128D0D12A986BD62DBC1388A56ED1737C2AFACF04185CF06FD0EE66797A3390B2F0E1EB08A4D92AAFAD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/South_Pole) $TZData(:Pacific/Auckland)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):178
                                                                                                                                                                                    Entropy (8bit):4.871844665431957
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2L0GRHEtWlFBQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2L0tQB
                                                                                                                                                                                    MD5:CA52057130DCF506D11A7CC069F4FBA3
                                                                                                                                                                                    SHA1:2C38B7E7872BB41C3569DFCB539C3EC3AAE24FDD
                                                                                                                                                                                    SHA-256:2488805DE4FEA42305689F679F1AE2D80B1E934E657FEA329AD39A82DAC63022
                                                                                                                                                                                    SHA-512:B19D409870939C8F0834C6C028239E010EE5128DFA6E97D4903BECA229B04FE530EA376B936767D9BFE21709720C1791289D8E3622B17C18F2680B0670794A02
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Antarctica/Syowa) $TZData(:Asia/Riyadh)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5370
                                                                                                                                                                                    Entropy (8bit):3.5134546899897146
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YveRdmbxnKIJqU9XThVIsopb8BcrFgoZVlzeEG+PtJ:UeRdmNnKIIajfopb3FVVJ
                                                                                                                                                                                    MD5:442F495C36B31CA5D7A9BEFF12105AEF
                                                                                                                                                                                    SHA1:B3F6CA5B4A5756F9B2C09A27198F7A651CC6032D
                                                                                                                                                                                    SHA-256:6FD5AB8B7B308CDCEA4B747A81D8675988AE218813C91714FC4CA97919CEBEA5
                                                                                                                                                                                    SHA-512:C6EAECC26D67D218615EBB5602639DAB62A2578BD9683553D765DC1AC5580627D29B6F911388F5F1BFC284278EA4EBECE94630D3C6B95FF9EF93D3D61A3C2028
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Troll) {.. {-9223372036854775808 0 0 -00}.. {1108166400 0 0 +00}.. {1111885200 7200 1 +02}.. {1130634000 0 0 +00}.. {1143334800 7200 1 +02}.. {1162083600 0 0 +00}.. {1174784400 7200 1 +02}.. {1193533200 0 0 +00}.. {1206838800 7200 1 +02}.. {1224982800 0 0 +00}.. {1238288400 7200 1 +02}.. {1256432400 0 0 +00}.. {1269738000 7200 1 +02}.. {1288486800 0 0 +00}.. {1301187600 7200 1 +02}.. {1319936400 0 0 +00}.. {1332637200 7200 1 +02}.. {1351386000 0 0 +00}.. {1364691600 7200 1 +02}.. {1382835600 0 0 +00}.. {1396141200 7200 1 +02}.. {1414285200 0 0 +00}.. {1427590800 7200 1 +02}.. {1445734800 0 0 +00}.. {1459040400 7200 1 +02}.. {1477789200 0 0 +00}.. {1490490000 7200 1 +02}.. {1509238800 0 0 +00}.. {1521939600 7200 1 +02}.. {1540688400 0 0 +00}.. {1553994000 7200 1 +02}.. {1572138000 0 0 +00}.. {1585443600 7200 1 +02}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):150
                                                                                                                                                                                    Entropy (8bit):4.825276519494304
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2L0GRHEoKcMFPMXGm2OHvavFYd/bVFXKVVFSTVVn:SlSWB9eg/2L0XcMFPDm2OHEsVFXK/UX
                                                                                                                                                                                    MD5:EEF1A803C78FEDC2848A967F8F7C8C28
                                                                                                                                                                                    SHA1:AC0E8008EFE4EF1A393478C82724335EA30BF1CD
                                                                                                                                                                                    SHA-256:1EFDAE8A23BA4EE37E7992F3C9DCADA6C2E95AF82A955A4C6597E7295C950855
                                                                                                                                                                                    SHA-512:F19EA119EA4F354099402FDEEAAA551AA2C5FC1295E40B5A82E5896CB41F0C86AD8CAA86FDC4E7BD30AAF0ABAF2794FE7B177C4FE25A89F1C744C400A140AA88
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Vostok) {.. {-9223372036854775808 0 0 -00}.. {-380073600 21600 0 +06}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181
                                                                                                                                                                                    Entropy (8bit):4.968479138333469
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVyWJooeyXHAIgoqxWJz5RL/2XbeLo4cA4FH/h8Qas:SlSWB9vsM3ymSDSHAIgoXN/2XbUyAK8K
                                                                                                                                                                                    MD5:3FE28E22313BA8C8100254644DBFD164
                                                                                                                                                                                    SHA1:46F917F0E706CD072B89C06652DAA032CD67AD98
                                                                                                                                                                                    SHA-256:944A38702A5176A082755897F1E4B1C88D5721CB499245E2FE51D2CFD849A23F
                                                                                                                                                                                    SHA-512:BF6E42C039C780EB62CFD69B0375EFF9D459E6468CAFE2323A086D2EB2039B97F805BC361962C72F51F527E96B51973298F13774427E38A28E851A9D19664820
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Oslo)]} {.. LoadTimeZoneFile Europe/Oslo..}..set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Oslo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):171
                                                                                                                                                                                    Entropy (8bit):4.829666491766117
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFK4h4WFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKs46
                                                                                                                                                                                    MD5:60D7F3194F19179E0CF0F561F9C40EE6
                                                                                                                                                                                    SHA1:B079EC49485CFBFFB7A5BE6149319B75684258E9
                                                                                                                                                                                    SHA-256:8FCDDB246932BAED880B70C0CA867057E7989AEA55EDDC174430E1055CD1058D
                                                                                                                                                                                    SHA-512:0BDC86B1D473D4875C6F7C092F955D0999E6C1F2EF83CFC7726A3C5BFEB0F5CB8E00B1F0CBC1F91F806EC635C472927504DF681A32DAC55EF372DA16FEA9EF40
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Aden) $TZData(:Asia/Riyadh)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1637
                                                                                                                                                                                    Entropy (8bit):3.732051305399264
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5qehddmvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10SvPFu+a+CK/Eu3CWuD0Vob1:5YvdJqxiF0rvK50Sv9fGSM
                                                                                                                                                                                    MD5:D6BCB21F65642F36A159AFD72EC93953
                                                                                                                                                                                    SHA1:D3E670E579924E6E4F04AB574D48334FF521D8B2
                                                                                                                                                                                    SHA-256:06DC608C0B8CDD69CCE66A6BF86F141C46DF39CB45312E684E46F19ED8CAFF15
                                                                                                                                                                                    SHA-512:9A633B629873E5EE5AF923A94865EBE5FD9ECA181B2C47B7368A0828468715E07AD3FD825D5E2312D2D0BA1FA5490E3817C36B6339824C8012A0B75538C4A0DC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Almaty) {.. {-9223372036854775808 18468 0 LMT}.. {-1441170468 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {695768400 21600 0 +06}.. {701812800 25200 1 +06}.. {717537600 21600 0 +06}.. {733262400 25200 1 +06}.. {748987200 21600 0 +06}.. {764712
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7301
                                                                                                                                                                                    Entropy (8bit):3.7085177447035047
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Fz0T52akyId7+xOXdkwqeIFcvQdaKkIQV9aOBmGILnNoRkEKnFj/XmJmoTSVI:FY85S0VqXFcvQMZUnNrK
                                                                                                                                                                                    MD5:C5521EB658601F0C03F3122A1529B7B9
                                                                                                                                                                                    SHA1:0B0F9BD69F3B49DF5D25A9F567471409D7467ED8
                                                                                                                                                                                    SHA-256:AA5E87C065E5AA4516F1AA50E1840EE22683D3B4C25A4E00CA92C53F96C6D062
                                                                                                                                                                                    SHA-512:B16039183DF4AF64768F4956075E9557988466E4FC327968712958186CB8F804C1F1B0ED80F5EC7900521CC5710E8AA0DD6716C3B58F7B31116E22CB5785C000
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Amman) {.. {-9223372036854775808 8624 0 LMT}.. {-1230776624 7200 0 EET}.. {108165600 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {215643600 7200 0 EET}.. {231285600 10800 1 EEST}.. {244501200 7200 0 EET}.. {262735200 10800 1 EEST}.. {275950800 7200 0 EET}.. {481154400 10800 1 EEST}.. {496962000 7200 0 EET}.. {512949600 10800 1 EEST}.. {528670800 7200 0 EET}.. {544399200 10800 1 EEST}.. {560120400 7200 0 EET}.. {575848800 10800 1 EEST}.. {592174800 7200 0 EET}.. {610581600 10800 1 EEST}.. {623624400 7200 0 EET}.. {641167200 10800 1 EEST}.. {655074000 7200 0 EET}.. {671839200 10800 1 EEST}.. {685918800 7200 0 EET}.. {702856800 10800 1 EEST}.. {717973200 7200 0 EET}.. {733701600 10800 1 EEST}.. {749422800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2086
                                                                                                                                                                                    Entropy (8bit):3.7698340044911616
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5DeEdVrEOeFt7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5ZejsFLrcZwvJt2F+doTr9Q3G80
                                                                                                                                                                                    MD5:6EFC35043BDCA4AB61D72E931DB954E6
                                                                                                                                                                                    SHA1:F0B4E76C154DC773073E41AA8E94030E972A986A
                                                                                                                                                                                    SHA-256:D9DF64FDA4638F7604624B0F68A885D5ABADB1DE12AF1AF5581C2AF7DD971562
                                                                                                                                                                                    SHA-512:16AE582B113D6960C73B64620A8AF20F9D436AA4B3EC8E881617AED3389EB4357931882103F162F19EE8202953A7E6FB4FDD6D7760FB7621F4DB9D229AD13F17
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Anadyr) {.. {-9223372036854775808 42596 0 LMT}.. {-1441194596 43200 0 +12}.. {-1247572800 46800 0 +14}.. {354884400 50400 1 +14}.. {370692000 46800 0 +13}.. {386420400 43200 0 +13}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1665
                                                                                                                                                                                    Entropy (8bit):3.7149890651919644
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5uvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIkhYwr:sFBNKs6b03zB0WJEuDa7sFZiKWaN6TiF
                                                                                                                                                                                    MD5:A72FB1FE01C93BD7E0A8136635C72639
                                                                                                                                                                                    SHA1:2383CF839F50784D4BF8B7EDDB324C80E2DDD0DC
                                                                                                                                                                                    SHA-256:96B510AF9B8C6BC1DFA84E9ED5E072F3FD484EEB66BBEBC7B6826ED859ED9027
                                                                                                                                                                                    SHA-512:061FECE3C750C0229638DD8AF38FB3E8E48E59E0DE1B13BCFE46483A7A170B71B9BCB0D6F110B6B2EF68510FA940F9066F14CBD59829E222D6644D3657CE1893
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtau) {.. {-9223372036854775808 12064 0 LMT}.. {-1441164064 14400 0 +04}.. {-1247544000 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {7647156
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1666
                                                                                                                                                                                    Entropy (8bit):3.721746335201775
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5FUvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQR:PwaBNKs6b03zB0WJEuDa7sFZiKWaN6Tt
                                                                                                                                                                                    MD5:E278B985BD2515DBCAED8CB741BE9208
                                                                                                                                                                                    SHA1:BC9F5E72C430661D7ED1AF04571CE5D0F73DD18D
                                                                                                                                                                                    SHA-256:991638FA2AB2A2F7A091A23D78D99306EE73A740F1A03FBAC448EDCAB55A0E38
                                                                                                                                                                                    SHA-512:9951DB729B837647CC4B3D2E605525DCCBAFFD39D76460331BF62235DCAE5E4470CDA578F940B1739AABFEC55D293FF60D79AE0EFDFE1EB64E84571881FDEA6A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtobe) {.. {-9223372036854775808 13720 0 LMT}.. {-1441165720 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):878
                                                                                                                                                                                    Entropy (8bit):3.937249024843323
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5ggeRMdIQvNcDvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKTob3CGcr:5gbkvNSvNhQQvmRKqv0fvzQIovWdvEGD
                                                                                                                                                                                    MD5:259179C7A1CA04F9F3A373B6C8FCB8C5
                                                                                                                                                                                    SHA1:D042DF8EFD8EC1473B45B1131BD5EB714F1B2C17
                                                                                                                                                                                    SHA-256:13745BFA25E6E2D8D0FABAE42CB7C37CF9F974CFB343D4FE84E4E2D64A25926B
                                                                                                                                                                                    SHA-512:703BEAD5A1E5B3816D98057A08A87C2139F418787F38561FE35175B84E2005365727F85D1B949CC5DF464B207A7D01BB65FB1A632E73DDA523E843B82D76FBBD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ashgabat) {.. {-9223372036854775808 14012 0 LMT}.. {-1441166012 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +05}.. {370720800 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.801820439218014
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8xEYM4DyXHAIgN/ZEYovFvWARL/2WFKUNSH+WFKYEQ:SlSWB9vsM3yR+HAIgH8VWAN/2wKUNSeq
                                                                                                                                                                                    MD5:5193EF7ADB646798801245BC50C8DDA6
                                                                                                                                                                                    SHA1:83ED851CBC60EFB330A8FC119E1BED5B4C0BA630
                                                                                                                                                                                    SHA-256:2C752F641B98E3C05B14AE31330D1F198DAA4A7E354BA9670C7754926BFB891A
                                                                                                                                                                                    SHA-512:E940E1BE67A9AC895F3D060B1CB34797A429147A9DC2AC0F1162D37D86661EF217EDABA720F0AE3796186FE801229210AC785BB4511CBBE5A41791D236101D8C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ashgabat)]} {.. LoadTimeZoneFile Asia/Ashgabat..}..set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1666
                                                                                                                                                                                    Entropy (8bit):3.7265766742957402
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:55TvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQJ:XrFBNKs6b03zB0WJEuDa7sFZiKWaN6Tl
                                                                                                                                                                                    MD5:0236793F90ABC6F68718DDBB44AF5E2F
                                                                                                                                                                                    SHA1:A5EFAEEF9B9159E748A3FED231F8A978E400482E
                                                                                                                                                                                    SHA-256:4B7B118E6AE72D41740CF0CB2BD8E970700758DCBC0DD6F298199D841DF8408E
                                                                                                                                                                                    SHA-512:851C7A9C110790454312BB9C5B5D3C426365EEF4673191B9ABB2E4A32301894C5FB1ADCBE2A4C67BEE416AD63FB8BED85F94EF9BF42473DA4BFFA7824935A1D5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Atyrau) {.. {-9223372036854775808 12464 0 LMT}.. {-1441164464 10800 0 +03}.. {-1247540400 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764715
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1702
                                                                                                                                                                                    Entropy (8bit):3.7261419515679393
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5/eVvyGiHD6UC4UrUomFMmUZcjbUKNFcUEUvUOpU8MYUWCUlbf/U9bUiUUybUQUF:5m8G9mFdnNF1FfsTuvQXHCe
                                                                                                                                                                                    MD5:690013310A46BD1AE250A5E019353809
                                                                                                                                                                                    SHA1:0DF434C7EEB707DC071007FAB112F4DEB37E936F
                                                                                                                                                                                    SHA-256:D20B75D2604C3B742C1629C5EE02CFF6783E472249982B272B68F2A6DE9BDC38
                                                                                                                                                                                    SHA-512:FF8C33E55E4F006C38D3FD37A1AD3E1200718CA374ECBEAE8255C7635912F0BB23A59A600BF7130D5660A24C515F726E8440D0D908E560CB59F74059638E6AA2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baghdad) {.. {-9223372036854775808 10660 0 LMT}.. {-2524532260 10656 0 BMT}.. {-1641005856 10800 0 +03}.. {389048400 14400 0 +03}.. {402264000 10800 0 +03}.. {417906000 14400 1 +03}.. {433800000 10800 0 +03}.. {449614800 14400 1 +03}.. {465422400 10800 0 +03}.. {481150800 14400 1 +03}.. {496792800 10800 0 +03}.. {512517600 14400 1 +03}.. {528242400 10800 0 +03}.. {543967200 14400 1 +03}.. {559692000 10800 0 +03}.. {575416800 14400 1 +03}.. {591141600 10800 0 +03}.. {606866400 14400 1 +03}.. {622591200 10800 0 +03}.. {638316000 14400 1 +03}.. {654645600 10800 0 +03}.. {670464000 14400 1 +03}.. {686275200 10800 0 +03}.. {702086400 14400 1 +03}.. {717897600 10800 0 +03}.. {733622400 14400 1 +03}.. {749433600 10800 0 +03}.. {765158400 14400 1 +03}.. {780969600 10800 0 +03}.. {796694400 14400 1 +03}.. {812505600 10800 0 +03}.. {82831
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):171
                                                                                                                                                                                    Entropy (8bit):4.784355129067593
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8hkXHAIgNvZORL/2WFKENUKMFB/4WFKKB:SlSWB9vsM3yBkHAIgPON/2wKENUr/4wT
                                                                                                                                                                                    MD5:1B5E0D449DAEF469D586A853CB3073AD
                                                                                                                                                                                    SHA1:FD735B0472B31644E787767B82B737CC39EC4175
                                                                                                                                                                                    SHA-256:3D437037FBF2BBDF969C8E71967080947F24860D431B39F5D8F23151316ABCD5
                                                                                                                                                                                    SHA-512:2A2DC33D4258A5E1AE59172883F3B11723798ED35CF5AF1B8BA81A8807DC6F8222C8044D82B152EF6AF43E7350FEB2625D4406C6C7DD309CE65810EA3D3286B6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Qatar)]} {.. LoadTimeZoneFile Asia/Qatar..}..set TZData(:Asia/Bahrain) $TZData(:Asia/Qatar)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2149
                                                                                                                                                                                    Entropy (8bit):3.6155622322573713
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5/eFdqlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUTIEjvZJ+76:5RsUf8mFpNWFny1ZGMte3aivUKo
                                                                                                                                                                                    MD5:294DFC98F67AC00A188EC3D3B87C501C
                                                                                                                                                                                    SHA1:93C434CD9AA170E35AD676C88EE09986A94EC02A
                                                                                                                                                                                    SHA-256:873E8F08B87610D0DAFE239D32345248A4595C6B13D1DA83EC214D78E88FA12C
                                                                                                                                                                                    SHA-512:5346082CCA733724C0D2C36B768467E59BA9ED6452B6CF1BA923AF4F0D2BC05C67DB49E804CA81DAD449D30D0835026D708D9AB632D02FDA1EA1A0BF717111DE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baku) {.. {-9223372036854775808 11964 0 LMT}.. {-1441163964 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 14400 0 +04}.. {820440000 14400 0 +04}.. {828234000 18000 1 +05}.. {846378000 14400 0 +04}.. {852062400
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181
                                                                                                                                                                                    Entropy (8bit):4.911309754748998
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFKELYOiMXGm2OHB+keoHvZKmrROpDovFFsQ+8EXVeVSYe:SlSWB9eg/2wKELeDm2OHxeoHvZ3FO1og
                                                                                                                                                                                    MD5:9AC4947AC29C797055B7EBFA4F6AC710
                                                                                                                                                                                    SHA1:E7758A9A8BFA255F6B2D27F5366D9FE2A26DDF6C
                                                                                                                                                                                    SHA-256:6E72BA908F250FD45D554A12E3E7B3BD2F1C02A6C2431F806FD2A054F843AA90
                                                                                                                                                                                    SHA-512:F9D0F0CB7D3726C2AB3B5049429172D9DD4BA21353F6F98570CBA4EE969F7D97BD973CB165AECFF930AFFA8633E8052624D44EE7FB91763681ED3F78A61F4F98
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bangkok) {.. {-9223372036854775808 24124 0 LMT}.. {-2840164924 24124 0 BMT}.. {-1570084924 25200 0 +07}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2117
                                                                                                                                                                                    Entropy (8bit):3.7025684250364725
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5VeTtXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEnsr:5n40yVRB7VfXucdKmtTTDOV
                                                                                                                                                                                    MD5:6CC13B6910412A3A3D16CA36ADF00352
                                                                                                                                                                                    SHA1:061CF4A8FEA8C139F50F96E6B6506B50ED3DD792
                                                                                                                                                                                    SHA-256:992F93A7975F8CD4E94D96B3BA1ECFB3585E52A53F4442A15993402D3F955F66
                                                                                                                                                                                    SHA-512:4E9750B1C3C0BA4F7922BCBC76276A3E74031D78A98E21DC59F66D6EA8E1B70865BBEB50A6B77EB0423421A18428B97B47412053CE15213128CEED669F4DD6E8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Barnaul) {.. {-9223372036854775808 20100 0 LMT}.. {-1579844100 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {76470
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8024
                                                                                                                                                                                    Entropy (8bit):3.7230911686481774
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:4nBKPP8LFH0TDkywaZb1QSCK5VUjiO1PoBQpo7778CZicJZS80EGcLt4Mok1MgJl:4M38LCRZb+sAiO1PoBQpo1ikjD
                                                                                                                                                                                    MD5:1D99E2BBB01B1669403CFBAF7E03F733
                                                                                                                                                                                    SHA1:DBDD58C7FD195FC602C4541D6F416CC96094C121
                                                                                                                                                                                    SHA-256:17AF14646D562AFE17DCCFD1D2FBA95C122F3E0263906A36EB48BFF04ACF233E
                                                                                                                                                                                    SHA-512:98524E8DCD17C090058F17BDA1200D9801EB1B14EB5CEB8C31149A4A402A53BA4923A2AFF457E0A72DAA601D88095247806F945F704000F874FCBF73631DD135
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Beirut) {.. {-9223372036854775808 8520 0 LMT}.. {-2840149320 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1473645600 10800 1 EEST}.. {-1460948400 7200 0 EET}.. {-399866400 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336794400 10800 1 EEST}.. {-323578800 7200 0 EET}.. {-305172000 10800 1 EEST}.. {-291956400 7200 0 EET}.. {-273636000 10800 1 EEST}.. {-260420400 7200 0 EET}.. {78012000 10800 1 EEST}.. {86734800 7200 0 EET}.. {105055200 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {212965200 7200 0 EET}.. {231285600 10800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1669
                                                                                                                                                                                    Entropy (8bit):3.7443715330695735
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5qvdJqxiF0rvK5XvV4vUzvCjvT7voPvkPvJUbvn0vYpv99v3uvuWvKJhv3T:Ad1mzK5/VkULCbTjoHkHJUDnQYV9p3mO
                                                                                                                                                                                    MD5:1EE8FF3DF0D931A140ADBB021EB3BFEB
                                                                                                                                                                                    SHA1:F1F15EF70C4E9F456849AF89CAC97AD747D9E192
                                                                                                                                                                                    SHA-256:1D5E9A8F6A04273AF741F648EF10718B004A60D7884FE432DDF85A8F558BEA98
                                                                                                                                                                                    SHA-512:155539A5CF21A34FBFACBF1652D934BF32255F4E505E60B3B4D8B5F2F7FAE552E6CB4824D8608A9C56370F58E48702335995BBD16B7A296A86A72A615FBC8ABC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bishkek) {.. {-9223372036854775808 17904 0 LMT}.. {-1441169904 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {683586000 18000 0 +05}.. {703018800 21600 1 +05}.. {717530400 18000 0 +05}.. {734468400 21600 1 +05}.. {748980000 18000 0 +05}.. {765918000 21600 1 +05}.. {78042
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.843807524560784
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFKXeAMMkSMXGm2OHCQdvVVoHsWUOVFW/FvOVSSFdaUMWO:SlSWB9eg/2wK0iDm2OHCIvVVoH3UuW/N
                                                                                                                                                                                    MD5:37B0C37CDDEE62E6002AF3D09B0B6225
                                                                                                                                                                                    SHA1:75F1329492C231587FE233175D9B71112DA09B08
                                                                                                                                                                                    SHA-256:A4216B59F2478DE7E88A99E2B11BBBD93070477D7E62BFD453D1CA430EBB4834
                                                                                                                                                                                    SHA-512:6FDC5C74F927970DA261A5842D9647E97163009A2902C8A8AB6DFAACF261485AB179495D2D72FAC513D1A27F662553F1F0EEC8687E009EA5753D5A9E6B0A0D34
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Brunei) {.. {-9223372036854775808 27580 0 LMT}.. {-1383464380 27000 0 +0730}.. {-1167636600 28800 0 +08}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):178
                                                                                                                                                                                    Entropy (8bit):4.774027471796823
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq864DyXHAIgN1QvRL/2WFKh0s+WFKvovn:SlSWB9vsM3ya4DSHAIgcvN/2wKN+wKvy
                                                                                                                                                                                    MD5:8BB098AB77CB0469B1FA0E0B64C4A9E7
                                                                                                                                                                                    SHA1:88C73626985071DD0923E1CAB343ACCD854A7297
                                                                                                                                                                                    SHA-256:1BAEF7850111D2C33B2A766A8AE804534ABA1711BF80A4087A89656DDD8469D5
                                                                                                                                                                                    SHA-512:82216A7F787AF20A4C97C7AA754CD6BE979FEF24137CF9A8B18EECA5E8FBCF12834DD8A6FC9CD2357D807F1629806745B46B11DC0472E0284E18DCCC983897DE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kolkata)]} {.. LoadTimeZoneFile Asia/Kolkata..}..set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2086
                                                                                                                                                                                    Entropy (8bit):3.6981807774781017
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5Bpr1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2M:95PhtjLiII2ZFlgd
                                                                                                                                                                                    MD5:69E03A5CEB689E19B60168C0F7EBAE8E
                                                                                                                                                                                    SHA1:95C6396EB753753B4FE4AE1B98D76332523E72A4
                                                                                                                                                                                    SHA-256:10B6F435B05D887176A4D90CA5AC957F327F62F36F15D6F6E4F81844662429B9
                                                                                                                                                                                    SHA-512:DFA72EDC54A11F0840ADBEE7F5AD8EA472AA52A1F196292F1341CD92A68FB2EC0A5BC7DE6C8E83C975420DB4B76CECD4393370FDB2C09F86EC11A50E540F6F02
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Chita) {.. {-9223372036854775808 27232 0 LMT}.. {-1579419232 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647012
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1619
                                                                                                                                                                                    Entropy (8bit):3.775783980828041
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5th5fSW2sp4Qh2rRSQnGw7GywvWbC25XrMYWG4AIQTUhp9pkTGdXguHaena44XY5:rh5kpmWG29QFUmD
                                                                                                                                                                                    MD5:540A7304A62ABB8D7F84454ABD6E2556
                                                                                                                                                                                    SHA1:52C37529929218A668D7A4AD6FD1B5FE0A727E16
                                                                                                                                                                                    SHA-256:94B2C14EF45C695EF6B19D94722E1BCBB629A595F2866DBA80F00A66721040B5
                                                                                                                                                                                    SHA-512:3B535D109DB369E301D6B412F21EC990976B997826F22B2E16ECEEEB048D60F064C7CA1A616393DC2F1B491BAC0548DC0965B9EA149A95280FFDBCAD6726EF0F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Choibalsan) {.. {-9223372036854775808 27480 0 LMT}.. {-2032933080 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 36000 0 +09}.. {433778400 32400 0 +09}.. {449593200 36000 1 +09}.. {465314400 32400 0 +09}.. {481042800 36000 1 +09}.. {496764000 32400 0 +09}.. {512492400 36000 1 +09}.. {528213600 32400 0 +09}.. {543942000 36000 1 +09}.. {559663200 32400 0 +09}.. {575391600 36000 1 +09}.. {591112800 32400 0 +09}.. {606841200 36000 1 +09}.. {622562400 32400 0 +09}.. {638290800 36000 1 +09}.. {654616800 32400 0 +09}.. {670345200 36000 1 +09}.. {686066400 32400 0 +09}.. {701794800 36000 1 +09}.. {717516000 32400 0 +09}.. {733244400 36000 1 +09}.. {748965600 32400 0 +09}.. {764694000 36000 1 +09}.. {780415200 32400 0 +09}.. {796143600 36000 1 +09}.. {811864800 32400 0 +09}.. {828198000 36000 1 +09}.. {843919200 32400 0 +09}.. {8596
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.865222436335267
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKh2V7/4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKho4wKU
                                                                                                                                                                                    MD5:C5DC40C6325391F7247251ADB2C07F78
                                                                                                                                                                                    SHA1:3DDB1BF94532FB1F1271095B9C8CAA779BC545EF
                                                                                                                                                                                    SHA-256:A87382DC5F3C3141547A65E3746AF1DAF94B51468B96DA6CEF30E95754C97D37
                                                                                                                                                                                    SHA-512:062FF8D5E5392E5372B0405EDF3C7CF997AC33F95EBFFAA9CC9AB82BBE27B60C80255FCCEE9E6F5E02CBFCB163F99984BB2103217FFD1F80BDEC5C684BF2F61A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chongqing) $TZData(:Asia/Shanghai)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.889115378893491
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFK7LeL9J4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wK7LUT4wj
                                                                                                                                                                                    MD5:C3676771EB813B346F58A7B574D0D7B5
                                                                                                                                                                                    SHA1:A473EF621309E019F29F3DEF95C38593775B8404
                                                                                                                                                                                    SHA-256:D6D2B4A761C547F1F853AE901AC71AB49FBE825037079C4E0C89DC940AE4A822
                                                                                                                                                                                    SHA-512:21C3A5D499E6E0427FBF585CA8CC5D99D193C586483AB107C4D8E9F9DC8412021E8E019A314757DAFE1225D2635F6D48E9C54A511709863F22A02449FA201E02
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chungking) $TZData(:Asia/Shanghai)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):369
                                                                                                                                                                                    Entropy (8bit):4.465596050904646
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKr+iDm2OHgoHvZv9tdvjSWV/FSQipPUrKkTD/k5QqRVVFSQOR/UIp:MB862zZmdHgCvZvJvj1Nj+Phkv/YtvjA
                                                                                                                                                                                    MD5:9541BB43E79AB0C6E8163945B5BFB1BF
                                                                                                                                                                                    SHA1:C4994420DB8313DECDE19B4B9F6C5DB0126A95A7
                                                                                                                                                                                    SHA-256:E5B5E6D607A15DA65CB00C92C35A63EAF25F547E64CB34BB419CB8CFC2714B1B
                                                                                                                                                                                    SHA-512:46F623B3F7CF8A50F97DD812521398EB9100C9CDFB967C18EF1BD112306AAEB3C9CB224424E48611CB8CC21D1DC3D820DD83032D12BC9DF19301CF07786FA664
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Colombo) {.. {-9223372036854775808 19164 0 LMT}.. {-2840159964 19172 0 MMT}.. {-2019705572 19800 0 +0530}.. {-883287000 21600 1 +06}.. {-862639200 23400 1 +0630}.. {-764051400 19800 0 +0530}.. {832962600 23400 0 +0630}.. {846266400 21600 0 +06}.. {1145039400 19800 0 +0530}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):169
                                                                                                                                                                                    Entropy (8bit):4.786111096226559
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8ntyXHAIgN6KyFvRL/2WFK1S2WFKwBn:SlSWB9vsM3yHtSHAIgMKON/2wKM2wKwB
                                                                                                                                                                                    MD5:BA575D37459540907A644438071277F8
                                                                                                                                                                                    SHA1:14CF10D6AABBAF7BAE42B3B9641D8469C206567F
                                                                                                                                                                                    SHA-256:B3AD560F66EA330E54A147017E6E6AB64452A5255D097B962D540836D7B19EE7
                                                                                                                                                                                    SHA-512:9CA386EF4D812B00C2E63558B81B273F92BBCA98AF304C9FD6FC166210FC4E2F92B769E1D6FB96B670650DC76EFFAD2FC6E39AE12C24B47EAED4E50A2AFAC2D7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dhaka)]} {.. LoadTimeZoneFile Asia/Dhaka..}..set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8311
                                                                                                                                                                                    Entropy (8bit):3.719987853637512
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:8YI5WpVAdVGlkBOLh8X0CkBheIFlPup7YI6z0Y3lV9Jitv5F6Ya7vEzg93kn/R:8dIpqdk6BrqhXFlPUsz57AbV
                                                                                                                                                                                    MD5:DCB84F498498C06953E7FC1A4FD9AF17
                                                                                                                                                                                    SHA1:5B5A115CDA727C9439667E3E95CA3333E49BA810
                                                                                                                                                                                    SHA-256:7D44F4C16E862752D399999B9F0B1E4E8ED5D80C1322A980094801DD8A4A03EB
                                                                                                                                                                                    SHA-512:DC143B6DB263377413D4BBC9575236D525F6ED898934CB9A2FC1E3B32E1235F2D86BD8E133B38463DFC143EC2F6E8AA9184048479A4E797C39D63A1AD364BB74
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Damascus) {.. {-9223372036854775808 8712 0 LMT}.. {-1577931912 7200 0 EET}.. {-1568592000 10800 1 EEST}.. {-1554080400 7200 0 EET}.. {-1537142400 10800 1 EEST}.. {-1522630800 7200 0 EET}.. {-1505692800 10800 1 EEST}.. {-1491181200 7200 0 EET}.. {-1474243200 10800 1 EEST}.. {-1459126800 7200 0 EET}.. {-242265600 10800 1 EEST}.. {-228877200 7200 0 EET}.. {-210556800 10800 1 EEST}.. {-197427600 7200 0 EET}.. {-178934400 10800 1 EEST}.. {-165718800 7200 0 EET}.. {-147398400 10800 1 EEST}.. {-134269200 7200 0 EET}.. {-116467200 10800 1 EEST}.. {-102646800 7200 0 EET}.. {-84326400 10800 1 EEST}.. {-71110800 7200 0 EET}.. {-52704000 10800 1 EEST}.. {-39488400 7200 0 EET}.. {-21168000 10800 1 EEST}.. {-7952400 7200 0 EET}.. {10368000 10800 1 EEST}.. {23583600 7200 0 EET}.. {41904000 10800 1 EEST}.. {55119600 7200 0 EET}.. {73526400 10800 1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):364
                                                                                                                                                                                    Entropy (8bit):4.412125512631861
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKwiDm2OHEmVFnoHv9vX+Yl7UIFckVVFSQiL/FG/UIvy/Ur9i/Ur97:MB862Y2mdHzdCv9P+Y9vvjeQlP9/9VkK
                                                                                                                                                                                    MD5:B5496A038AC230B9D75AA22BB2BE6BDD
                                                                                                                                                                                    SHA1:ACFD9C78F803F344272E8E188C41ED969EBADA16
                                                                                                                                                                                    SHA-256:BFC4562055CC4355E79F9EFAA580A4C6A658285916159A5D390A0CDA96A97E98
                                                                                                                                                                                    SHA-512:AB05D0176DADC1ED03CC526C372B9827A5FA03459E4F4B4365C6CE4B6FBDA043514A9D3FE2DA747159C5A1BC0E07727E6578A101E42B4DB120AF9624368C5FEA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dhaka) {.. {-9223372036854775808 21700 0 LMT}.. {-2524543300 21200 0 HMT}.. {-891582800 23400 0 +0630}.. {-872058600 19800 0 +0530}.. {-862637400 23400 0 +0630}.. {-576138600 21600 0 +06}.. {1230746400 21600 0 +06}.. {1245430800 25200 1 +06}.. {1262278800 21600 0 +06}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):235
                                                                                                                                                                                    Entropy (8bit):4.597480383845617
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKCXeSDm2OHnBGeoH1mpvyvScHTU71avScr:MB862qXbmdHnBvC1SyHHq8Hr
                                                                                                                                                                                    MD5:316DDF860FA234621698EB473E558DB7
                                                                                                                                                                                    SHA1:35BF955F764555945CF8B314B8E881DAD6CF557B
                                                                                                                                                                                    SHA-256:8BC2E0D77AC35B6D63E11B820AC45EC23A4195ED773680C600C772FDF4B953F8
                                                                                                                                                                                    SHA-512:D1A8D5F1DAAB7827BDCBC14506AF8681FD1ED94C6101CC4A3C8CC2A76EA7D3649038069158C539A2007A1B0734FBD87DE120415E07A3F08F44417100C95459F5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dili) {.. {-9223372036854775808 30140 0 LMT}.. {-1830414140 28800 0 +08}.. {-879152400 32400 0 +09}.. {199897200 28800 0 +08}.. {969120000 32400 0 +09}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):148
                                                                                                                                                                                    Entropy (8bit):4.97292023820863
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFKQUMXGm2OHvkdoHsQK23NVsRYovV:SlSWB9eg/2wKQUDm2OHvsoHxVNSN
                                                                                                                                                                                    MD5:861BA4A0A71E6C3F71B90074275FD57C
                                                                                                                                                                                    SHA1:BC6FC5233340BB19AE4BD0BA563875479AC0A2B9
                                                                                                                                                                                    SHA-256:3DB174F1568BC23BF467A3DC7BAF8A2A2952B70653D4DE54F4DB391EC50B6925
                                                                                                                                                                                    SHA-512:B187735E0783F299253D9F93E002AEFF131FCCA50FB3E04CF0545B334B051D5ED978108A47C6957B608F5F93ED4CC3D69751FE0F40413719EE1C0440CD49AC76
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dubai) {.. {-9223372036854775808 13272 0 LMT}.. {-1577936472 14400 0 +04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):820
                                                                                                                                                                                    Entropy (8bit):3.969189280047274
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5we3dJvOt81FCuLqecDngO6jPvTpYy5T4TiFGDr:5BvdJqxiF0uGr
                                                                                                                                                                                    MD5:9ABD0ECB5F3E738F49CDD1F81C9FF1A4
                                                                                                                                                                                    SHA1:46B68C7BBD1BE9791B00128A5129AA3668435C93
                                                                                                                                                                                    SHA-256:550DB44595F59D0F151BE4AF70D6FECE20580AB687EF45DE2A0A75FB2515AC80
                                                                                                                                                                                    SHA-512:67E2B0EF216D509C4B6DD367519E0A733E54A7CA767D5F7960715E8056E61B7B633C7516D568544F55C9277E90412C1443B822C6EED3341C01F1BD9AA9476FA1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dushanbe) {.. {-9223372036854775808 16512 0 LMT}.. {-1441168512 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 21600 1 +06}.. {684363600 18000 0 +05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7597
                                                                                                                                                                                    Entropy (8bit):3.7170041442081203
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:G3pv/7V6Aj8aZaNlK0UpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:G3v/AaaivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:F8E4BA3E260452AE13CF234E60149A62
                                                                                                                                                                                    SHA1:8DDB08E2FDEEF6539EE0C0038B166908BFED16CD
                                                                                                                                                                                    SHA-256:8CFE85C48FC22033411432F8B75EE4C097A5D84897698CB1AFD5AB51C47FF5A3
                                                                                                                                                                                    SHA-512:487177411FB7E9F83AB9AAD84B685322B13A85784D4F90BB9C30F57BFAA6A9298E5C4F36C97444DE1117E51F85A62DC639D08B405460D071C2B29C898553E9A3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Famagusta) {.. {-9223372036854775808 8148 0 LMT}.. {-1518920148 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {622587
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8427
                                                                                                                                                                                    Entropy (8bit):3.7517631589916043
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:NyHSd2XK1GbJFp3gP0nPVl8dcqU/8O8pc1FlvaiSjxHe5PTisXNlDN3uMeVunBjq:NyyIgGbJv3dPAD7c1Flvai+4j/NKJ
                                                                                                                                                                                    MD5:E539AE663A076DD9F1C6E927289DE5B1
                                                                                                                                                                                    SHA1:855BCE0790A7259B01181861BCC748FE5F2815EB
                                                                                                                                                                                    SHA-256:F030E2B3DBCA556C36602FBF234C7DB7D4F222D02CFAB192288E91E6A1BF3C90
                                                                                                                                                                                    SHA-512:83E87396576A36455DF22EE809D71CBD18CDEC7F574A7AABFF6D5A21A71D2BE865B84105E2D72FD89F3C9AB19B66B6893F82934925E2311A8E6EAA015D6227F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Gaza) {.. {-9223372036854775808 8272 0 LMT}.. {-2185409872 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-16580
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179
                                                                                                                                                                                    Entropy (8bit):4.86422571961583
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKwHp4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKi4wKU
                                                                                                                                                                                    MD5:1BCCB3578FADE993EE8B2C11EAC06CD8
                                                                                                                                                                                    SHA1:CAEAB714E014CD5040C44E4603708B97BC0B03D4
                                                                                                                                                                                    SHA-256:12811A7944B892E3D1C0B4B09057CC1899F28081B3CD47FFD248BA49BA308AF0
                                                                                                                                                                                    SHA-512:1D791DC0E8F45359366DF33C2C337688D2E0E972A90F038733B840D28585505AEF542DDBAD014C9EA8C252048A588CD017DD67A84545A81EDB7C17E3B2E65092
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Harbin) $TZData(:Asia/Shanghai)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8402
                                                                                                                                                                                    Entropy (8bit):3.754379249421927
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:fXSd2XK1GbJFp3gP0nPVl8dcqUZ8O8pc1FlvaiSjxHe5PTisXNlDN3uMeVunBj5w:fiIgGbJv3dPADPc1Flvai+4j/NKJ
                                                                                                                                                                                    MD5:02B58C89D64C423A47559B2386FDAD1F
                                                                                                                                                                                    SHA1:B01C4C83ACB44F454A593A510BCBB5A4068EC835
                                                                                                                                                                                    SHA-256:2C126BA5F78CF7A13FBDFE00F647BB29E2AC104B89AB51B39281047D9B2E45A7
                                                                                                                                                                                    SHA-512:BBF564FBBDF90091F4D97F3DCFA0F2AF1CE6EB6B0D24CE4F4133E098F7A637344A78BB27DD8160D8424148ECB46B7BF578959B15F9AA0AEAD5D080DCE7C9C176
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hebron) {.. {-9223372036854775808 8423 0 LMT}.. {-2185410023 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):395
                                                                                                                                                                                    Entropy (8bit):4.419283016412891
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862RLmdHqCv3tYC5sF/p+zHHviViksF/dMUYPsF/RQ9EsV:5debv3td5sFR+znv2vsFlM/PsFVsV
                                                                                                                                                                                    MD5:5154581E724080F43C9D68B983C5CF77
                                                                                                                                                                                    SHA1:1BC86A418AA654DA9EF73954DFD01ACF53D796E9
                                                                                                                                                                                    SHA-256:FE977368691F4FA43D068CD8D989F39D2AEC46D199D7D629B8DD3ECF7423A335
                                                                                                                                                                                    SHA-512:3708654E022919D5CDC2CA90D8623370CFFF248E3AF10ECCBB6F56BC7E8DD000E6119614C30678D6628BBE6A8CCA00746315108A04632B3F6DD2DE172BBF8956
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ho_Chi_Minh) {.. {-9223372036854775808 25600 0 LMT}.. {-2004073600 25590 0 PLMT}.. {-1851577590 25200 0 +07}.. {-852105600 28800 0 +08}.. {-782643600 32400 0 +09}.. {-767869200 25200 0 +07}.. {-718095600 28800 0 +08}.. {-457776000 25200 0 +07}.. {-315648000 28800 0 +08}.. {171820800 25200 0 +07}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2226
                                                                                                                                                                                    Entropy (8bit):4.0055033036300145
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5Ze9l9Pm4yoHtTYJJIX1Zcp6GS0j1SPQpP6gPE8fTZIPNYQGm75st/nQdwi9:DyaoTcwQt6EsQTng
                                                                                                                                                                                    MD5:26BCBBA28AE34FE3CF7D17EF4C6B69C8
                                                                                                                                                                                    SHA1:5324DEA8E7965C66650E7B4769EFA1297B508486
                                                                                                                                                                                    SHA-256:EE9A6997BC1AAD4A8FA95DB312774C3F37FBB895549230C30FC66C02CC170EB6
                                                                                                                                                                                    SHA-512:54594CD18838B4A8947EBB5BDE2415727CC127CF79AEC98FC0F5D5A32F68EEAF4E079853239DE9F753CE90F18EFD55AE51FC43D64E313666CEA0EF8AC93BF065
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hong_Kong) {.. {-9223372036854775808 27402 0 LMT}.. {-2056690800 28800 0 HKT}.. {-900910800 32400 1 HKST}.. {-891579600 30600 1 HKWT}.. {-884248200 32400 0 JST}.. {-761209200 28800 0 HKT}.. {-747907200 32400 1 HKST}.. {-728541000 28800 0 HKT}.. {-717049800 32400 1 HKST}.. {-697091400 28800 0 HKT}.. {-683785800 32400 1 HKST}.. {-668061000 28800 0 HKT}.. {-654755400 32400 1 HKST}.. {-636611400 28800 0 HKT}.. {-623305800 32400 1 HKST}.. {-605161800 28800 0 HKT}.. {-591856200 32400 1 HKST}.. {-573712200 28800 0 HKT}.. {-559801800 32400 1 HKST}.. {-541657800 28800 0 HKT}.. {-528352200 32400 1 HKST}.. {-510211800 28800 0 HKT}.. {-498112200 32400 1 HKST}.. {-478762200 28800 0 HKT}.. {-466662600 32400 1 HKST}.. {-446707800 28800 0 HKT}.. {-435213000 32400 1 HKST}.. {-415258200 28800 0 HKT}.. {-403158600 32400 1 HKST}.. {-383808600 28800 0 HKT
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1583
                                                                                                                                                                                    Entropy (8bit):3.7521760184466206
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5x3LecCvgsFFFKOksF8FpsF71FQnsFNFxhsFlF6sFaFasFZFisF8GF5sFKLFAZsZ:5FqKVx8Cq9f/y2L
                                                                                                                                                                                    MD5:A77140A0D8C2D3E2993E4BA7CADFB4C6
                                                                                                                                                                                    SHA1:AE3586264A86D42F578D4B0F7A30C9BE6047EAB1
                                                                                                                                                                                    SHA-256:CA88A45E954A9854C680B399E69E4858BF5E861FABFADC19D62D97B734B25415
                                                                                                                                                                                    SHA-512:05EA9D903EEC755F799B7C2399ED933245A5AE3A594648FE37AF1CE7699AE499B4ED159F428D91259D80BC9AF5117F2DA055A506AED94E5281C38B7AFF69C6FE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hovd) {.. {-9223372036854775808 21996 0 LMT}.. {-2032927596 21600 0 +06}.. {252439200 25200 0 +07}.. {417978000 28800 1 +07}.. {433785600 25200 0 +07}.. {449600400 28800 1 +07}.. {465321600 25200 0 +07}.. {481050000 28800 1 +07}.. {496771200 25200 0 +07}.. {512499600 28800 1 +07}.. {528220800 25200 0 +07}.. {543949200 28800 1 +07}.. {559670400 25200 0 +07}.. {575398800 28800 1 +07}.. {591120000 25200 0 +07}.. {606848400 28800 1 +07}.. {622569600 25200 0 +07}.. {638298000 28800 1 +07}.. {654624000 25200 0 +07}.. {670352400 28800 1 +07}.. {686073600 25200 0 +07}.. {701802000 28800 1 +07}.. {717523200 25200 0 +07}.. {733251600 28800 1 +07}.. {748972800 25200 0 +07}.. {764701200 28800 1 +07}.. {780422400 25200 0 +07}.. {796150800 28800 1 +07}.. {811872000 25200 0 +07}.. {828205200 28800 1 +07}.. {843926400 25200 0 +07}.. {859654800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2089
                                                                                                                                                                                    Entropy (8bit):3.7296034934492694
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5PZy4DdOKStci4KjXoYjoSvfQJWE00dtT43kgiTskNrrBizhzRBqY3M:Py2/svfraBGfgP
                                                                                                                                                                                    MD5:C9F7AC464970567E5C38CB01ED2297AE
                                                                                                                                                                                    SHA1:453718BACCAE3FACD761AF22CA5875185478ADDD
                                                                                                                                                                                    SHA-256:61BAAAD6315FFBDAED6F266880165B06ECCAF72F660B7FB01C8B654F3952D68E
                                                                                                                                                                                    SHA-512:72044EFAE262CC12974F2DE2AAF06AC4C31BE73071ACD53DDC6B8D8BFC6FBDF937EC03DC881901F730659BDE662FBCFC76C57B2C086DAA97F160530464FBA7C6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Irkutsk) {.. {-9223372036854775808 25025 0 LMT}.. {-2840165825 25025 0 IMT}.. {-1575874625 25200 0 +07}.. {-1247554800 28800 0 +09}.. {354902400 32400 1 +09}.. {370710000 28800 0 +08}.. {386438400 32400 1 +09}.. {402246000 28800 0 +08}.. {417974400 32400 1 +09}.. {433782000 28800 0 +08}.. {449596800 32400 1 +09}.. {465328800 28800 0 +08}.. {481053600 32400 1 +09}.. {496778400 28800 0 +08}.. {512503200 32400 1 +09}.. {528228000 28800 0 +08}.. {543952800 32400 1 +09}.. {559677600 28800 0 +08}.. {575402400 32400 1 +09}.. {591127200 28800 0 +08}.. {606852000 32400 1 +09}.. {622576800 28800 0 +08}.. {638301600 32400 1 +09}.. {654631200 28800 0 +08}.. {670356000 25200 0 +08}.. {670359600 28800 1 +08}.. {686084400 25200 0 +07}.. {695761200 28800 0 +09}.. {701805600 32400 1 +09}.. {717530400 28800 0 +08}.. {733255200 32400 1 +09}.. {748
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):187
                                                                                                                                                                                    Entropy (8bit):4.9013773460609
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/2WFK4HB/8QaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/2wK4HJa
                                                                                                                                                                                    MD5:8A92C690BE27A69D122BFF51479B7B56
                                                                                                                                                                                    SHA1:52DB64587A347F34153A51788BDE8C349D966575
                                                                                                                                                                                    SHA-256:1F77C4BD27574E1D2066885DEF01806A02D3E444424A219A8EC5C114F89665E5
                                                                                                                                                                                    SHA-512:FEDF57C4862B6792A789F339EB1027EC8A8472B01B7D1D0814C419850B9AC03A7B454FDB04D8BECE166E9A8BCAA58B0B461007A6C824B30B1080991A1DB49CCA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):370
                                                                                                                                                                                    Entropy (8bit):4.4733192761103515
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKcrJfDm2OHATJeoHMaSYov/YSZkc5q/MVSSFFWSyvScH+dMVSSFL+:MB862EJLmdHjCEdOc5aMxaSyHHaMxF6P
                                                                                                                                                                                    MD5:C689A1AA9FFE535AEB3AD3D7EDE55172
                                                                                                                                                                                    SHA1:0520FC9A4619FB555A79C5DF2AE82422BF2C5EDA
                                                                                                                                                                                    SHA-256:2F39D9F93761B85C254F458317A7DE2B4184BE9459F2193A85C08662E801269A
                                                                                                                                                                                    SHA-512:C1034FB2FCFEF201C5362AF21B048B6637A824C5C93D75854CF3807892C772CD4376533E58BFF8D8726F531F43CB231365B8012EBD3C1BECED865D3CD2D6673D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jakarta) {.. {-9223372036854775808 25632 0 LMT}.. {-3231299232 25632 0 BMT}.. {-1451719200 26400 0 +0720}.. {-1172906400 27000 0 +0730}.. {-876641400 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 25200 0 WIB}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):213
                                                                                                                                                                                    Entropy (8bit):4.834345288972067
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKcaDm2OHG4YoH1kcfvScHVowkVcr2CV4zvhyov:MB862PmdHNYC6cfHHVop2NVkoov
                                                                                                                                                                                    MD5:2CB3A13FCC48F8C4457E001FC309918B
                                                                                                                                                                                    SHA1:83174176815CB93D216B5BC532C120EC8AC433CF
                                                                                                                                                                                    SHA-256:761C1E80FEBF46D6D6215CEBF211F121974156D9BCE2FB4258C1074C6ED2CE22
                                                                                                                                                                                    SHA-512:65009020AB9FEC2F8158A4851A78B71127F9B262DDD1472583942E19B7C086304F54BC8DAE5A40BD1448BCAEDA0FDBACCD19400E10FFA0357E324535F9036EF0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jayapura) {.. {-9223372036854775808 33768 0 LMT}.. {-1172913768 32400 0 +09}.. {-799491600 34200 0 +0930}.. {-189423000 32400 0 WIT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8135
                                                                                                                                                                                    Entropy (8bit):3.770028446231146
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:GKfnxFAEX/nPVl8diAg9oEhH20AHz7LzdWhYbBJPXuVhKaM76Rmg4DLeEcNptv5C:7ffBvPAzF0AHzPzdD1+XBRF0
                                                                                                                                                                                    MD5:884227D48C92BA6C519BFE571D4F1037
                                                                                                                                                                                    SHA1:21F8977816C2B439686A50D353B836A6D132A946
                                                                                                                                                                                    SHA-256:0BDC2C693134199C2ECD374CC01468813DB29DF47422C706A3EA2BE5ECCA177A
                                                                                                                                                                                    SHA-512:8A09F1FE11DAD203501A16FE6A2CAEC969FE3553B456B8BD1997E55B3EE430B2BB4B54F7D87C5E99931FD96E7C769CAA618C777EBD23FBD1E1A0F57409422914
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jerusalem) {.. {-9223372036854775808 8454 0 LMT}.. {-2840149254 8440 0 JMT}.. {-1641003640 7200 0 IST}.. {-933638400 10800 1 IDT}.. {-923097600 7200 0 IST}.. {-919036800 10800 1 IDT}.. {-857347200 7200 0 IST}.. {-844300800 10800 1 IDT}.. {-825811200 7200 0 IST}.. {-812678400 10800 1 IDT}.. {-794188800 7200 0 IST}.. {-779846400 10800 1 IDT}.. {-762652800 7200 0 IST}.. {-748310400 10800 1 IDT}.. {-731116800 7200 0 IST}.. {-681955200 14400 1 IDDT}.. {-673228800 10800 1 IDT}.. {-667958400 7200 0 IST}.. {-652320000 10800 1 IDT}.. {-636422400 7200 0 IST}.. {-622080000 10800 1 IDT}.. {-608947200 7200 0 IST}.. {-591840000 10800 1 IDT}.. {-572486400 7200 0 IST}.. {-558576000 10800 1 IDT}.. {-542851200 7200 0 IST}.. {-527731200 10800 1 IDT}.. {-514425600 7200 0 IST}.. {-490838400 10800 1 IDT}.. {-482976000 7200 0 IST}.. {-459388800 10800 1 I
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.8546989169864085
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFKTtNMXGm2OHodFxsYoHvgVHURRNVsRYovFFFkdj/cXHF:SlSWB9eg/2wKTPDm2OHoH+YoHvgVHURA
                                                                                                                                                                                    MD5:9BD9B21661C235C0794078EC98978D3B
                                                                                                                                                                                    SHA1:3D854780F49D0E5F5A190DC9367C7406127C5E4D
                                                                                                                                                                                    SHA-256:A59C95C038F2E945D685D96FA9B859CE82A643A1B7F56EB36B2C809DE91CD4BA
                                                                                                                                                                                    SHA-512:A76E99CF03DA8897F0A210A98DB79E4CD60070F2BE363D0D0960D9882919F9B49978FA55BB2500F1648ADD4080730CAD85BAFF61D885A9EAD394AC04C850F6BA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kabul) {.. {-9223372036854775808 16608 0 LMT}.. {-2524538208 14400 0 +04}.. {-788932800 16200 0 +0430}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2060
                                                                                                                                                                                    Entropy (8bit):3.788131608921229
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5+SeWI/2kkWk7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5i/2ZsFLrcZwvJt2F+doTr9Q3G80
                                                                                                                                                                                    MD5:390F39934F095F89358B73D056D90264
                                                                                                                                                                                    SHA1:6B57CE5346B50ED88BFBB6BC57F834FB3F564905
                                                                                                                                                                                    SHA-256:6E0278E389072437BC07A5032CD58E9E5B1B2BDB20918632C422EFA97BC43ABF
                                                                                                                                                                                    SHA-512:6C54D94E95D73030F2FFCF8D130494CBD79FB1CEB9B59ADE0743C10F02557C3DD59CC6274B262A7E29C2D4C35DDA4B6A9A0398C661F5BD40F3B92181192B9577
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kamchatka) {.. {-9223372036854775808 38076 0 LMT}.. {-1487759676 39600 0 +11}.. {-1247569200 43200 0 +13}.. {354888000 46800 1 +13}.. {370695600 43200 0 +12}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965600 43200 0 +12}.. {764
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):457
                                                                                                                                                                                    Entropy (8bit):4.396286144160272
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862dmdH35Cy6DvjeQXvjKEn6vNEhFc0bkTfb2iWToN1:5de3IjjeQ/jKE6vNNa8
                                                                                                                                                                                    MD5:DF604BCD42A3C1E6BABD0E4FF5764CA3
                                                                                                                                                                                    SHA1:984111F3A75EE7D8760AA2B839010545AF8EE359
                                                                                                                                                                                    SHA-256:4E7F7ACAE8B4018A835328744F680C8054771805BB0BB07678A09737963C090D
                                                                                                                                                                                    SHA-512:690AC3FC7CA3C66AA70F17E38C6B43FFACAB3F86040C3BA94FBFF80AC8C1AECF8192E503282109DABF3228F8DC73C732F1041C80455B8B26BDB25C4C32FA286A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Karachi) {.. {-9223372036854775808 16092 0 LMT}.. {-1988166492 19800 0 +0530}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 +0530}.. {-576135000 18000 0 +05}.. {38775600 18000 0 PKT}.. {1018119600 21600 1 PKST}.. {1033840800 18000 0 PKT}.. {1212260400 21600 1 PKST}.. {1225476000 18000 0 PKT}.. {1239735600 21600 1 PKST}.. {1257012000 18000 0 PKT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):174
                                                                                                                                                                                    Entropy (8bit):4.967143524972358
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8s4YkyXHAIgNrYOARL/2WFKu3e2WFKjov:SlSWB9vsM3yMGSHAIgvAN/2wKulwKjy
                                                                                                                                                                                    MD5:259662F35AA09A891C2DDF8FCFECD6F0
                                                                                                                                                                                    SHA1:DBB3A363A34C33F0B6B0D677E43C2985E2BAF976
                                                                                                                                                                                    SHA-256:7B2251F0A41CBADF45D69F24604834167B14D8D33B510E635719AB404CABBCE2
                                                                                                                                                                                    SHA-512:CD7E514555D58985C774535556B66542EFC5FB7CD5891F42FE21B591612CB7EBD4B41E96593E26E9283BA1B01EF3BE0FDFAE871F5EF6ADF2286AF1E479DCB44B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Urumqi)]} {.. LoadTimeZoneFile Asia/Urumqi..}..set TZData(:Asia/Kashgar) $TZData(:Asia/Urumqi)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.896398105471451
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFKXIi7hvXMXGm2OHF+VT5oHsQKwMTXvv6Q6zRk8P4VvW/:SlSWB9eg/2wKYghfDm2OH0T5oHxNMzv8
                                                                                                                                                                                    MD5:7AC6429D2A08372C71C61B4521246FEC
                                                                                                                                                                                    SHA1:6E50F5AD1018398491453D751F8B717B618EF46E
                                                                                                                                                                                    SHA-256:F0A0816E62036637F75081CBF17A1E6B8FBC2D86AEC3CD2E234BBBDD6EC9F109
                                                                                                                                                                                    SHA-512:A5389A318896ABCAFE419262F6B8CA86C917788F1E2AFBC8CB1C074A52870E7A92C9F6F7D79DDE4AB0D267D870D3CCD69B3FC5FD57520352EFE36C583B493FB9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kathmandu) {.. {-9223372036854775808 20476 0 LMT}.. {-1577943676 19800 0 +0530}.. {504901800 20700 0 +0545}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):184
                                                                                                                                                                                    Entropy (8bit):4.8363583658476745
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8yIi7V5XHAIgN1AIilvWARL/2WFKSiZ1/2WFKXIi7y:SlSWB9vsM3y7gVJHAIg5QOAN/2wKSg15
                                                                                                                                                                                    MD5:4CCC96293A33113D9ADC4130DCD19CBA
                                                                                                                                                                                    SHA1:7BAB4B8DD6BB415A2FC86D9AB36BE2A893C03153
                                                                                                                                                                                    SHA-256:9ACC9586B6F8B53BFE8B242283A434A9A9633D60559EBFDEE263B4C8915D50CA
                                                                                                                                                                                    SHA-512:644E1777E01C15A728E30526F131462FCE50476A8FEDA9B99F41D95013BB8833A79437E75AA2025E2FD2E253B9AD40709DEF77E1F0C73DAAE7A9CF886A175A03
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kathmandu)]} {.. LoadTimeZoneFile Asia/Kathmandu..}..set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2119
                                                                                                                                                                                    Entropy (8bit):3.707911838150672
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5No6r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFYkRDhUBAc6l:r5PhtjLiII2JBC6c6l
                                                                                                                                                                                    MD5:D7B394A9662D60D01781005FE73CC9E8
                                                                                                                                                                                    SHA1:50B5EBD02596DC45D1F69358C5B69DD3058905FC
                                                                                                                                                                                    SHA-256:33203D7FB7F3D1F848640ECE0642A2305E1863B4D47413075E2E7E40BD7418E7
                                                                                                                                                                                    SHA-512:055EBA420F2F6049E803796ACCA263264B9E585E5312A86B8DF7B409C5F1CB1810F3AEDACD66CCF4605E55198947D263C240486C2A4D453D23C89802F0C66BBA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Khandyga) {.. {-9223372036854775808 32533 0 LMT}.. {-1579424533 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):336
                                                                                                                                                                                    Entropy (8bit):4.614218930153471
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKvhfDm2OHEX3gYoHrXdUvvYbQLpUFdvjSVVFJLNsR/QFckVVFJLLW:MB8623tmdHNYCDWXYbQtUTvjAJBs50vs
                                                                                                                                                                                    MD5:248F1B5A26455000C936CE8BC02C1A0B
                                                                                                                                                                                    SHA1:0C3F8CD4E038B113E5238AC52652809B6CA27999
                                                                                                                                                                                    SHA-256:6D464564ED2EFC9DADA1586D4FC99FE333726D2BE15A00E30C2391F588896463
                                                                                                                                                                                    SHA-512:AF36B0B3D410305ED504726C87265ACCAF5577A9B5DD7E7DAF135420E356C651287873197431B65B5317B4BA2009274288E4F101AC1274045A8D99E2414AB132
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kolkata) {.. {-9223372036854775808 21208 0 LMT}.. {-3645237208 21200 0 HMT}.. {-3155694800 19270 0 MMT}.. {-2019705670 19800 0 IST}.. {-891581400 23400 1 +0630}.. {-872058600 19800 0 IST}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 IST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2062
                                                                                                                                                                                    Entropy (8bit):3.7086418466382605
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5Ote2CoXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEw:5B40yVRB7VfXucydm46I/CTxwh
                                                                                                                                                                                    MD5:A59F7FFD0C3EBAD47EC5F2B89EBBD9FA
                                                                                                                                                                                    SHA1:ACB94E28E0CF7C6606086267CEA1F63A3E755F56
                                                                                                                                                                                    SHA-256:53B8D5E7FB1BD67FECE66A933D9BDBB773F14A8C04D316A2A1B00EC6DBC151DD
                                                                                                                                                                                    SHA-512:7B3886B9D0A793CCEEDB2B190523922CFEBE5C82A5201C9EFA30CA4C7F63FB75C998CC7E1BD48D5D489F16E36FC0C22BD954CB7D321B3C09B36B60629C4C9F7E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Krasnoyarsk) {.. {-9223372036854775808 22286 0 LMT}.. {-1577513486 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):375
                                                                                                                                                                                    Entropy (8bit):4.4690470842439005
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wK1NSDm2OHroHvmdXjvWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScy:MB862PGmdHrCvovDTMsF/CFDMx/HHbMj
                                                                                                                                                                                    MD5:5CFF42C943FFC92D16DACEB2872590A8
                                                                                                                                                                                    SHA1:AEA8B1583764BE2AF7B055BC6AFAA0E486A2E35F
                                                                                                                                                                                    SHA-256:25A8328B309B68DA85C7A800086A1E4D3C62B96AD97FEF24FC429A14C50E762B
                                                                                                                                                                                    SHA-512:27800D0401E8D2028730B9664E9489B6A5182C394C2C05509E195D4471B4ABEFC26C82E9B818E94BD5578109728CD891FFE3C156248706A50D792D12A6CD8C96
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuala_Lumpur) {.. {-9223372036854775808 24406 0 LMT}.. {-2177477206 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):669
                                                                                                                                                                                    Entropy (8bit):4.074079100812583
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKPLBDm2OHXoH3UTdMVSSFVM5qGeCiKaFzsBRcerUNwGvULhMXeiCs:MB862HL1mdHXC3UBMxJJo9rphTXUzHHF
                                                                                                                                                                                    MD5:489E706324960E86B6E174D913C72E02
                                                                                                                                                                                    SHA1:C7D77482C0D41F3426FC269B3B6C0575EF0E8C7E
                                                                                                                                                                                    SHA-256:6E35E560675B0B5322474900D4EC8326C504788C1F82E533B09785DEEFF092DF
                                                                                                                                                                                    SHA-512:5CEFD44656C041E59A16481E042EA914E7C003BDE6ADF5F49B57052E91F4F732A91A244BD8BC09EF5DC2640D3210DEE53882717C5C4CBD85CCE44A93B028E9C3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuching) {.. {-9223372036854775808 26480 0 LMT}.. {-1383463280 27000 0 +0730}.. {-1167636600 28800 0 +08}.. {-1082448000 30000 1 +08}.. {-1074586800 28800 0 +08}.. {-1050825600 30000 1 +08}.. {-1042964400 28800 0 +08}.. {-1019289600 30000 1 +08}.. {-1011428400 28800 0 +08}.. {-987753600 30000 1 +08}.. {-979892400 28800 0 +08}.. {-956217600 30000 1 +08}.. {-948356400 28800 0 +08}.. {-924595200 30000 1 +08}.. {-916734000 28800 0 +08}.. {-893059200 30000 1 +08}.. {-885198000 28800 0 +08}.. {-879667200 32400 0 +09}.. {-767005200 28800 0 +08}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):173
                                                                                                                                                                                    Entropy (8bit):4.877362838821003
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFKdQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKdQ6
                                                                                                                                                                                    MD5:EA1DB4B80CC74CBA024B9BF3734B31F2
                                                                                                                                                                                    SHA1:D8131C093BCA3B378BEC606CFEB56A40CB4E246F
                                                                                                                                                                                    SHA-256:8E0C60A9AA64FB8602EDC35311F7436B04853970A21C1F6C871494A09AAD5787
                                                                                                                                                                                    SHA-512:3B57C9CCC16AA4FE71D275D5EC6A7BC1838841023EE4408158362A7E13E7F1B345F7D95006BC8D2FC270158864E286A1A9364C792F679D5803BD82148399C199
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Kuwait) $TZData(:Asia/Riyadh)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):169
                                                                                                                                                                                    Entropy (8bit):4.781739054385376
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8PWXHAIgNz+NOARL/2WFKf+WFKkvn:SlSWB9vsM3yOHAIg1AN/2wKGwKmn
                                                                                                                                                                                    MD5:55DAE27AEAA74FE822338C20B6CDFF68
                                                                                                                                                                                    SHA1:F00EB827DC29EB2063B3A0EDBC39856637C55F33
                                                                                                                                                                                    SHA-256:4308D741C83B263C7C9FB8EC692A7B7B502135E407B265B12EA7EF92523455C0
                                                                                                                                                                                    SHA-512:398EE6015C58BDBBEAB49B74833B938FD84DE1AC6D3B8D095CE772ECA980D9E93F4EBFFFFCEAE7F91E287C8CE4F94B1A078D8E1460C352B7C2018F99915838FF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Macau)]} {.. LoadTimeZoneFile Asia/Macau..}..set TZData(:Asia/Macao) $TZData(:Asia/Macau)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2217
                                                                                                                                                                                    Entropy (8bit):3.9638741177777868
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5ReCX8Iv3nhPHCvzncCHg9PHjZzH+0HDHN1aHhHNaezHBjHeHsH65H18HDH983lY:5d8u3hfCTcaOrh6qn151Wf3Bogp+nlC
                                                                                                                                                                                    MD5:B184E7403CB7168607D2C9E158F86A3B
                                                                                                                                                                                    SHA1:48B003B8F822BE979FBCB08CBDBFFC617BCF99DB
                                                                                                                                                                                    SHA-256:FBCB92CECB1CB0BC284ADC30D70C5F57B3AFC992136A0D898ABC64490BB700FB
                                                                                                                                                                                    SHA-512:D8C5C67CAEB7C670B7BD1DACC1203C4DEE4DDB16A780F502C4440997CFCFF869E86842EF87C2CD0E0B942941C02A6BC3BDAB7CEAD78B026B68F4A031173400C8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Macau) {.. {-9223372036854775808 27250 0 LMT}.. {-2056692850 28800 0 CST}.. {-884509200 32400 0 +09}.. {-873280800 36000 1 +09}.. {-855918000 32400 0 +09}.. {-841744800 36000 1 +09}.. {-828529200 32400 0 +10}.. {-765363600 28800 0 CT}.. {-747046800 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716461200 32400 1 CDT}.. {-697021200 28800 0 CST}.. {-683715600 32400 1 CDT}.. {-667990800 28800 0 CST}.. {-654771600 32400 1 CDT}.. {-636627600 28800 0 CST}.. {-623322000 32400 1 CDT}.. {-605178000 28800 0 CST}.. {-591872400 32400 1 CDT}.. {-573642000 28800 0 CST}.. {-559818000 32400 1 CDT}.. {-541674000 28800 0 CST}.. {-528368400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-498128400 32400 1 CDT}.. {-478774800 28800 0 CST}.. {-466678800 32400 1 CDT}.. {-446720400 28800 0 CST}.. {-435229200 32400 1 CDT}.. {-415258200 28800 0 CST}.. {-403158600
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2088
                                                                                                                                                                                    Entropy (8bit):3.7643610103361134
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5he9dbbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKx/y:5wv+0j6lua2Gg/3gO8UoOZU2Wc/pKo
                                                                                                                                                                                    MD5:F62A89F441C9C17EB99F64223C815651
                                                                                                                                                                                    SHA1:408C38A79E056FF9B03D0DA85114DC015CB66938
                                                                                                                                                                                    SHA-256:0C6EEEB7975A95C2B0678D137E6A735238D244A37FA11078050051511DE499FE
                                                                                                                                                                                    SHA-512:55DC72546BDC26450D5318E9D2819E32A91C27D06A7AF5432BD50F8722C69984BBAA8599055A824D2935D919F0C0AA357687DD9B47F49F213EEE21AF7458FE17
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Magadan) {.. {-9223372036854775808 36192 0 LMT}.. {-1441188192 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):243
                                                                                                                                                                                    Entropy (8bit):4.737440985553183
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wK5XDm2OHUVoHxYQTLQTvj1kc3gEpHkH8vScHr0:MB862hTmdHsCLTI6cQe7HHA
                                                                                                                                                                                    MD5:9116C0B70AB33EC49F933EAE0238FD4B
                                                                                                                                                                                    SHA1:BA390E8FBEAF5EA6E861AFC5A51CD4DF0B422461
                                                                                                                                                                                    SHA-256:30D8AB00E32ECE51442C0310E650D89D6989E0809600EE334CB10C506D84BF9D
                                                                                                                                                                                    SHA-512:499E60E8CBDA72226BCB4E241020E62B6F88E7D3E4329D260A6536EF87C02D7D61FD1BECC47D4FF308B4EB5D3E7FFBE2EC1C96FE2DEDC09DD1D973421C5FFE1E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Makassar) {.. {-9223372036854775808 28656 0 LMT}.. {-1577951856 28656 0 MMT}.. {-1172908656 28800 0 +08}.. {-880272000 32400 0 +09}.. {-766054800 28800 0 WITA}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):421
                                                                                                                                                                                    Entropy (8bit):4.48495488773916
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862GjmdHnCTZBCvEo6AwoucQzy4orjAbomAtoNv:5GjeCVwvB6AduXzylHAMmAa9
                                                                                                                                                                                    MD5:0FBF0ED252638DF31826C33EB3FFBFE2
                                                                                                                                                                                    SHA1:3496E4A5251A9BDF3AA4368297140780B6DBF66D
                                                                                                                                                                                    SHA-256:070D61A0E39643A700ABA89A8A4BE5733BA456958966098405E11ECDFA854D76
                                                                                                                                                                                    SHA-512:2A40E14964B357809E596DF88D8C4141ED78664BACA0A7724A7CA837EF427DC2B07C48D9DBE5787FAB0015673F5BDE002223D489334C5B91B74EEC5507A14B78
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Manila) {.. {-9223372036854775808 -57360 0 LMT}.. {-3944621040 29040 0 LMT}.. {-2229321840 28800 0 PST}.. {-1046678400 32400 1 PDT}.. {-1038733200 28800 0 PST}.. {-873273600 32400 0 JST}.. {-794221200 28800 0 PST}.. {-496224000 32400 1 PDT}.. {-489315600 28800 0 PST}.. {259344000 32400 1 PDT}.. {275151600 28800 0 PST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):170
                                                                                                                                                                                    Entropy (8bit):4.805992552335358
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8DeXHAIgN6S7ARL/2WFKvE+H+WFKQ3n:SlSWB9vsM3yj+HAIgMS7AN/2wKLewKQ3
                                                                                                                                                                                    MD5:8AEB5C3E81069F884A370714E8013F1F
                                                                                                                                                                                    SHA1:4E3DD4A84627E75E84726C0CBA72CA6801280C2B
                                                                                                                                                                                    SHA-256:011B7DE1C9F7EC241B224BC864D8AE66ACB433FBC8AD939E4DBEB12BE6390243
                                                                                                                                                                                    SHA-512:50B1DE2615AE9B4781505DC709F9D07F6221D4E6D7B61D7BDA682377EAD9807F47FF0E933B79823D0DFD9F3647A82CFC28FB41FBB2226ED1D08B76F86FEB45DC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dubai)]} {.. LoadTimeZoneFile Asia/Dubai..}..set TZData(:Asia/Muscat) $TZData(:Asia/Dubai)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7625
                                                                                                                                                                                    Entropy (8bit):3.7113086720696398
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:R3pv/7V6Aj8aZaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:R3v/AauivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:2ADD0DFC1F133E4D044727234251A3DC
                                                                                                                                                                                    SHA1:0D1502986258349E384017BA6CB8FA0AC424638C
                                                                                                                                                                                    SHA-256:3C3E4844C70D361893EF022D6C3C8E38B243E91D40C5A726C924355476816F25
                                                                                                                                                                                    SHA-512:70CDD53E7E44EDABF653A4F92EECBF5BB20A31DA95D65209D1CADE7DD9FC68946B8EC8829C28AE00BE5F42AAB545B9282CBBCFC5834437D6A94A179BF4FE0141
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Nicosia) {.. {-9223372036854775808 8008 0 LMT}.. {-1518920008 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {62258760
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2063
                                                                                                                                                                                    Entropy (8bit):3.718004112421892
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:526enddzXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFf:5l40yVRB7VfXucydm46I/CTxwf
                                                                                                                                                                                    MD5:513B6A2AF76DAED9002C037BEC99862F
                                                                                                                                                                                    SHA1:82D1C47BDF46B8B901C35BACACE8595C093BF5F2
                                                                                                                                                                                    SHA-256:96A445D47D834C28480D1E2036ECA4962B35AFA494C219065D4879F71C1830DB
                                                                                                                                                                                    SHA-512:2FE5AF4FA9D6AAB4FBD8E354789B82D39FA1B52394D3A0ABFBC6A30A531E0B7429A3D9AC7835A2843A6E9859E0255565F151FDFC87004ACB4EBD1AAD40BDA8A4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novokuznetsk) {.. {-9223372036854775808 20928 0 LMT}.. {-1441259328 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2121
                                                                                                                                                                                    Entropy (8bit):3.714792994893581
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:52sve20ruXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnF:5Hc40yVRB7VfXu0TKmtTTDOWQ
                                                                                                                                                                                    MD5:AC8C8D768503C8334A9FBAEF4C3A9CAB
                                                                                                                                                                                    SHA1:CA10BB99E2D7AB329229759BD4801068A3AEB6D5
                                                                                                                                                                                    SHA-256:EF799077291F6B3B19E0AEC88F224BB592FAAD09D30740F2376D3D20F2169639
                                                                                                                                                                                    SHA-512:34049B1AC4254F999C3E5AD8CB31ABF88AC2D972E20E19927F33CC59935354F92125A0342A413E64227E8AE29DDFC2FFE5F67AE538C89D8EBAD7FCA889321DFA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novosibirsk) {.. {-9223372036854775808 19900 0 LMT}.. {-1579476700 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {738090000 25200 0 +07}.. {7
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2055
                                                                                                                                                                                    Entropy (8bit):3.6912374223526396
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5abexPvO1FMnFP1FCnFHnFKqenFdDnFQgOnFxjPnFITnFonFJynFAT4TBThSv0FP:5asvjdqxph01NSvPETKmtTTDO0
                                                                                                                                                                                    MD5:3E06B20B0B62AA09FA03082FAEE4FD62
                                                                                                                                                                                    SHA1:8886EC80528ECA13D3364138BFFE92F881768169
                                                                                                                                                                                    SHA-256:2605CD1E26E4AB48BCB4399BB5B17BAD115A47F87BA3DD54B55BB50C3FE82606
                                                                                                                                                                                    SHA-512:04C1B6A898D12C8EA1B0B2F6665C870434061C63CC8F7A067BFC708E9828BA2E60104B82E2025E42D51DA2F485890C4D34EC0341EF466A7942649BE64F5EEE17
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Omsk) {.. {-9223372036854775808 17610 0 LMT}.. {-1582088010 18000 0 +05}.. {-1247547600 21600 0 +07}.. {354909600 25200 1 +07}.. {370717200 21600 0 +06}.. {386445600 25200 1 +07}.. {402253200 21600 0 +06}.. {417981600 25200 1 +07}.. {433789200 21600 0 +06}.. {449604000 25200 1 +07}.. {465336000 21600 0 +06}.. {481060800 25200 1 +07}.. {496785600 21600 0 +06}.. {512510400 25200 1 +07}.. {528235200 21600 0 +06}.. {543960000 25200 1 +07}.. {559684800 21600 0 +06}.. {575409600 25200 1 +07}.. {591134400 21600 0 +06}.. {606859200 25200 1 +07}.. {622584000 21600 0 +06}.. {638308800 25200 1 +07}.. {654638400 21600 0 +06}.. {670363200 18000 0 +06}.. {670366800 21600 1 +06}.. {686091600 18000 0 +05}.. {695768400 21600 0 +07}.. {701812800 25200 1 +07}.. {717537600 21600 0 +06}.. {733262400 25200 1 +07}.. {748987200 21600 0 +06}.. {76471200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1664
                                                                                                                                                                                    Entropy (8bit):3.708603813141953
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:53PvalvNhQQvmRKqv0fvzQIovWdvEGvDaDv7w9hYwr:JHaBNKs6b03zB0WJEuDa77w9hYA
                                                                                                                                                                                    MD5:A3BD0C15642AE4F001F98F8E060E8374
                                                                                                                                                                                    SHA1:366F3C7FD4000AC23B79AB0FF4429371ED323B81
                                                                                                                                                                                    SHA-256:933BBCD7AE0BF59A5B4A6E0EF74C237FEEDC42E6A3AEB2158131AA70FBA6FE47
                                                                                                                                                                                    SHA-512:16D8692D3EA96D3594E6220A6989BBFBB926A66EEBEB240C4DC68BE75C69C5206659D9D341D92AE6128928FD38A5F45B445621CBBBA4E4BA8C34C3AC52BF3C08
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Oral) {.. {-9223372036854775808 12324 0 LMT}.. {-1441164324 10800 0 +03}.. {-1247540400 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {701816400 14400 0 +04}.. {701820000 18000 1 +04}.. {717544800 14400 0 +04}.. {733269600 18000 1 +04}.. {74899440
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.958543249401788
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKeHKLNM0WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKTNg
                                                                                                                                                                                    MD5:EBF01E229CC41EB8B27650A3D668EDC1
                                                                                                                                                                                    SHA1:33E1B252C1B45EAE326FCF8CC7C80C78A46F7E8D
                                                                                                                                                                                    SHA-256:DCEE88876D00396918F43DECA421B6C9B02F84B5866A2CE16E641B814B390A9F
                                                                                                                                                                                    SHA-512:80840600F37A256B8FD9933760FBAE7C13DE1E24EFD970E47BE8DEC731DFABF6D6FB76999BEEC775FF8C8B8719E94788ED7EEB04376A34C827ACB443F720F7E3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Phnom_Penh) $TZData(:Asia/Bangkok)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):369
                                                                                                                                                                                    Entropy (8bit):4.492596995768464
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKT5PDm2OHUeoH99xV/1kc5k/MVSSFFCLkvScH+dMVSSFL1CnF4mMz:MB862L5bmdHFCRV/6c5kMxGLkHHaMxFn
                                                                                                                                                                                    MD5:9ADB1A9E41A143A06116E24EA0A53D90
                                                                                                                                                                                    SHA1:6E50B549E1A705C0090BD5EDE26F7DED78CDF71A
                                                                                                                                                                                    SHA-256:AC8370AEDF5FE3FE1E80710CE117DEE23815BE377D418E4B4F3259A1930E8DBF
                                                                                                                                                                                    SHA-512:92790B20B960AC518AB2E18F902C6E0BA887F268909F5571CAC1068F5E719CCF6943AE6902DA1B683E170658B5E7BE06C6A187C1C0A652DD052D5BD0B2A7B84D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pontianak) {.. {-9223372036854775808 26240 0 LMT}.. {-1946186240 26240 0 PMT}.. {-1172906240 27000 0 +0730}.. {-881220600 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 28800 0 WITA}.. {567964800 25200 0 WIB}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):273
                                                                                                                                                                                    Entropy (8bit):4.709411633376997
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wK8cE4SDm2OHnNoH9Aw8vmVuT0vjLtcjviov:MB8620cExmdHnNCGv2Ezv
                                                                                                                                                                                    MD5:727BBC1A1662B500F616F544A484F213
                                                                                                                                                                                    SHA1:93C1D902D9D4AA4197C7D16C61FB784AC01D0DE5
                                                                                                                                                                                    SHA-256:29BA17F756F5C0BBA30FEBF44E620504D04921C832BD1CB56E1B60EF288B57DF
                                                                                                                                                                                    SHA-512:C3C91E2F180109FF33E6491722F679A1B8DCE8CD31DE006D7FF2CBE270C008E927507C953641D28EE77D139BBEA54DEA1B7DBD6C30B208DDAB1B58756C32AC02
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pyongyang) {.. {-9223372036854775808 30180 0 LMT}.. {-1948782180 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-768646800 32400 0 KST}.. {1439564400 30600 0 KST}.. {1525446000 32400 0 KST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):176
                                                                                                                                                                                    Entropy (8bit):4.851251407399968
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFKK3ovXMXGm2OHPFV4YoHsQKb3VvVsRYovFFF3FRVGsWr:SlSWB9eg/2wKK3yXDm2OHoYoHxcvSNFS
                                                                                                                                                                                    MD5:CBA9635133F88AD3B27E23B95430C27C
                                                                                                                                                                                    SHA1:5E41232EC03BBC71B522F58CB2D05E6BFFFF1A75
                                                                                                                                                                                    SHA-256:18CCA69F933795CE3F7DB31506EFC063E6CE1DFDCAB32AA387C398456D7F7E1F
                                                                                                                                                                                    SHA-512:D7C43F1F9ADA54C914ADB3CB2C9063EB7044089CFC7755ACFD08828CDEBA3C116AE2BE916ABE5D561E63699B921BC52636DD0BBC2C4304F813616D320D7DDAAF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qatar) {.. {-9223372036854775808 12368 0 LMT}.. {-1577935568 14400 0 +04}.. {76190400 10800 0 +03}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1668
                                                                                                                                                                                    Entropy (8bit):3.7299735983334195
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5DwvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQA:BMaBNKs6b03zB0WJEuDa7sFZiKWaN6TE
                                                                                                                                                                                    MD5:F5DBE4E72FA5AB0019CC98C8E21EC86E
                                                                                                                                                                                    SHA1:27ECB901AA07C18EA7F38235E8EFE0B1635FEFBC
                                                                                                                                                                                    SHA-256:4191629B874C988291E8FD13E675A3ED685D677F6541313975FC4610E47F1DCD
                                                                                                                                                                                    SHA-512:D5EFD4EFFFFE2E41909AEB7B67BD1FA6FAF4B8E9AC645518D5B33BD1B3C5084F59D47D4ED052E0D4B9F9989BDDBA3AECB3D1E67F5237914D24C01F9C95242396
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qostanay) {.. {-9223372036854775808 15268 0 LMT}.. {-1441167268 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {7489
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1670
                                                                                                                                                                                    Entropy (8bit):3.734572151642808
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5NvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWgvNSvTqvIQvyovklvqQX0:TaBNKs6b03zB0WJEuDa7sFZiKWcN6Tir
                                                                                                                                                                                    MD5:026EC6E479EC006C4398288362254680
                                                                                                                                                                                    SHA1:24AD03DD21DA394B3423D27211955BFD694F8E73
                                                                                                                                                                                    SHA-256:CD6B067AA3EF6935B4E89CA36E6A03FCB97F1E0EE61A7B5D46C06BF4DE140774
                                                                                                                                                                                    SHA-512:023AC55E118F13A31CE996C7BA155C90D47DEB6C223EEB3C0EE7B702871FF0CCA13CDF61D65FDDABE41B888CD7A74274AA5730059CC5688F8ED4DDBF8FE4ECA4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qyzylorda) {.. {-9223372036854775808 15712 0 LMT}.. {-1441167712 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {701812800 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):174
                                                                                                                                                                                    Entropy (8bit):4.812955128020714
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8nv3vXHAIgNnDA6RL/2WFK02KQMFfh4WFKsyn:SlSWB9vsM3yHvPHAIg15N/2wK0GEJ4wy
                                                                                                                                                                                    MD5:BD3F294F1EDDD21467E980C9F5A0E7DE
                                                                                                                                                                                    SHA1:11A3FC3E4489C18BDF9BFFB4C44615559D9DD99D
                                                                                                                                                                                    SHA-256:E4D2C38D8E7377A528291A88129CDAC40CA4D40A5F1CD8ADB98228527556906E
                                                                                                                                                                                    SHA-512:FA5FD600627793EABB83C1066BE246A47BCCE1FC57830596B9C0CDE8901B949AF178ABDE876C3B73CC3751312E8A4C03C390888B0B5A9669F511344143F83073
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Yangon)]} {.. LoadTimeZoneFile Asia/Yangon..}..set TZData(:Asia/Rangoon) $TZData(:Asia/Yangon)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):148
                                                                                                                                                                                    Entropy (8bit):4.973311159904374
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFK814PMXGm2OHFukeoHqUi9VssWYcv:SlSWB9eg/2wK81GDm2OHF7eoHvi9V1Wr
                                                                                                                                                                                    MD5:AD3236CFF141732831732357AB181EE3
                                                                                                                                                                                    SHA1:EAF51A63898A2048EA5FBE9BA4C001EEE37FFDB2
                                                                                                                                                                                    SHA-256:411E31D09FFA48E44169C42661AE2F7FC142460BCAA216837D8C4740983CA7BD
                                                                                                                                                                                    SHA-512:6CA2D89C02568580786BE98A863453ADCF4D21CAC52E5B44C4F7A05E76D29AEB3E28E353D6FB758BB553DBC8F35389462B388F61E94C68F5DB50A3E8C429336D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Riyadh) {.. {-9223372036854775808 11212 0 LMT}.. {-719636812 10800 0 +03}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.946090704619887
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8I65eV5XHAIgN2h6560ARL/2WFKwJ6h4WFK365ey:SlSWB9vsM3yJAVJHAIgA4k0AN/2wKl4i
                                                                                                                                                                                    MD5:0766480A295525EE5D65F1ED32094858
                                                                                                                                                                                    SHA1:7A2D68E1009DDD809A4A700931456C617DCD343A
                                                                                                                                                                                    SHA-256:C695981A0DF691C3F4509999FBC52858ADC75024CCCBDEFBE1094FED17E809E4
                                                                                                                                                                                    SHA-512:A21536FB61A64E953E8D6414FF0AEF1BC7E68A33C5DCF7090517A91FC449B96A93A4FBDF2C00682540D1193FDB29603349F5BDB455FD90045FDBCA61247A9860
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ho_Chi_Minh)]} {.. LoadTimeZoneFile Asia/Ho_Chi_Minh..}..set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2117
                                                                                                                                                                                    Entropy (8bit):3.7276904131666577
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5q+3Vv+0j6lua2Gg/3gO8UoflcXRDhUBAc+:YxIa2GOT8tiXBC6c+
                                                                                                                                                                                    MD5:295D51B8FBBE890C97637687B8F32322
                                                                                                                                                                                    SHA1:7BB72B0EC783898DDF625D275E3BBB964D1693FB
                                                                                                                                                                                    SHA-256:D7D0EA5CEF908442AB0D777A4B097BED18540CD5280FF63F33DD989E27E72908
                                                                                                                                                                                    SHA-512:9B3E3BA01EAE38A00B0EE8A8FB17191CB4ED2EE9E46AE06403BA8C1193804764C86599840DC03E0C6A631456E1BE2BC560BDF6CF0450068EF78A6E494041326C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Sakhalin) {.. {-9223372036854775808 34248 0 LMT}.. {-2031039048 32400 0 +09}.. {-768560400 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):879
                                                                                                                                                                                    Entropy (8bit):3.9460497720710506
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5t8eZd7QvalvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKT10Sv6r:5MvalvNhQQvmRKqv0fvzQIovWdvEGvDO
                                                                                                                                                                                    MD5:10A758996B0DF756E520541BEA9B7D75
                                                                                                                                                                                    SHA1:137E5FD4E00CFA4B3939EF11868862B7F93D87CD
                                                                                                                                                                                    SHA-256:35E4B905723891281D9A6A0A1FD3760A3A48136E1419C686BE31ACE83BF7AA9D
                                                                                                                                                                                    SHA-512:7E32661731EAB2ED8C387533ACCB4853F5B6225BAC11E93247E7B06D7AA856E6A665F63718BFE395CFD00F80A4C16789D7097FFA8DAD88B1D707BF9C155C1D4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Samarkand) {.. {-9223372036854775808 16073 0 LMT}.. {-1441168073 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):985
                                                                                                                                                                                    Entropy (8bit):4.121802167517286
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5AemgvHzF+zg2c+z3NGmJhIUfqII8yHg/zoD:5F/nfWUBISHg/G
                                                                                                                                                                                    MD5:A1DE6975DEA70D7241B5B3C43E1EA3AA
                                                                                                                                                                                    SHA1:35EE563A2BCA77C761F7E878997763EA8D258040
                                                                                                                                                                                    SHA-256:C4F82C94650572FE4D03BC1FE54CED8F4BF55DFBEE855D52DE3EA6378240AF93
                                                                                                                                                                                    SHA-512:1639B0609115DBEA6A381986A732A5CA1523952AEF84843B4D714D5B2FF40B16C4166D8D60D31D4FC2C2BA34DED1F6DB39474336195603562265BDBF71687696
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Seoul) {.. {-9223372036854775808 30472 0 LMT}.. {-1948782472 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-767350800 32400 0 KST}.. {-681210000 36000 1 KDT}.. {-672228000 32400 0 KST}.. {-654771600 36000 1 KDT}.. {-640864800 32400 0 KST}.. {-623408400 36000 1 KDT}.. {-609415200 32400 0 KST}.. {-588848400 36000 1 KDT}.. {-577965600 32400 0 KST}.. {-498128400 30600 0 KST}.. {-462702600 34200 1 KDT}.. {-451733400 30600 0 KST}.. {-429784200 34200 1 KDT}.. {-418296600 30600 0 KST}.. {-399544200 34200 1 KDT}.. {-387451800 30600 0 KST}.. {-368094600 34200 1 KDT}.. {-356002200 30600 0 KST}.. {-336645000 34200 1 KDT}.. {-324552600 30600 0 KST}.. {-305195400 34200 1 KDT}.. {-293103000 30600 0 KST}.. {-264933000 32400 0 KST}.. {547578000 36000 1 KDT}.. {560883600 32400 0 KST}.. {579027600 36000 1 KDT}.. {592333200 32400 0 KST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):981
                                                                                                                                                                                    Entropy (8bit):4.16042656890735
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5Te3vvZJzHjwH6kHp7FH32AzHjZBHNHlQHuHxmHUjH6zHj2HBHeC:5ovZZO7lLpT24
                                                                                                                                                                                    MD5:A266AA43A84FD5E4890BC77AA4E240D0
                                                                                                                                                                                    SHA1:CD88C5D451CD7D3F50C9B36FDD47C84D20377441
                                                                                                                                                                                    SHA-256:3AABB42D9EFE95D906B7F34640E7815919A1A20979EBB6EC1527FCAA3B09B22A
                                                                                                                                                                                    SHA-512:13AE48F58C9AF24002F0FE4F28BF96B10EE0ED293E0DE9D29BCEBAAE102B2EA818F42CA4069544A254C95444A48604EC57E6AB2BEBDA4B5E72C82B49E61AD0A0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Shanghai) {.. {-9223372036854775808 29143 0 LMT}.. {-2177481943 28800 0 CST}.. {-1600675200 32400 1 CDT}.. {-1585904400 28800 0 CST}.. {-933667200 32400 1 CDT}.. {-922093200 28800 0 CST}.. {-908870400 32400 1 CDT}.. {-888829200 28800 0 CST}.. {-881049600 32400 1 CDT}.. {-767869200 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-650016000 28800 0 CST}.. {515527200 32400 1 CDT}.. {527014800 28800 0 CST}.. {545162400 32400 1 CDT}.. {558464400 28800 0 CST}.. {577216800 32400 1 CDT}.. {589914000 28800 0 CST}.. {608666400 32400 1 CDT}.. {621968400 28800 0 CST}.. {640116000 32400 1 CDT}.. {653418000 28800 0 CST}.. {671565600 32400 1 CDT}.. {684867600 28800 0 CST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):372
                                                                                                                                                                                    Entropy (8bit):4.436676898144829
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKfbSDm2OHxdoHvm5vWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScHS:MB862nbGmdHDCvsvDTMsF/CFDMx/HHbe
                                                                                                                                                                                    MD5:C3D13D921E4C6E475910E5080B761C32
                                                                                                                                                                                    SHA1:8C5AE73C4098D03908E5D567FD7C4D827601D718
                                                                                                                                                                                    SHA-256:05C76B58A4E356FD358E24FBC71FAE98DCB18C441C8D8CBB13A18D4F6E406062
                                                                                                                                                                                    SHA-512:3A620597469D31577ECAAA098C95C244F0C288ABACE9E8964D8641154C1893967EFBD7211A41751D0D4CC1B0B9A2286F11738EFB7D01F110A4826BBE1844A2EA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Singapore) {.. {-9223372036854775808 24925 0 LMT}.. {-2177477725 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2064
                                                                                                                                                                                    Entropy (8bit):3.7913177223006698
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5HJeidmbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxwy:5HSv+0j6lua2Gg/3gO8UoOZU2Wc/pKf
                                                                                                                                                                                    MD5:B4FA38E884A85F6BD47C8BB02BB0500C
                                                                                                                                                                                    SHA1:1DD135B79CC0D81C048D7B2C6BE0CF71171DD19E
                                                                                                                                                                                    SHA-256:705D6D8360C2DCD51E909E39E1910FE876145220D151031612DA36B247207395
                                                                                                                                                                                    SHA-512:2D32AAAF1BCC865B5F2810BFE0FB82BE98140BB5F2ECA1DA7FD148A3074DA127B81242F17B8BA9C9E259B61CBB123FD1513CCE6A85C8D7679ADFC0D689B552BB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Srednekolymsk) {.. {-9223372036854775808 36892 0 LMT}.. {-1441188892 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1344
                                                                                                                                                                                    Entropy (8bit):4.062084847879695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5X2eIvZPzGzHjZBHNHlQHKn3HnHNd9HiHkHBHaHLHMtyH9Qm+zHFOzHZ32HZvHiR:5Xi1ypBvt1mwO3Kq46T
                                                                                                                                                                                    MD5:AECA800C8F2A679D0B19E5BB90AFD858
                                                                                                                                                                                    SHA1:2C7DCEB709F9A4312C511971FE1E6A9DC1FBD0E8
                                                                                                                                                                                    SHA-256:389C9D3EE2970665D0D8C5CB61B8B790C5FBDDC0DF0BF2B9753046F5953A477F
                                                                                                                                                                                    SHA-512:C2D6BB4FEB5848D0704647D26F94C0BD8CD7E834AA2187EC9C877E80157E9CC225BBA3BECEE0148894C8639105D292AB50EE95830992BF357C632ACF001E020F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Taipei) {.. {-9223372036854775808 29160 0 LMT}.. {-2335248360 28800 0 CST}.. {-1017820800 32400 0 JST}.. {-766224000 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-639133200 28800 0 CST}.. {-620812800 32400 1 CDT}.. {-607597200 28800 0 CST}.. {-589276800 32400 1 CDT}.. {-576061200 28800 0 CST}.. {-562924800 32400 1 CDT}.. {-541760400 28800 0 CST}.. {-528710400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-497174400 32400 1 CDT}.. {-478688400 28800 0 CST}.. {-465638400 32400 1 CDT}.. {-449830800 28800 0 CST}.. {-434016000 32400 1 CDT}.. {-418208400 28800 0 CST}.. {-402480000 32400 1 CDT}.. {-386672400 28800 0 CST}.. {-370944000 32400 1 CDT}.. {-355136400 28800 0 CST}.. {-3394080
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):878
                                                                                                                                                                                    Entropy (8bit):3.9280321712564845
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5geQqdNRvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10Sv6r:5+EvdJqxiF0rvK50Sv6r
                                                                                                                                                                                    MD5:DB59DB8E401E12917B7367D5604D3DE6
                                                                                                                                                                                    SHA1:7CC7C5C1DB551BD381B833C81746201D36BC59A9
                                                                                                                                                                                    SHA-256:4445F3F892C7267A6867009CC1A3F0B0548D0240408375A9D15360B28993C2A9
                                                                                                                                                                                    SHA-512:2C7AE63C408A9F06F973AAC16845E1DBE92D15A421BBBE420914F21155AD5E57CD058D7E4427E43185E023D2FF475EBF9D74003ECEF004FF4E5F9D5681ADFB80
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tashkent) {.. {-9223372036854775808 16631 0 LMT}.. {-1441168631 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1729
                                                                                                                                                                                    Entropy (8bit):3.6815162494646034
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5yBeqvIdZlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPqUsx9Ul4N:5MmsUf8mFpNWFnytO6VnYK
                                                                                                                                                                                    MD5:C376C9ED66F6CC011E063D3E8E0DCED1
                                                                                                                                                                                    SHA1:13C6345F8CB0EC79FE7C78B156C5737BCB66E49E
                                                                                                                                                                                    SHA-256:B637BB0E49144C717E99E93540CB2C4D3695D63B91FE42547F2F0AA006498693
                                                                                                                                                                                    SHA-512:FD60192CBEDC91C5D6B3B5E6F19DEDCAE14DCF48DCAE6D4865A8F0BBDC01CBF8DAAE92C4C46C353AF5B3EEE36CCC87B23F193DDF221132F5404C42507B708364
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tbilisi) {.. {-9223372036854775808 10751 0 LMT}.. {-2840151551 10751 0 TBMT}.. {-1441162751 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {694213200 10800 0 +03}.. {701816400 14400 1 +03}.. {717537600 10800 0 +03}.. {733266000 14400 1 +03}.. {748
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7250
                                                                                                                                                                                    Entropy (8bit):3.5278500339429972
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:z73zxgC3kvOR0xV1oLp9ZUj8nZjcJ5NIOFVp7ufbIL74f6IQTExJQtcAL:vryO2H1oLp9aQZyDmIVEPW
                                                                                                                                                                                    MD5:359B270670A5FF61BBCE3D07F1BAA5AB
                                                                                                                                                                                    SHA1:5B6D01C931D31D92299EE4455F76E69EB0C25A96
                                                                                                                                                                                    SHA-256:A78655218A749F4ABCA436BE818E84D3277220FF3E69BE20A786AADF8AC744F9
                                                                                                                                                                                    SHA-512:DFB0C7452AF6124A3742042CD97E7B9C0A84A4E338E00AF6DD66C971BC4D1324D3947A3A8601778F026E50367D942C10513FA1D73742E7006E91BF35E90260BF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tehran) {.. {-9223372036854775808 12344 0 LMT}.. {-1704165944 12344 0 TMT}.. {-757394744 12600 0 +0330}.. {247177800 14400 0 +04}.. {259272000 18000 1 +04}.. {277758000 14400 0 +04}.. {283982400 12600 0 +0330}.. {290809800 16200 1 +0330}.. {306531000 12600 0 +0330}.. {322432200 16200 1 +0330}.. {338499000 12600 0 +0330}.. {673216200 16200 1 +0330}.. {685481400 12600 0 +0330}.. {701209800 16200 1 +0330}.. {717103800 12600 0 +0330}.. {732745800 16200 1 +0330}.. {748639800 12600 0 +0330}.. {764281800 16200 1 +0330}.. {780175800 12600 0 +0330}.. {795817800 16200 1 +0330}.. {811711800 12600 0 +0330}.. {827353800 16200 1 +0330}.. {843247800 12600 0 +0330}.. {858976200 16200 1 +0330}.. {874870200 12600 0 +0330}.. {890512200 16200 1 +0330}.. {906406200 12600 0 +0330}.. {922048200 16200 1 +0330}.. {937942200 12600 0 +0330}.. {953584200 16200 1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):184
                                                                                                                                                                                    Entropy (8bit):4.876713308636272
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/2WFK+TT52WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/2wKsswKR
                                                                                                                                                                                    MD5:40B15013485EE2138A3DCB915F9121E7
                                                                                                                                                                                    SHA1:3ADBE38686C7CA1FDE3DDD12BE908F39BFD1E228
                                                                                                                                                                                    SHA-256:07537A30E6236D9E334DAFD5C4D352D25FDEF95D6DC7496F5D93EFAB74D9EBB1
                                                                                                                                                                                    SHA-512:DA3B7B44B3BEF07CA8AA5253BF684A838181D8A15D7CCF0447A6B5F5BAE28D155CF65BCFB6286EB36C0B9F4FDD1FE862A3297ADB6FC33532B9F766334283D725
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):176
                                                                                                                                                                                    Entropy (8bit):4.906503135441824
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8kNZ4WXHAIgNqFNKARL/2WFK9Z752WFKvNZovn:SlSWB9vsM3ykZ42HAIgc3KAN/2wKf126
                                                                                                                                                                                    MD5:081862B6FB33389BEC9B0E6B500AA342
                                                                                                                                                                                    SHA1:AF9467BB87C4C28921DF62A87B81223052F9FF4A
                                                                                                                                                                                    SHA-256:37459C17B59639DF62B3F3943751902CE6AAF1F11B7630069DB45052EBEFB5B9
                                                                                                                                                                                    SHA-512:CAF6F1C928528C4471229A2EF2944623545626532986628E6CE38884535286A0B38BA88C1A295E8B11322475D6BFAC61BF89786A76330C1A0C729339A3532BAF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Thimphu)]} {.. LoadTimeZoneFile Asia/Thimphu..}..set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.887493603495978
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFKvNZJMXGm2OHEQUTFnoHqVaJKuc/v6Q61V9gmZVFSTVV:SlSWB9eg/2wKVZJDm2OHEfnoHDKuc/SC
                                                                                                                                                                                    MD5:F239452984CCA9F23E97A880652C39E6
                                                                                                                                                                                    SHA1:52D25282D03B79960F152D21E7492EE26DAEBBAA
                                                                                                                                                                                    SHA-256:B797C74E3840298C3CD8149FC8AA4BCE839EFE79E7C3310986FF23C965607929
                                                                                                                                                                                    SHA-512:1044BEDAE04FCA7BD62937AFCE70F6C447583A90DD1596C3029A64A8251E3F73C106F4D940548DD38E895D67FEFDCD196B257E11437DEB399085EE80C345AA50
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Thimphu) {.. {-9223372036854775808 21516 0 LMT}.. {-706341516 19800 0 +0530}.. {560025000 21600 0 +06}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):388
                                                                                                                                                                                    Entropy (8bit):4.470556147950505
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862ymdHOx5CvAoK3zoiIxtoFDIe+zT0agbov:5yeOCvARzzCOVa/gby
                                                                                                                                                                                    MD5:3CCC15B63A882DB1B7459A51CD1C8165
                                                                                                                                                                                    SHA1:77A3EFE6E4EE524B9EC6F51593DD7521FD7B8DAD
                                                                                                                                                                                    SHA-256:3DA522FA88541A375D53F30A0B62DC4A305FA0315FEE534B7998C9E0A239450A
                                                                                                                                                                                    SHA-512:15238E96DABAB5D2B9FFD25B3F50417ED32205FA69239D6F6B28DA97A378D669FD409164964D0DD2A5B1D795C8F60E8D4EB15924046348C3D6010646A536E07C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tokyo) {.. {-9223372036854775808 33539 0 LMT}.. {-2587712400 32400 0 JST}.. {-683802000 36000 1 JDT}.. {-672310800 32400 0 JST}.. {-654771600 36000 1 JDT}.. {-640861200 32400 0 JST}.. {-620298000 36000 1 JDT}.. {-609411600 32400 0 JST}.. {-588848400 36000 1 JDT}.. {-577962000 32400 0 JST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2116
                                                                                                                                                                                    Entropy (8bit):3.695316005718174
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5CeLz/XJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEno:5H040yVRB7VfXucydm4IqtTTDOS
                                                                                                                                                                                    MD5:E95DE93CBCE72C5E02D7ECFE94C96308
                                                                                                                                                                                    SHA1:59A49EBFE544D97545BADFEFE716BB5659C64C20
                                                                                                                                                                                    SHA-256:6B64A01D0F0B5EC7A1410C3BD6883BA7CC133E9F073D40E8BFECE037E3A3FA24
                                                                                                                                                                                    SHA-512:9E33DC9C1C6D60F3226263C484AF46A14AAB31F838516A0D69BA08F8F416EF10D09697E8D7ABAC1CE1F5BCE8AB0C2635D99FBE70C89ECC268DED0DCE89E67466
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tomsk) {.. {-9223372036854775808 20391 0 LMT}.. {-1578807591 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7647084
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.897140749162557
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8pYFfXHAIgNzGRRL/2WFKPQOrFJ4WFKov:SlSWB9vsM3yWFPHAIg0RN/2wKPQOrFJD
                                                                                                                                                                                    MD5:F6AE33D706C36FDD8A21F44AD59F5607
                                                                                                                                                                                    SHA1:94D6EC7A437249AEBE2FA4AF8AFB029A620368C0
                                                                                                                                                                                    SHA-256:732751845ACEDBFFD3C6170F4B94CB20B25BFDCFCC5EEA19F4BE439F5C5B573A
                                                                                                                                                                                    SHA-512:2314AB2B154887842211C9A570BC1323D9B4375FF60C96296835DB001E8A277CA62D40B8562BC34EDDF281D96D5325640B79F7907558C6E0319C7D2A76BE239C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Makassar)]} {.. LoadTimeZoneFile Asia/Makassar..}..set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1590
                                                                                                                                                                                    Entropy (8bit):3.7728141273024374
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5IerIvusF7cCGK6zoCjZte3kzMjsBw0oZzlL98oysHqGzJvqE+ksabzdX+YjL:5VujmUCei46oljFC67
                                                                                                                                                                                    MD5:A4647294401D2B54ABAA8E509BF05A6F
                                                                                                                                                                                    SHA1:BF804CC38996D7715E3BA9BAD715D7ADBED781B9
                                                                                                                                                                                    SHA-256:A56A26981163A717CF388A423CFE7A2BAD1BE8652BE2E338670CBC0C0A70E5E9
                                                                                                                                                                                    SHA-512:B43157FABDE016FA6636CAB7B06CC1DEA53526B42FB46BB41DC4B7E48188D191C325BEF0D170B125E885F321C4316746A8D478D798828E2DC4A51C71DA4A610C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ulaanbaatar) {.. {-9223372036854775808 25652 0 LMT}.. {-2032931252 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 32400 1 +08}.. {433782000 28800 0 +08}.. {449596800 32400 1 +08}.. {465318000 28800 0 +08}.. {481046400 32400 1 +08}.. {496767600 28800 0 +08}.. {512496000 32400 1 +08}.. {528217200 28800 0 +08}.. {543945600 32400 1 +08}.. {559666800 28800 0 +08}.. {575395200 32400 1 +08}.. {591116400 28800 0 +08}.. {606844800 32400 1 +08}.. {622566000 28800 0 +08}.. {638294400 32400 1 +08}.. {654620400 28800 0 +08}.. {670348800 32400 1 +08}.. {686070000 28800 0 +08}.. {701798400 32400 1 +08}.. {717519600 28800 0 +08}.. {733248000 32400 1 +08}.. {748969200 28800 0 +08}.. {764697600 32400 1 +08}.. {780418800 28800 0 +08}.. {796147200 32400 1 +08}.. {811868400 28800 0 +08}.. {828201600 32400 1 +08}.. {843922800 28800 0 +08}.. {859
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):192
                                                                                                                                                                                    Entropy (8bit):4.728285544456033
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8TcXkXHAIgNrfcXORL/2WFKhrMEBQWFKucXB:SlSWB9vsM3yXHAIgTN/2wKhrMEewKX
                                                                                                                                                                                    MD5:D2EAEA6182FB332CAA707B523F6C8A9D
                                                                                                                                                                                    SHA1:3BFC654E2B3BCF902AF41AEEC46772C84FFF3890
                                                                                                                                                                                    SHA-256:D17FDAF17B3DAC3A1310E2332F61585598185E64CED799ABD68249EB5B698591
                                                                                                                                                                                    SHA-512:E16BEE28BFE3AFFFE6F0025C09D0D65001F38D5045AAB1B554E4D3A66A88273F985B7BAA11F8D26E76E5ABC9F559E3E4B794CC939AAD5FF012A5A47924D08CB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ulaanbaatar)]} {.. LoadTimeZoneFile Asia/Ulaanbaatar..}..set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):149
                                                                                                                                                                                    Entropy (8bit):5.006390440264841
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2WFKjhfMXGm2OHEVPoHsWA0GVFSTVVn:SlSWB9eg/2wKjJDm2OHEVPoH3A0CUX
                                                                                                                                                                                    MD5:D6245CAAEC9BA2579F4CEFFF196A9369
                                                                                                                                                                                    SHA1:4D182953F2CEEFF3583265F977B14F40C1A2FB43
                                                                                                                                                                                    SHA-256:C445B8030DEDDDED0AFF5CC692CC323B63BE8C14BBD42DC3FDE90AD4F9D14785
                                                                                                                                                                                    SHA-512:A32C477B6FAA79247907D1C4E2DF400B05AF4B529277C4CE12B33097872311E3F579115DC8CBA93DAC936928FD574414F3473A9CB7C8E85AB57CCA57489B60F8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Urumqi) {.. {-9223372036854775808 21020 0 LMT}.. {-1325483420 21600 0 +06}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2058
                                                                                                                                                                                    Entropy (8bit):3.773734429231407
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5petrlfgLv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxKG:5Ysv+0j6lua2Gg/3gO8UoOZU2Wc/pKF
                                                                                                                                                                                    MD5:5ADD78E4AFCBA913D078A8790861A2DE
                                                                                                                                                                                    SHA1:BB63A762D5D76C0FD3CB9AB2BCDE95718E1C99EB
                                                                                                                                                                                    SHA-256:9D639C0FC69B3BEEBC96969092F9590EB48E7946E901B225BF245E165973B9A8
                                                                                                                                                                                    SHA-512:7C2418FD1F96F101B83E2ABDF2551405C6E429DBBF30A2FA7CD2477E2CE1CEEBB790C51B28AEFF043BA7A7A914CEF3C812668058D69225B9FE9475C56508453D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ust-Nera) {.. {-9223372036854775808 34374 0 LMT}.. {-1579426374 28800 0 +08}.. {354898800 43200 0 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {764694000 43200 1 +12}.. {780418
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179
                                                                                                                                                                                    Entropy (8bit):4.858039387006872
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKgTjEHp4WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKgsX
                                                                                                                                                                                    MD5:D23A09C84A5368FBB47174BC0A460D14
                                                                                                                                                                                    SHA1:045A72FEA79C75E5F0029BD110E33A022C57DFAB
                                                                                                                                                                                    SHA-256:18F5E4FE8247F676278AC5F1912AC401DC48DF5B756D22E76FF1CFA702F88DA7
                                                                                                                                                                                    SHA-512:404EABC2FC162E18C678CED063249C7FF4C28653880EA1903CE846FD191CD1C5B61E0610736F250B79BBAC768B1AFD6B9A8824D56D74591A95D7301B47D48387
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Vientiane) $TZData(:Asia/Bangkok)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2062
                                                                                                                                                                                    Entropy (8bit):3.7094518963173035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:56beOUYQ7FyDy3le3i96VwAmnuBNuTw6vl9O8nfipRkwhUZDAcD:56cYQBIy343dVNUIukElcXRDhUBAcD
                                                                                                                                                                                    MD5:5C0C094B088D0212182E7B944197D4FE
                                                                                                                                                                                    SHA1:CF43A511FE9CD295207DF350704462E09D4D5278
                                                                                                                                                                                    SHA-256:2558C96E25359C72F168DAC6FB3C16C54F8FD7D0724EEB1671156D4A1F42AC6C
                                                                                                                                                                                    SHA-512:5D659EBDC8C2B06C964B083ECC78B4370A4658590D83F020CD23910C44E2D8DAFE69F61E8EB569E1905E89F38CD03ABE6B92F6CE36CF0B1EE0732A7645AFA65D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Vladivostok) {.. {-9223372036854775808 31651 0 LMT}.. {-1487321251 32400 0 +09}.. {-1247562000 36000 0 +11}.. {354895200 39600 1 +11}.. {370702800 36000 0 +10}.. {386431200 39600 1 +11}.. {402238800 36000 0 +10}.. {417967200 39600 1 +11}.. {433774800 36000 0 +10}.. {449589600 39600 1 +11}.. {465321600 36000 0 +10}.. {481046400 39600 1 +11}.. {496771200 36000 0 +10}.. {512496000 39600 1 +11}.. {528220800 36000 0 +10}.. {543945600 39600 1 +11}.. {559670400 36000 0 +10}.. {575395200 39600 1 +11}.. {591120000 36000 0 +10}.. {606844800 39600 1 +11}.. {622569600 36000 0 +10}.. {638294400 39600 1 +11}.. {654624000 36000 0 +10}.. {670348800 32400 0 +10}.. {670352400 36000 1 +10}.. {686077200 32400 0 +09}.. {695754000 36000 0 +11}.. {701798400 39600 1 +11}.. {717523200 36000 0 +10}.. {733248000 39600 1 +11}.. {748972800 36000 0 +10}.. {7
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2058
                                                                                                                                                                                    Entropy (8bit):3.7081033128260934
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5h+r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2j:K5PhtjLiII2ZFlgm
                                                                                                                                                                                    MD5:E43E5F0EA7C4575525BAB130984DCDCC
                                                                                                                                                                                    SHA1:2D715749469FEA51A8E25D1F4F8DC4FF9178817D
                                                                                                                                                                                    SHA-256:3BEF13638C46F16435D326C675907E61BB68C8173153CED3359E983BE0E413E5
                                                                                                                                                                                    SHA-512:27954FEC865031BC363CFDE94E97B3B19836A6F777646EA4AAB12ECCAEE6D60A0C690711EA192B917AC717F94A01D1EF64BAE97DF968069CC12415971B070498
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yakutsk) {.. {-9223372036854775808 31138 0 LMT}.. {-1579423138 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {76470
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):244
                                                                                                                                                                                    Entropy (8bit):4.692243303623333
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2wKs5XDm2OHGVQoHvZN6FCDx+UIFDVkvScHbY/s5UIAy:MB862KTmdHGuCvZNNkkHH3Sy
                                                                                                                                                                                    MD5:D45766D30074719C9A88ACE8BB53204B
                                                                                                                                                                                    SHA1:69B333DFCCCCEB66DD0F7DC28B272BB10769B6B0
                                                                                                                                                                                    SHA-256:2526557810747E78E713AE09BC305621A80FAEECF8D441632E7825738D4C79CB
                                                                                                                                                                                    SHA-512:5255DEED72D7D13862A4D6BED7E0458C099D2EF5A1B41536CAA7C0E65A61DE8B8D1AD62AD44559F970B6613ADFB3862778D1CC99B9A05CB5BBCA7F0202B5A5B2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yangon) {.. {-9223372036854775808 23087 0 LMT}.. {-2840163887 23087 0 RMT}.. {-1577946287 23400 0 +0630}.. {-873268200 32400 0 +09}.. {-778410000 23400 0 +0630}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2095
                                                                                                                                                                                    Entropy (8bit):3.704641905144701
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5ievNhYvm1qv7vXIovPvSvlDvtvuovKKvKcNvHvAvivBvqvvEyv8vlvEv+v4v+v+:/Nupj40H6l75FKCKcZP8qdyEaoBAWkW+
                                                                                                                                                                                    MD5:D4DABA407BB8A10E4961D1DE5D9781D1
                                                                                                                                                                                    SHA1:6933DE65336331BD90E2BEC6AEA0609B16DAEDC9
                                                                                                                                                                                    SHA-256:2C78699EFC60758B8F8D0D1DEEDFDED5E65C65EBF3082B23E60BDEA8BF8FBCFE
                                                                                                                                                                                    SHA-512:459E2187FAA66414F5CE934C335F563DFD2FA5316B86A54D1A29123A0460AFD65B7CE46629BD6A070A14CB6873A28A2F2803DE5FF4F29EA610712EB07FAD303F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yekaterinburg) {.. {-9223372036854775808 14553 0 LMT}.. {-1688270553 13505 0 PMT}.. {-1592610305 14400 0 +04}.. {-1247544000 18000 0 +06}.. {354913200 21600 1 +06}.. {370720800 18000 0 +05}.. {386449200 21600 1 +06}.. {402256800 18000 0 +05}.. {417985200 21600 1 +06}.. {433792800 18000 0 +05}.. {449607600 21600 1 +06}.. {465339600 18000 0 +05}.. {481064400 21600 1 +06}.. {496789200 18000 0 +05}.. {512514000 21600 1 +06}.. {528238800 18000 0 +05}.. {543963600 21600 1 +06}.. {559688400 18000 0 +05}.. {575413200 21600 1 +06}.. {591138000 18000 0 +05}.. {606862800 21600 1 +06}.. {622587600 18000 0 +05}.. {638312400 21600 1 +06}.. {654642000 18000 0 +05}.. {670366800 14400 0 +05}.. {670370400 18000 1 +05}.. {686095200 14400 0 +04}.. {695772000 18000 0 +06}.. {701816400 21600 1 +06}.. {717541200 18000 0 +05}.. {733266000 21600 1 +06}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2029
                                                                                                                                                                                    Entropy (8bit):3.6487650030366106
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5O4GeuadYlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUUUl2ue/:5xKdsUf8mFpNWFnyLCPYmPJSi3sh4
                                                                                                                                                                                    MD5:2CFA7C55D0731D24679CA5D5DC716381
                                                                                                                                                                                    SHA1:2BB66783D75C71E76409365757980FBC15F53231
                                                                                                                                                                                    SHA-256:20871FA6AA959DDFB73D846271B4A568627B564CFC08A11BDD84B98C2F2019A3
                                                                                                                                                                                    SHA-512:CAB10A48859B2C0B2CC7C56E0AA530AE7E506A4986BADC5ED974D124BD46DB328B50C423F83FCFD52D31962A249EEFC10351798B86D51EDA500F412C8D42E6BC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yerevan) {.. {-9223372036854775808 10680 0 LMT}.. {-1441162680 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 10800 0 +03}.. {733273200 14400 1 +03}.. {748998000 10800 0 +03}.. {764722800 14400 1 +03}.. {780447
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9879
                                                                                                                                                                                    Entropy (8bit):3.557602151081988
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:K35nZPOUYySoluItljncxelTMwtrayE6x5sETNek/CyNzybxYKmX6SXL/XbEcygI:K940pb6cL/b3Ldr9Q7TMq+ML
                                                                                                                                                                                    MD5:E7F2A3EE0362E9ED3ECBAD24168AD098
                                                                                                                                                                                    SHA1:98832274F6D9B641B809123D1272A1C04EEAA177
                                                                                                                                                                                    SHA-256:6B3609BE4E93D21A2AB492594EDD387931E2C787E8471C9F2D3A677F34002D8F
                                                                                                                                                                                    SHA-512:C48A76F8251AE455C759CB98802E40B3BEF716FD8E7441B6DE0242942C913367E3572B7C871082E97CA9BE67EC7DC37F8D01C438965217AC0EC36AD508DCE0D4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Azores) {.. {-9223372036854775808 -6160 0 LMT}.. {-2713904240 -6872 0 HMT}.. {-1830376800 -7200 0 -02}.. {-1689548400 -3600 1 -01}.. {-1677794400 -7200 0 -02}.. {-1667430000 -3600 1 -01}.. {-1647730800 -7200 0 -02}.. {-1635807600 -3600 1 -01}.. {-1616194800 -7200 0 -02}.. {-1604358000 -3600 1 -01}.. {-1584658800 -7200 0 -02}.. {-1572735600 -3600 1 -01}.. {-1553036400 -7200 0 -02}.. {-1541199600 -3600 1 -01}.. {-1521500400 -7200 0 -02}.. {-1442444400 -3600 1 -01}.. {-1426806000 -7200 0 -02}.. {-1379286000 -3600 1 -01}.. {-1364770800 -7200 0 -02}.. {-1348441200 -3600 1 -01}.. {-1333321200 -7200 0 -02}.. {-1316386800 -3600 1 -01}.. {-1301266800 -7200 0 -02}.. {-1284332400 -3600 1 -01}.. {-1269817200 -7200 0 -02}.. {-1221433200 -3600 1 -01}.. {-1206918000 -7200 0 -02}.. {-1191193200 -3600 1 -01}.. {-1175468400 -7200 0 -02}.. {-1127689
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8784
                                                                                                                                                                                    Entropy (8bit):3.833553120942514
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:ZRBHksL3zq6bCvyjvspNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/+:ft0CC
                                                                                                                                                                                    MD5:B04E22B9B42722013941169B5D04DEA2
                                                                                                                                                                                    SHA1:32B96A7D9504D5022A6C4E2D310E95B5F062947F
                                                                                                                                                                                    SHA-256:099C3BEFBA3B4C00AE19BC53D475A52B32FAC9B36EC823C8EAEFC7D00F78F388
                                                                                                                                                                                    SHA-512:8B93BCA1E923B7A43F2EB0889216E8FF991D13CB8D25BD300310ED7CD8537DBD858E8F422C9B52AE2F52F7C1CB450EF0B7C5C1B3AE547C9C1E18E2A851569DD5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Bermuda) {.. {-9223372036854775808 -15558 0 LMT}.. {-2524506042 -15558 0 BMT}.. {-1664307642 -11958 1 BMT}.. {-1648932042 -15558 0 BMT}.. {-1632080442 -11958 1 BMT}.. {-1618692042 -15558 0 BST}.. {-1262281242 -14400 0 AT}.. {-882727200 -10800 1 ADT}.. {-858538800 -14400 0 AST}.. {-845229600 -10800 1 ADT}.. {-825879600 -14400 0 AST}.. {-814384800 -10800 1 ADT}.. {-793825200 -14400 0 AST}.. {-782935200 -10800 1 ADT}.. {-762375600 -14400 0 AST}.. {-713988000 -10800 1 ADT}.. {-703710000 -14400 0 AST}.. {-681933600 -10800 1 ADT}.. {-672865200 -14400 0 AST}.. {-650484000 -10800 1 ADT}.. {-641415600 -14400 0 AST}.. {-618429600 -10800 1 ADT}.. {-609966000 -14400 0 AST}.. {-586980000 -10800 1 ADT}.. {-578516400 -14400 0 AST}.. {-555530400 -10800 1 ADT}.. {-546462000 -14400 0 AST}.. {-429127200 -10800 1 ADT}.. {-415825200 -14400 0 AST}.. {1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6856
                                                                                                                                                                                    Entropy (8bit):3.8064107143060752
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:KXVuHfXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:KXVQbkIaFF1w0us4qE3+sSGjT
                                                                                                                                                                                    MD5:8ABD279386C50705C074EEE18BF5AE59
                                                                                                                                                                                    SHA1:C392231DBE744F5942DA4BFAC8AD0ABEBAEA0BF3
                                                                                                                                                                                    SHA-256:2026944DCDEBC52F64405E35119F4CF97EA9AA1E769498730880B03F29A2B885
                                                                                                                                                                                    SHA-512:3095759D01AC7EEA25E427CA38E8A0395BEFA7250E7A0C1327BF9D61F07F4570CDF7313FBE6695973EB0DD66D201C6C63591CC0DA8A1E0029926DC7056F4C95B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Canary) {.. {-9223372036854775808 -3696 0 LMT}.. {-1509663504 -3600 0 -01}.. {-733874400 0 0 WET}.. {323827200 3600 1 WEST}.. {338950800 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):246
                                                                                                                                                                                    Entropy (8bit):4.637993677747699
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/2RQ7RfDm2OHDoH1JlvQV/FFrR3FcykVvQV/FFf+nmwV:MB86267RLmdHDC1w/FH3FcyL/FomwV
                                                                                                                                                                                    MD5:1581C6470850E0C9DB204975488B1AF8
                                                                                                                                                                                    SHA1:6933ED13F18AD785CEDF0837F86EFAC671297A85
                                                                                                                                                                                    SHA-256:2EA59ACDB5BBDD3C6ABCEEA456838A5CA57371A3D2BB93604B37F998ED8B9D4D
                                                                                                                                                                                    SHA-512:9FFFA013D82CEFF6F447521C19270ECDD71152F23670164423E6013FEC46253C62D2CB79B42630BD786BD113F27369E746CA981DD17E789F7571F473B47247C1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Cape_Verde) {.. {-9223372036854775808 -5644 0 LMT}.. {-1830376800 -7200 0 -02}.. {-862610400 -3600 1 -01}.. {-764118000 -7200 0 -02}.. {186120000 -3600 0 -01}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.709193799640151
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqLG4E23vXHAIgvMG4EeRRL/2RQqG4EZrB/4RQqG4E1n:SlSWB9vsM3yCPHAIgvoRN/2RQ1rB/4Ri
                                                                                                                                                                                    MD5:601EB889A87F9CAD6F1DF4D1AB009FAE
                                                                                                                                                                                    SHA1:EB43C253A48755442A67A2408D7E3295549F831C
                                                                                                                                                                                    SHA-256:64FB8CAD17CD36666C7027AAD01344FEF659B13699EEF1942365842F8ED2170E
                                                                                                                                                                                    SHA-512:9CFC4A446ED6A3BEF6C26AE57324F10A970EE2ADD6933130447FAD6A3DB538841F2490DD461AF5776FACD9BD2CDC4A83247DFA6B34802AE844DDC6D4C37B28EA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Atlantic/Faroe)]} {.. LoadTimeZoneFile Atlantic/Faroe..}..set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6796
                                                                                                                                                                                    Entropy (8bit):3.804838552487436
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:96ufXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:/bkIaFF1w0us4qE3+sSGjT
                                                                                                                                                                                    MD5:F97CC7EB9C52D00177BFF4715832FCD5
                                                                                                                                                                                    SHA1:CD9DCBB5E6ADD6EA91C8F142957EC229FC7F6DA3
                                                                                                                                                                                    SHA-256:795F438E7F01342D5F25ECCDD09FCE65C03C5D2D561B9B5191301D57EC16B850
                                                                                                                                                                                    SHA-512:9586289FEB6C597160011A47432F0AC40000483FA2E579BD89046EFD33E98DDAD652B792FD80CEDEB4CD87B6439A7B473F25F1B7375BC75353CBAF9F77E1084E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Faroe) {.. {-9223372036854775808 -1624 0 LMT}.. {-1955748776 0 0 WET}.. {347155200 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600 3600 1 WEST}.. {811904400 0 0 WET}.. {828234000 3600
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.975859213900122
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVyWJooeyXHAIgoqxWJz5RL/2RQqG0EHEcAg/h8Qas:SlSWB9vsM3ymSDSHAIgoXN/2RQaK8Avn
                                                                                                                                                                                    MD5:6EB1E51CDB90E841DC151004E98E80CF
                                                                                                                                                                                    SHA1:CDB1FFF4FDBC7837E10E3725F09626345A82716E
                                                                                                                                                                                    SHA-256:9152D10450CEBCE4AAEA3F3C8A50E4077A881E0B06B193A5886F06A453803112
                                                                                                                                                                                    SHA-512:252648AA76AC0F08ED9BA3CB82E930101B1D2CE37EA979670671909CA8E2C7D838C35A449B0C7C2EF7BBF08C746475EC83403651CFB203E2F56C395CE2640933
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Oslo)]} {.. LoadTimeZoneFile Europe/Oslo..}..set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Oslo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9709
                                                                                                                                                                                    Entropy (8bit):3.80455694200614
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:hZUiLbMsf/ss0qKd+aKyUXtOZHY1SCOcesoQivoKbFVCdm1rXWNXyCXTOuUbkIaq:hZZDQX1rWJysukysLE3+sSGjT
                                                                                                                                                                                    MD5:AC6647F9B53B5958214EC3F3B78A4D85
                                                                                                                                                                                    SHA1:7355622AF99296F069F73899D5C70941C207F676
                                                                                                                                                                                    SHA-256:B2A0D0DDC26806A05B2BE806CA3F938DB12A3FA40110B8B21FD3F04EFED3A531
                                                                                                                                                                                    SHA-512:07569CA4D5DC6D57D91D6FDC370671A7546B73BA653D094E1B501D33570F7700727AD7FF2A083BC79E9EDE807C47E7A5604BEF5803F290B2F277C51DEF10FA6B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Madeira) {.. {-9223372036854775808 -4056 0 LMT}.. {-2713906344 -4056 0 FMT}.. {-1830380400 -3600 0 -01}.. {-1689552000 0 1 +00}.. {-1677798000 -3600 0 -01}.. {-1667433600 0 1 +00}.. {-1647734400 -3600 0 -01}.. {-1635811200 0 1 +00}.. {-1616198400 -3600 0 -01}.. {-1604361600 0 1 +00}.. {-1584662400 -3600 0 -01}.. {-1572739200 0 1 +00}.. {-1553040000 -3600 0 -01}.. {-1541203200 0 1 +00}.. {-1521504000 -3600 0 -01}.. {-1442448000 0 1 +00}.. {-1426809600 -3600 0 -01}.. {-1379289600 0 1 +00}.. {-1364774400 -3600 0 -01}.. {-1348444800 0 1 +00}.. {-1333324800 -3600 0 -01}.. {-1316390400 0 1 +00}.. {-1301270400 -3600 0 -01}.. {-1284336000 0 1 +00}.. {-1269820800 -3600 0 -01}.. {-1221436800 0 1 +00}.. {-1206921600 -3600 0 -01}.. {-1191196800 0 1 +00}.. {-1175472000 -3600 0 -01}.. {-1127692800 0 1 +00}.. {-1111968000 -3600 0 -01}.. {-
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2035
                                                                                                                                                                                    Entropy (8bit):3.716074665066009
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5Fhytu1phYdTclBoLB+Q1utqZu97fKnt91ItLjxkRq2fE4/JQjJuj4csf5J1R8yO:jhytu1phYdTclBoLB+Q1utqZuZfKt91x
                                                                                                                                                                                    MD5:FE3467015B8B226CB9D8077CB1ABF81B
                                                                                                                                                                                    SHA1:665083E753C6860755D669F30DF55333F2740127
                                                                                                                                                                                    SHA-256:E77B9D50AF6C2550CA0517B4A6DE64A8A159AD0C77F1294C4212B6E20221B099
                                                                                                                                                                                    SHA-512:661CA9C1DEDB9CE459215C48AE1409787B39EA025DA897FE8DA5532966FEC28BF86DF4B2794F7DDACFC01064CB9A11737592018C9B5C05045934D237FB1C428B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Reykjavik) {.. {-9223372036854775808 -5280 0 LMT}.. {-1956609120 -3600 0 -01}.. {-1668211200 0 1 -01}.. {-1647212400 -3600 0 -01}.. {-1636675200 0 1 -01}.. {-1613430000 -3600 0 -01}.. {-1605139200 0 1 -01}.. {-1581894000 -3600 0 -01}.. {-1539561600 0 1 -01}.. {-1531350000 -3600 0 -01}.. {-968025600 0 1 -01}.. {-952293600 -3600 0 -01}.. {-942008400 0 1 -01}.. {-920239200 -3600 0 -01}.. {-909957600 0 1 -01}.. {-888789600 -3600 0 -01}.. {-877903200 0 1 -01}.. {-857944800 -3600 0 -01}.. {-846453600 0 1 -01}.. {-826495200 -3600 0 -01}.. {-815004000 0 1 -01}.. {-795045600 -3600 0 -01}.. {-783554400 0 1 -01}.. {-762991200 -3600 0 -01}.. {-752104800 0 1 -01}.. {-731541600 -3600 0 -01}.. {-717631200 0 1 -01}.. {-700092000 -3600 0 -01}.. {-686181600 0 1 -01}.. {-668642400 -3600 0 -01}.. {-654732000 0 1 -01}.. {-636588000 -3600 0 -01}.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):160
                                                                                                                                                                                    Entropy (8bit):5.011466665416709
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/2RQqGtlN62/EiMXGm2OHXT14YoHvhFvdQVIyV:SlSWB9eg/2RQrlo2MiDm2OHXqYoHvTFS
                                                                                                                                                                                    MD5:3B310BB8C90CA716DC1AC5A697ACA9CD
                                                                                                                                                                                    SHA1:CD583F49478DCDAD91EF78539502C6FC62945C1E
                                                                                                                                                                                    SHA-256:51BFABCB3388107753A3C1A8CF31118E6627132BAA09B9878D9E7CEDBEBB4886
                                                                                                                                                                                    SHA-512:F593B7A1FAF0EA6B42D5EE86C20C9A8F5CD7ACD9B30EF7755E45ECAFEA8752C32E4CF4BEDF531F494E59D9F0C49CCC6FCA077292E20794AA265DFC0A56DFE579
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/South_Georgia) {.. {-9223372036854775808 -8768 0 LMT}.. {-2524512832 -7200 0 -02}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.880390141563645
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2RQqGt4r+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2RQr4rV
                                                                                                                                                                                    MD5:2C73A963F515376A46762CE153AAF5C5
                                                                                                                                                                                    SHA1:996C3C93DFAD89EA80AC5DFA1DFBD7CECD9ED28D
                                                                                                                                                                                    SHA-256:1C9CA8966FC8BD0BE70F4A187E17E56FB99139BC88C392E82BA2E23E23111C54
                                                                                                                                                                                    SHA-512:35A9ADC047DB058D71C21FC4ECB57CD14B0D9BA4416506763D1800D72CE6C9E81636F332AAD3533616F05C86F90A60416BD4065C5F832A51AA3DC186218BDCAE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Atlantic/St_Helena) $TZData(:Africa/Abidjan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2256
                                                                                                                                                                                    Entropy (8bit):3.662522763865322
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:506KSBSdSs2SbSwGSyPU3lSsS5SGScSo/SkSuShSceS3SBSc7XSiSgSwSd/SJkS6:JKU+Ew0FU1TuhrR//tOIoOjXZfDWSkPR
                                                                                                                                                                                    MD5:77C7ECE4FCBE150069B611C75E8DAA0E
                                                                                                                                                                                    SHA1:22F4E5F15BCA92D8456B70BB36230F2605CA5E1C
                                                                                                                                                                                    SHA-256:F0E99EF01F140CD5AAFE16803A657922207E6F7F6AF10B0AE795790916C302C4
                                                                                                                                                                                    SHA-512:6FB57E8499A587292AFAFA9BD003721572393D5268CAF956230DA76983A112B27D6731BE561A22CCEF84935F43AC988B667C2DC404C157EA8D0E7830FC1A2AB8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Stanley) {.. {-9223372036854775808 -13884 0 LMT}.. {-2524507716 -13884 0 SMT}.. {-1824235716 -14400 0 -04}.. {-1018209600 -10800 1 -04}.. {-1003093200 -14400 0 -04}.. {-986760000 -10800 1 -04}.. {-971643600 -14400 0 -04}.. {-954705600 -10800 1 -04}.. {-939589200 -14400 0 -04}.. {-923256000 -10800 1 -04}.. {-908139600 -14400 0 -04}.. {-891806400 -10800 1 -04}.. {-876690000 -14400 0 -04}.. {-860356800 -10800 1 -04}.. {420606000 -7200 0 -03}.. {433303200 -7200 1 -03}.. {452052000 -10800 0 -03}.. {464151600 -7200 1 -03}.. {483501600 -10800 0 -03}.. {495597600 -14400 0 -04}.. {495604800 -10800 1 -04}.. {514350000 -14400 0 -04}.. {527054400 -10800 1 -04}.. {545799600 -14400 0 -04}.. {558504000 -10800 1 -04}.. {577249200 -14400 0 -04}.. {589953600 -10800 1 -04}.. {608698800 -14400 0 -04}.. {621403200 -10800 1 -04}.. {640753200 -14400 0 -
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.862270414049974
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjpMFBx/h4QWCCj1:SlSWB9vsM3yI9kHAIgmON/2DCeMFB/4d
                                                                                                                                                                                    MD5:2EF41863430897F45E0CBB51E6A44069
                                                                                                                                                                                    SHA1:8E9561060E9509FAF235E5E033FC9C2918E438DB
                                                                                                                                                                                    SHA-256:DF7CBDDCBB2F5926A07D19A35739E5B8DCD9733C037F7D1FF95753C28D574674
                                                                                                                                                                                    SHA-512:9D3A37D64DCCCA28093C30FAB595690D021FACEC15F351A77CA33A779D645D305A2FA031869F0DE3B0404C498C2C321D3D02E4DC592D3C632F6700F5DCB54900
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/ACT) $TZData(:Australia/Sydney)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8372
                                                                                                                                                                                    Entropy (8bit):3.894755849491153
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:j8SY62BXovlCyRL8pJXa4NyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:j8X3Xzgl3PaN8asiQ/Uv9UnvtCaRs
                                                                                                                                                                                    MD5:94E1A0C4326D09AF103107E64625CC6C
                                                                                                                                                                                    SHA1:C026565F020EB158309549D98313632BAA79205F
                                                                                                                                                                                    SHA-256:5C43D3152982BCFD5B9F51D0E909CF3A558BED1C270FEFFE030531D38D6F91B7
                                                                                                                                                                                    SHA-512:CA08A8BC0EB740D59650FE0A9E56D9E169348AD0994F2BFFD6CCFBF9CC42E82F892FB719E80C4E2084B5702E9725C651359EE3066BD71BB19397EA83B6A68430
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Adelaide) {.. {-9223372036854775808 33260 0 LMT}.. {-2364110060 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1 ACDT}.. {320776200 34200 0 ACST}
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):674
                                                                                                                                                                                    Entropy (8bit):4.32071371733564
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862ELmdHLOYCvSi0xT0ryRIvUr0obZv:5ELe6dvSi6L
                                                                                                                                                                                    MD5:900B39F1D4AB93A445F37B6C0A8DE3D9
                                                                                                                                                                                    SHA1:DE82800779DCB8094C395B5024BD01FFA3C3BB8C
                                                                                                                                                                                    SHA-256:0D3C39EDAB34A8DB31A658A1549772F7D69EB57565E40AA87B707953A2D854A4
                                                                                                                                                                                    SHA-512:8D115D1D14FE6FF21A4AE77E3AAC075E6A877214E568956B9A4FD2E75A46E458CAA5AE26B483F128B4C62960D73BD7543BC32F22B760059423B3D9ABCBA24B6A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Brisbane) {.. {-9223372036854775808 36728 0 LMT}.. {-2366791928 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8437
                                                                                                                                                                                    Entropy (8bit):3.902306256303896
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:QZSSY62BXovldRL8q75aANyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:QZSX3X2QfPaN8asiQ/Uv9UnvtCaRs
                                                                                                                                                                                    MD5:1553DAAB804A6C9BB15D711554980D3B
                                                                                                                                                                                    SHA1:5E3161B1FBB4C246DCB5E11ABD94095121CE38ED
                                                                                                                                                                                    SHA-256:734F295BD0B558BDF6178DE62151B8913699D08AB2B1D101C55B8DEBC410074C
                                                                                                                                                                                    SHA-512:06B21886070E39E390ECBD18841B7FDBFCA2C7C8573495D2BAA2B92EB113CD1C73C18D73C49DE3C49572CBCBCBED2FAD3248BC651BEB825A1E089B1DEDEFCBFA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Broken_Hill) {.. {-9223372036854775808 33948 0 LMT}.. {-2364110748 36000 0 AEST}.. {-2314951200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):195
                                                                                                                                                                                    Entropy (8bit):4.851279484907769
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjnSV1+QWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DCcq+DCyB
                                                                                                                                                                                    MD5:8944D3DF8FBECC03A8FB18C3B2DA3B53
                                                                                                                                                                                    SHA1:6B17B38D6560592CA49840C47DB9BDA7E79F9F76
                                                                                                                                                                                    SHA-256:5FE3CED97293FE0573D5ECE0CEF59CE5DDB4C57BC568AE7199E77B01D3ADE17C
                                                                                                                                                                                    SHA-512:907D8BB7EA840E0B3AC683884F2F709A2C06D67CE9258BE46400A0DA63581A9B1403A44FA43E1059BE8F5C7E06F9FA05C176309AD6295317BF14F0E9FA5741E4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/Canberra) $TZData(:Australia/Sydney)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):193
                                                                                                                                                                                    Entropy (8bit):4.79231670095588
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DCkx+4DCVDy:MByMjUQVv8At2s4Ky
                                                                                                                                                                                    MD5:0C1DFC0877CE8EB08007B7C2B7AF2D87
                                                                                                                                                                                    SHA1:02F835BE2DA4FCA79DC2A6959BB4EB6ACC8DF708
                                                                                                                                                                                    SHA-256:1DD4EC4ED4F854E2EF6162B2F28C89208710F8EC5AABB95FFA9425D3FBBCAB13
                                                                                                                                                                                    SHA-512:358347045915B7D10940DB15E49528D0C636BEC1BE70129847D0B9D034F9E96E847394D88358E87D98A9E581605A3C2AB917B85FDE1296F290B4194BB7E3FA46
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Currie) $TZData(:Australia/Hobart)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):437
                                                                                                                                                                                    Entropy (8bit):4.508468081487136
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862pmdHPCvZUjMWpXgda/gd026Xgdvgd+v:5peKvZqMSX+4+56X+v+Q
                                                                                                                                                                                    MD5:A81864B2C0BD7BF81F4FA21F17800059
                                                                                                                                                                                    SHA1:518AC9E040A17083ED3962F4FBB47D1D83764FF7
                                                                                                                                                                                    SHA-256:AC004FD4B3C536406991EC13EBB3E64E0EC0C7B264BC18C0700C8FA545868155
                                                                                                                                                                                    SHA-512:3C24F4C2CC3072B3E820FCC1C68A747DCCBB9481FE743C1555783CC932DCBA44FE4851A732D24EABF62E845474D4E1278F120A04DB7549A18C7C49C31FB8D425
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Darwin) {.. {-9223372036854775808 31400 0 LMT}.. {-2364108200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):759
                                                                                                                                                                                    Entropy (8bit):4.110997549215461
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862EmdHvOYCvV2mV22wF2nUV2CF2+V2pCwF21UF2biV2cHVKF25V2VF2cV2tFq:5Eemdvg2wQCKZ4j5c0LVmtH1iknohwQT
                                                                                                                                                                                    MD5:1BC8DBD2E24606EFA49F933034FC0EEF
                                                                                                                                                                                    SHA1:A511695A1B87A689C6BFF65257C11D3962FDDA3D
                                                                                                                                                                                    SHA-256:79D0C770A304360DB33F3D1EF7B3935F1E4E8125893E0DCE683AC35A51302CFB
                                                                                                                                                                                    SHA-512:A839D390D70F22FC833322029B732F3AE68FF48793B07005041BD12322DD6E5D5E5FF31787AA004A507A57F8FC245133891F266C4EF19D49F085E6B412E5B04C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Eucla) {.. {-9223372036854775808 30928 0 LMT}.. {-2337928528 31500 0 +0945}.. {-1672555500 35100 1 +0945}.. {-1665384300 31500 0 +0945}.. {-883637100 35100 1 +0945}.. {-876120300 31500 0 +0945}.. {-860395500 35100 1 +0945}.. {-844670700 31500 0 +0945}.. {-836473500 35100 0 +0945}.. {152039700 35100 1 +0945}.. {162926100 31500 0 +0945}.. {436295700 35100 1 +0945}.. {447182100 31500 0 +0945}.. {690311700 35100 1 +0945}.. {699383700 31500 0 +0945}.. {1165079700 35100 1 +0945}.. {1174756500 31500 0 +0945}.. {1193505300 35100 1 +0945}.. {1206810900 31500 0 +0945}.. {1224954900 35100 1 +0945}.. {1238260500 31500 0 +0945}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8734
                                                                                                                                                                                    Entropy (8bit):3.8515786470328823
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:aOqigkx6WsYyS39nQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:aOq05hnQiAmcOM6e0pj
                                                                                                                                                                                    MD5:5E04BF8E1DEBFCC4130FDD1BBD67B2DF
                                                                                                                                                                                    SHA1:796AADCE7BB2FAF5E6FC916C941A4E3DCAFACC9E
                                                                                                                                                                                    SHA-256:D813F6A97BEFC22CA4F24C59EB755D269B9C68A449CC7CF0D2C61F911860EBE7
                                                                                                                                                                                    SHA-512:3A69CF1D1F57D6BD39E5F4DAF76BBB06A749D42BEB29452A0A5BDAA68F5DACC0DF176EDDA7A083F5B5B84FC651926C09D46CAAD2F6C4F1595AB9CCA1A958D653
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Hobart) {.. {-9223372036854775808 35356 0 LMT}.. {-2345795356 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-1646640000 39600 1 AEDT}.. {-1635753600 36000 0 AEST}.. {-1615190400 39600 1 AEDT}.. {-1604304000 36000 0 AEST}.. {-1583920800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AES
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):199
                                                                                                                                                                                    Entropy (8bit):4.912882643701746
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yIoGEoPHAIgjGg6N/2DCkx/2DCPGUv:MByMjeXV6t2a8v
                                                                                                                                                                                    MD5:425DC7B1E31F4AA41DAD74E3C9AE3562
                                                                                                                                                                                    SHA1:D92A3269F7BF5EC00F082C64CEF6E20C43017180
                                                                                                                                                                                    SHA-256:4D84E4040FBC529C9E0366BB74D0CFADEEEEDA0DFCC6C2C9204DED6C6455CAC3
                                                                                                                                                                                    SHA-512:F3031F16C0D00D9F8A38CD378F599EB3E63F4FF85F120DB38E3013E93F08E6F512D969F164BBC88CD625910FB3E086F3352E5B8FFC1373C3CC98F363FB3FD3F7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Lord_Howe)]} {.. LoadTimeZoneFile Australia/Lord_Howe..}..set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):824
                                                                                                                                                                                    Entropy (8bit):4.249672335529665
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862gtmdHVCvCi0xT0ryRIvUr0obbty/ywtUj3yv:5gteMvCi6Xlt8
                                                                                                                                                                                    MD5:504A422280E0459A2126E7CB02F527E6
                                                                                                                                                                                    SHA1:EF61B98EFB1E44EE59020E99A69EA67D6B8ACFC2
                                                                                                                                                                                    SHA-256:01B278309353849CC2FDF62A30E2FF483833D5713CF5E329252738BE6F2C0A84
                                                                                                                                                                                    SHA-512:BFDAAD56D817CD3AAB17DFD0A33EFDD422645BC542ABE269C0F8520E33796DF4F19EAB2E40BFC6C4AF93EF654239B8F2E285639B4662040D865B9C340A23CFAD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lindeman) {.. {-9223372036854775808 35756 0 LMT}.. {-2366790956 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}.. {709912800 36000 0 AEST}.. {719942400 39600 1 AEDT}.. {731433600 36000 0 AEST}.. {751996800 39600 1 AEDT}.. {762883200 36000 0 AEST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7764
                                                                                                                                                                                    Entropy (8bit):3.5615258807990537
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:pmz39IyKxb/JbcD9gKniAF23QbNS1fEGXALNbbT2JFJ/FaKaTQ9ZJhRVK:p+cpVKniAF2AbkFKL
                                                                                                                                                                                    MD5:10F983F4683CDE13A1228AC0B04D8513
                                                                                                                                                                                    SHA1:45378BA5949BE53D698108F50FECFF50C9E3D296
                                                                                                                                                                                    SHA-256:76D1F1ED67B8F8D6903789C2FDDF79590A83677972D416F5F3C9687614EC6238
                                                                                                                                                                                    SHA-512:D60D802EF215A33750E4F859657BA12A67084B1E9FCF1B4A7CEEE7B9D816BC2C6670775D93C88EC8380CDD7790AD574133D6F90F0828F848313C26583B2F196A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lord_Howe) {.. {-9223372036854775808 38180 0 LMT}.. {-2364114980 36000 0 AEST}.. {352216800 37800 0 +1030}.. {372785400 41400 1 +1030}.. {384273000 37800 0 +1030}.. {404839800 41400 1 +1030}.. {415722600 37800 0 +1030}.. {436289400 41400 1 +1030}.. {447172200 37800 0 +1030}.. {467739000 41400 1 +1030}.. {478621800 37800 0 +1030}.. {488984400 37800 0 +1030}.. {499188600 39600 1 +1030}.. {511282800 37800 0 +1030}.. {530033400 39600 1 +1030}.. {542732400 37800 0 +1030}.. {562087800 39600 1 +1030}.. {574786800 37800 0 +1030}.. {594142200 39600 1 +1030}.. {606236400 37800 0 +1030}.. {625591800 39600 1 +1030}.. {636476400 37800 0 +1030}.. {657041400 39600 1 +1030}.. {667926000 37800 0 +1030}.. {688491000 39600 1 +1030}.. {699375600 37800 0 +1030}.. {719940600 39600 1 +1030}.. {731430000 37800 0 +1030}.. {751995000 39600 1 +1030}.. {762
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8341
                                                                                                                                                                                    Entropy (8bit):3.8532171550973526
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Yyigkp2EUyn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:Yy3VnQiAmcOM6e0pj
                                                                                                                                                                                    MD5:40D06B80A4A0DB415270EFD9698B97BF
                                                                                                                                                                                    SHA1:1999F0E8C7EBAA11BD21D64D9E07FA911F13C64C
                                                                                                                                                                                    SHA-256:F21B9EA51C0D41BAD0420FE0601E5A4B491FB895856F4BDDF6541D704469D92F
                                                                                                                                                                                    SHA-512:E47D597CC85D177CF2804C44C216EB4C5B74472457F15F697704311A847BF8A051DCAFD26FA61DD689555F35640151E26F25D5DC5319EFEFEA62AD86657A4A95
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Melbourne) {.. {-9223372036854775808 34792 0 LMT}.. {-2364111592 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.893713405897538
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjREeQWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DC5eDCyB
                                                                                                                                                                                    MD5:80B7CDD1EA5A5308CE84C038180005F2
                                                                                                                                                                                    SHA1:B7CA15B58ADA8CA3EB74B7971073022D57D8EE70
                                                                                                                                                                                    SHA-256:73D7C9E207E61ACF8DF7242BDCD84488189033E22A84873A953B65DE02FA1B0B
                                                                                                                                                                                    SHA-512:F627F5FF335600AC9158D6A0D3694AB7E70180177449C17B5605BBF7B1B7F8FB447A9C207F4E1BCB627074DB47B8A66F5D78E03C6DB8FA17F8BDD6AABB331665
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/NSW) $TZData(:Australia/Sydney)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):192
                                                                                                                                                                                    Entropy (8bit):4.830368875485429
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjbvvXHAIgoXjbBvRL/2QWCCjsrQWCCjbi:SlSWB9vsM3yIFHAIg2N/2DCZrDCl
                                                                                                                                                                                    MD5:14CB7EA1C028F457345EBEB8ADDC9237
                                                                                                                                                                                    SHA1:208BF676F56533BA271D1B98363A766DF17CF6F2
                                                                                                                                                                                    SHA-256:A983C9CAD7E542CAED43B083E68CD2B782959A4B54015F374C29250D3ACF9B8D
                                                                                                                                                                                    SHA-512:099F65E5FA705FD7257CF7B8E103905EE313C6D082844F69CCD3F318E3E7F4098B29F952FA0AA28655E1FE290A0FB2E809911088315889DE7CAAF0E04698C2FC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Darwin)]} {.. LoadTimeZoneFile Australia/Darwin..}..set TZData(:Australia/North) $TZData(:Australia/Darwin)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):739
                                                                                                                                                                                    Entropy (8bit):4.31793586514766
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB8623mdHCBdCvmlXz6zezzOz4iaLYvzkzi4zm5fVcBhg8mfev:53eCB0v4+e3Oz4iaLYbkzi4zxhfqw
                                                                                                                                                                                    MD5:01B1A88867472AD60B8F5C0E1648E3ED
                                                                                                                                                                                    SHA1:9975EA750458E8061DD8A83585675CB7E4910CA6
                                                                                                                                                                                    SHA-256:FC1B54CA261074E47A8A486FEAC12DD04D46166D1D2B44163BD8791BEC32D275
                                                                                                                                                                                    SHA-512:20BDFBCD1A5038C81552EBD955F3921DE3447A1F30E64935937768B2B98735AE53049601DCDD2D519646C78E6D03289EB465CFF4F2DADEA7D89A329504C6C475
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Perth) {.. {-9223372036854775808 27804 0 LMT}.. {-2337925404 28800 0 AWST}.. {-1672552800 32400 1 AWDT}.. {-1665381600 28800 0 AWST}.. {-883634400 32400 1 AWDT}.. {-876117600 28800 0 AWST}.. {-860392800 32400 1 AWDT}.. {-844668000 28800 0 AWST}.. {-836470800 32400 0 AWST}.. {152042400 32400 1 AWDT}.. {162928800 28800 0 AWST}.. {436298400 32400 1 AWDT}.. {447184800 28800 0 AWST}.. {690314400 32400 1 AWDT}.. {699386400 28800 0 AWST}.. {1165082400 32400 1 AWDT}.. {1174759200 28800 0 AWST}.. {1193508000 32400 1 AWDT}.. {1206813600 28800 0 AWST}.. {1224957600 32400 1 AWDT}.. {1238263200 28800 0 AWST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):203
                                                                                                                                                                                    Entropy (8bit):4.803539644461131
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yIaWhSHAIgPWAvN/2DCoRWJvFBx+DC7WN:MByMjL9t2rOvFel
                                                                                                                                                                                    MD5:401B6B2E30EF17BE20212645287EB94B
                                                                                                                                                                                    SHA1:67D15A45C61122CE680B829FE0FA3A1C501A8C8F
                                                                                                                                                                                    SHA-256:DDA669B9BFB3E08FC23CE67030148B9E4740824ADD8DE02580D6AFD31CE05BAB
                                                                                                                                                                                    SHA-512:F4348F8F4FF261C47854725AEE4E14E7E334B3C31496E5C46B0E0041551CB6861380E684E8888AFE9DA7E8E97236AC322B9CE2738EF245E9D46C9681665F83A1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Brisbane)]} {.. LoadTimeZoneFile Australia/Brisbane..}..set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):198
                                                                                                                                                                                    Entropy (8bit):4.752918480727309
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yIDRpGSHAIgSRrN/2DCa7QDCuRpyn:MByMjdpQYrt23QHpy
                                                                                                                                                                                    MD5:D226A0718185854DFE549E00856AA8D5
                                                                                                                                                                                    SHA1:94EE96FAE259D90C2FDF169DD95BD82B3171FFAE
                                                                                                                                                                                    SHA-256:D9DCFDC377901EC0C0FEB9CEA743C2C1425273F69A1BAA7BF3B74FEC5885B267
                                                                                                                                                                                    SHA-512:7EE29A7235CAAEF4889246B7A2241CA9A0D5D2B2E1D56B20141247C93B8736F17280F0D46004AC4588E137D1E76F661C779C906BBFC2B5F8FA73C19F7657F952
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Adelaide)]} {.. LoadTimeZoneFile Australia/Adelaide..}..set TZData(:Australia/South) $TZData(:Australia/Adelaide)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8338
                                                                                                                                                                                    Entropy (8bit):3.847525715050911
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:AZJigk42/yn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:AZJuVnQiAmcOM6e0pj
                                                                                                                                                                                    MD5:C0F1776E011C4C86B7709A592E7CA1EB
                                                                                                                                                                                    SHA1:1CA528D529BF4995E145D6E0D87A8752A3577E7F
                                                                                                                                                                                    SHA-256:FC453486325ADE1D31F14087B76D4936F3A6D551ABD1DB6FCAC129BDB043951C
                                                                                                                                                                                    SHA-512:F872182962C2615A35F012ECAB30C88F07C6BEF0261207AD52706DB22D8CDD0DA65723CD801FDA7C548C5EB0ECFC39DD66CC17503BAA3BBB77BFA35D20650E4F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Sydney) {.. {-9223372036854775808 36292 0 LMT}.. {-2364113092 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):195
                                                                                                                                                                                    Entropy (8bit):4.777331394201868
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DC3neDCVDy:MByMjUQVv8At2+eKy
                                                                                                                                                                                    MD5:9C58D9EFBB03472BBDA76CE2FFAD4BB4
                                                                                                                                                                                    SHA1:30959E3681B64AE26F7FA3957887896C26AF7F19
                                                                                                                                                                                    SHA-256:C94FA7A7640CD00963EE8FF1A3D9DCDA2075408739D998EDBF7CFC998DB764FD
                                                                                                                                                                                    SHA-512:2D6B778217726691F2CB4A4995A8B1AB08DDB7FE4570A3FD04EF54F718F455EF3CBD4EEF1A1BCC99A2088C82A6E89DB455BAF1327CECD6BF608837E50F14A6C1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):4.818875198673406
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yIvFfkSHAIgoFNNvN/2DCzyQDCMF4:MByMj9fKaNNvt2xQz4
                                                                                                                                                                                    MD5:0B144A2E47C81354BC510BC741DE5150
                                                                                                                                                                                    SHA1:A7396F1741F02C6C208FD1286362E4E0720198B8
                                                                                                                                                                                    SHA-256:DBEF9C5BDD290FEC5FA740D697143332D3CA1FC373CF1DF736F1883AC9BA3298
                                                                                                                                                                                    SHA-512:562B029591F9ADB8C324BA56E849B2B524E91B26D3DB441510194882A8E1E63E6948D041874A00A0A76F29925A1CEAC53DD2AE5D7F23123B6FE919346CBFD8CC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Melbourne)]} {.. LoadTimeZoneFile Australia/Melbourne..}..set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.831654343064909
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq/xJjXFeyXHAIgoXjrWARL/2QWCCjH0QWCCjQ:SlSWB9vsM3yInHAIgOWAN/2DC00DCt
                                                                                                                                                                                    MD5:5F5916CB038876BE27AA5E2AD74EE085
                                                                                                                                                                                    SHA1:18AC21B638188B542455BA3DA91F958DF1724E68
                                                                                                                                                                                    SHA-256:75ABB7F20C4A0B618138AA190AF33CEAF2A6D2C707DA6C1314E4BFF2F9904F58
                                                                                                                                                                                    SHA-512:ADFD83E292AC1BB5E19255A9B2DA0E3BB9323A5F9B92D458DE34C291D7F9B6CFBBF62AA3351FB320E54F34305DD485ADC72134D21AFA6A27B2B8B7D93DCA2113
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Perth)]} {.. LoadTimeZoneFile Australia/Perth..}..set TZData(:Australia/West) $TZData(:Australia/Perth)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):212
                                                                                                                                                                                    Entropy (8bit):4.918079927018121
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yIcKlHAIgJK3N/2DCkuM0DC9KM:MByMjcKeJK3t2kVSKM
                                                                                                                                                                                    MD5:BEDEA56FCE4B2F0A3F3E9319856A5560
                                                                                                                                                                                    SHA1:9FD0FE998A003C6B4CCCD00A977153347DE07F55
                                                                                                                                                                                    SHA-256:55A9264D0414644A1BE342106AE86086A6659596DC9322A74FC4D1DDB41F7C60
                                                                                                                                                                                    SHA-512:7C438B72262B99EDEEB31AC95E0135BB722A3B0B049278B6DE67DB5FB501837FB9C03785233B538E83F4B56104F6EA3B3DA0F7C2275E0F78F232161840AA4C63
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Broken_Hill)]} {.. LoadTimeZoneFile Australia/Broken_Hill..}..set TZData(:Australia/Yancowinna) $TZData(:Australia/Broken_Hill)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):194
                                                                                                                                                                                    Entropy (8bit):4.888429541699473
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7thteSHAIgpth9RN/xWh490th4:MByMYdIp7tQ490I
                                                                                                                                                                                    MD5:A8A7A10DA4321819ED71F891480770F8
                                                                                                                                                                                    SHA1:930674EF7711542D7F471A59C1870D4576E027FD
                                                                                                                                                                                    SHA-256:2F594239A434052D36053A2B3EAB134EADBAD06EB6737E67CF72166DAB157537
                                                                                                                                                                                    SHA-512:C6AD1869A713DDE0E4DE53F7894E5CE0B7AEFDDD7C5C3D83BB5B92FB7D8E20B373A6694045053E1AE8EA98A7B7D0C052EF2C21310E47DC650A7A399A5F73D586
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.875339623736144
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wKy4oeyXHAIg20wKARL/1bIAJl0IAcGEwKyovn:SlSWB9vsM3y7/rDSHAIgp/AN/xIAE90j
                                                                                                                                                                                    MD5:E0D0EFBEC37E27532B49FF6DD9893DA0
                                                                                                                                                                                    SHA1:9C00993A885AF448E48201A46E17629A7A602FC6
                                                                                                                                                                                    SHA-256:A676562A90FF8587A775F6F0E3BE05D870456A56D25B5330816BF9043C8D475B
                                                                                                                                                                                    SHA-512:AB0E6907F9C0002CA5C050A0069AF013B14BADA08CA4553C96B302C078DF7629D5D7EDE4A19A53DEC6E7B9E6D9857F14EC7A1DB9BC11F2EEC9FFBAC70E129EEE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Noronha)]} {.. LoadTimeZoneFile America/Noronha..}..set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):191
                                                                                                                                                                                    Entropy (8bit):4.948480276987682
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0tQJXveyXHAIg20tQJE6RL/1bJHIAcGEtQJXy:SlSWB9vsM3y7tIGSHAIgpt36N/xR90tF
                                                                                                                                                                                    MD5:FCCB5F44903E1B988A058E5BBF5E163B
                                                                                                                                                                                    SHA1:E1CC03DD4A804C7305D8B0C12D8451D08AE262EA
                                                                                                                                                                                    SHA-256:961FB3AB99A63B1E9704B737EAB2D588B5A39D253A213E175CC678BEDFFD498D
                                                                                                                                                                                    SHA-512:F31C80E4AD6EBE6CB8A3382E0052DC47601D073E8F81375D50241105675AA3AB45433FFD0534524D9992ABE1086C6671D85FF7C72B0D6766EB9984426F608B77
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Sao_Paulo)]} {.. LoadTimeZoneFile America/Sao_Paulo..}..set TZData(:Brazil/East) $TZData(:America/Sao_Paulo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.902113962502196
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0znQZF3vXHAIg20znQv5RL/1bbAWVIAcGEznQe:SlSWB9vsM3y7zn+PHAIgpznSN/xn90zN
                                                                                                                                                                                    MD5:9F4B43F4F27D0B7EAC0C5401A1A794B4
                                                                                                                                                                                    SHA1:2A8543B994E93E54BD50EAA78463905E6A8EBE74
                                                                                                                                                                                    SHA-256:0500C9A248C8CE9030EA30D0AF9DD95DC465480BAF60646C0B7C511FA23C6D1F
                                                                                                                                                                                    SHA-512:0ADAF708ACFBD80F4704951EEBC24AD144FD5856997A429279E804F3A7F7F9A8FED41DCEE85BFB1ECDBF1E05137E87E7430186474BCF5DE42067FFC74746F048
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Manaus)]} {.. LoadTimeZoneFile America/Manaus..}..set TZData(:Brazil/West) $TZData(:America/Manaus)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7736
                                                                                                                                                                                    Entropy (8bit):3.7984816540097843
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:09+xKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt7:9Ss41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:6DB983AD72FB2A88FC557BE5E873336F
                                                                                                                                                                                    SHA1:C64E988010087ED559A990B3D95078949C9B4D72
                                                                                                                                                                                    SHA-256:E2AEA7CFD428A43D9DB938BCC476623ADC1250BD8057013A7FFF5F89D7FF8EFC
                                                                                                                                                                                    SHA-512:C0A646F80FB2FD42D9146A4FD36CF5A7F62016684F8D5AF80453EC190F4AEA65EDADC5BCF071AE746ABFB43B29C27B2743F2152B6986D41BFDE1617CA774A7C5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:CET) {.. {-9223372036854775808 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766623600 3600 0 CET}.. {228877200 7200 1 CEST}.. {243997200 3600 0 CET}.. {260326800 7200 1 CEST}.. {276051600 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8505
                                                                                                                                                                                    Entropy (8bit):3.8095769056779916
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:e3HgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:eQaUqtfA604qSBgI7DBch
                                                                                                                                                                                    MD5:A6F88C55E8613A27DE3E6C25B0672910
                                                                                                                                                                                    SHA1:3B593CC17BF153A6209FC5AACE7B88DA9603BD44
                                                                                                                                                                                    SHA-256:73A9841F233AA657AFB6CED8A86A37D55FE5582DD996B9B28975D218BCCC078F
                                                                                                                                                                                    SHA-512:526A922B1594A2800B03F363F7BFEC29203D4A4F2B49C5F2618469F59176CE4F8AFBA0616B226AC39D308DB05DE7147714D9B6CDBB2EA7373A041A4D47F50E2E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:CST6CDT) {.. {-9223372036854775808 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-84384000 -18000 1 CDT}.. {-68662800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.804821796604604
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/0nalGe2IAcGE2NEOyn:SlSWB9vsM3y7UEOXHAIgpUEqA6N/0af9
                                                                                                                                                                                    MD5:33A04963E70EBF29339204348E0DF874
                                                                                                                                                                                    SHA1:456C0DB88ECE4D180EEE5AE5AEF5FBEB6E977D00
                                                                                                                                                                                    SHA-256:6DC6354D761CBE7820C9186568CAB87AD48CA925507F6A740357195B60E16D87
                                                                                                                                                                                    SHA-512:DF8F46827760BD7EC922C6837E0B6649B4FBD220B79E6F1B67FE3DD8CB3D2D035ECDAF4CF6CE5BDE6DC79C6F7B6EE2B9787AF08A97845CD0D647720A2E78D7EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:Canada/Atlantic) $TZData(:America/Halifax)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):191
                                                                                                                                                                                    Entropy (8bit):4.863241040396457
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0po/vXHAIg20puFvHRL/0nPQox/h4IAcGEpoyn:SlSWB9vsM3y7pYHAIgppuRN/0d490pl
                                                                                                                                                                                    MD5:97E50CE9FBA3F1A6DFCF333F9E6D592C
                                                                                                                                                                                    SHA1:EE472C411079E788DBF32FAC9C5B7EE121960DC2
                                                                                                                                                                                    SHA-256:DB32E83949D62478D229E9FB57BB1624D21B3A9CCEE4CD55335F8262C01D820A
                                                                                                                                                                                    SHA-512:D547E3DC03848A677BE67F7CF4124E067F76EE09BB724A5B10F028BEA72C1526B17678A035B2C53F69498E9ECAACD3C5445D42B7FE58DF706DD2C5F2ADA05A73
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Winnipeg)]} {.. LoadTimeZoneFile America/Winnipeg..}..set TZData(:Canada/Central) $TZData(:America/Winnipeg)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):195
                                                                                                                                                                                    Entropy (8bit):4.90775999333305
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7hzi2HAIgphznN/0L5d490hzyv:MByMYhiXphntyQ90hyv
                                                                                                                                                                                    MD5:E4114CC94C5C1DDF98535BF2B25BF109
                                                                                                                                                                                    SHA1:212BE0FEF7039C0CDB8AF509927F4C03D8F72D22
                                                                                                                                                                                    SHA-256:27CCEB515F9B2AB2D441F7C1533064AD13C89A6A009C3F2F14842B217075E231
                                                                                                                                                                                    SHA-512:06C946DC79190F1C0FAF7F1F41BBEE4EE2A40910913896DE5AA94BC848DAB60F4F40A999CA4218FE1AA499854CCDD9379C937A9DEF273B2C7A352D8CAB8A5FE2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/East-Saskatchewan) $TZData(:America/Regina)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.758562813220951
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/0nbHboxp4IAcGEqM:SlSWB9vsM3y7RQtHAIgpRQPN/0Dboxpp
                                                                                                                                                                                    MD5:4365BEFA3D50EEE20843EF97A095E512
                                                                                                                                                                                    SHA1:7756049B4CD6459742686925E9516E64A9727306
                                                                                                                                                                                    SHA-256:22844994AE893F3236A091B050E932E84A5218EC0D01F72595E17CCC471FA564
                                                                                                                                                                                    SHA-512:CB265E79DF926026BEBF7158590369ABE5353C759540F509ABBA2A7ADBE59A705BC2AB936F400614BE610EDB761DE9A2B1E179A0A8B0A87E595392362C2516AA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:Canada/Eastern) $TZData(:America/Toronto)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):192
                                                                                                                                                                                    Entropy (8bit):4.8181126338833655
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx07nKL50vXHAIg207nKLyRRL/0nNYLo/4IAcGE7nK1:SlSWB9vsM3y77G2HAIgp7bN/0W8/4908
                                                                                                                                                                                    MD5:FA0D0024AD72CCE4EC7229FA897FB1B7
                                                                                                                                                                                    SHA1:4373A07F2674FE974189CC801987652AA97F0204
                                                                                                                                                                                    SHA-256:D7A203E60FF19DCDEAAD14121720DE51DA73392D25B40FFA301C1935CDF89517
                                                                                                                                                                                    SHA-512:82EF7F429604A69734B04D298B4C9C9AC3BE57B9DD8C4CECF59C7AB3470BDFBA0505886C4E6AA3864F5EC7FBB4C69C54CF153A6417376828234833013C29A0C1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Edmonton)]} {.. LoadTimeZoneFile America/Edmonton..}..set TZData(:Canada/Mountain) $TZData(:America/Edmonton)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):196
                                                                                                                                                                                    Entropy (8bit):4.998628928230972
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7tgYJHAIgptVN/0xdBx+90twv:MByMYnKpTt590g
                                                                                                                                                                                    MD5:A2DCCB8BFC65DD4E7C3BB7F10DCEFF11
                                                                                                                                                                                    SHA1:6FD2F4FAE06C5D4D3F189A167A98AA76497569DD
                                                                                                                                                                                    SHA-256:87F42F45FD7D059CA47650D445420DE8320F3A7C1CBC7671FBFA8A8881274433
                                                                                                                                                                                    SHA-512:F42E32C5BD785BA914E5054784BF67DDF951460A708290D1899621CEEDC63475B584FC052A86A3B6D45BF3C651D42427FB6F9CE2A2A33764DFFF731053BECC16
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/St_Johns)]} {.. LoadTimeZoneFile America/St_Johns..}..set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):194
                                                                                                                                                                                    Entropy (8bit):4.887587766811186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7ZLgXPHAIgpZLgFN/0N290ZLgK:MByMY13p1stx901/
                                                                                                                                                                                    MD5:68900CE38FE0E40578323BBD3D75184E
                                                                                                                                                                                    SHA1:9D5EAB5CBCD495DD46974207FBE354A81DD2070F
                                                                                                                                                                                    SHA-256:5C4FD46054B190A6D4B92585B4DAE4E3A8233EE2996D14472835DDD264911DC6
                                                                                                                                                                                    SHA-512:3EF53F0FCD8D88A1B977886BDFAA03D7B84EF021AC6BEDF7C571BFBF2242BFC3F3EB6A6B6A9C2F6852AF412A96DFBC30F3BB25A6619CBCD8736F3DF5B64DE1BF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Vancouver)]} {.. LoadTimeZoneFile America/Vancouver..}..set TZData(:Canada/Pacific) $TZData(:America/Vancouver)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.887593462838566
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/0nogS64IAcGEsAzEB:SlSWB9vsM3y7hzi2HAIgphznN/0Hd499
                                                                                                                                                                                    MD5:A4237BDCAF68B0EFECA97178F3DEE724
                                                                                                                                                                                    SHA1:A9CBC02B5545A63A0C9B38C8FA7FA2DE6D483188
                                                                                                                                                                                    SHA-256:46BA00AE3A07A4DC83D6CB517D87C9CBBA491B3421FE9AD6C74CAC5695EB73F7
                                                                                                                                                                                    SHA-512:832BF256BE8CB2DD205DDE50017448D5830B46FF4DCA77BDB852067EE0C9DF9977014F2A3E3DD6944336158D8EA377CFBBE519EE5B56FB26EB64325B45476B9D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/Saskatchewan) $TZData(:America/Regina)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):195
                                                                                                                                                                                    Entropy (8bit):4.889486451014262
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7peR2fkSHAIgppeR2rN/0CF/490peR24:MByMYkGk7pkOtBQ90kB
                                                                                                                                                                                    MD5:490D99BD5465CBF5A8FE28F33180B8A6
                                                                                                                                                                                    SHA1:4783295C31A804BE98145270ED28956A0783E655
                                                                                                                                                                                    SHA-256:A1B1AF37DC89C6BA663E4E967A18409AE4E0FA9EF1B908D0461368DA31001C09
                                                                                                                                                                                    SHA-512:9F6B4F204A21B69E1DFCB766C0671D3736414C73269DCEDCDB4FC3DBA869BBA1511DF6B5061F8964F0AF9C3816133D04E5DFB8A6AD07CA06E7712787A8FECC5A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Whitehorse)]} {.. LoadTimeZoneFile America/Whitehorse..}..set TZData(:Canada/Yukon) $TZData(:America/Whitehorse)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):194
                                                                                                                                                                                    Entropy (8bit):4.812019117774239
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7tfEJkHAIgptfEJo5N/0rHM490tfEJB:MByMYE9pEOt4X90EB
                                                                                                                                                                                    MD5:6EF54792279C249B16877100682F1806
                                                                                                                                                                                    SHA1:A62629EA055207D917740E3AEF4F0B005EA49CC4
                                                                                                                                                                                    SHA-256:5B40167DD0C0B5C293861070C4AC249F78DDF8BAD798DD0165E3AE894C9B9570
                                                                                                                                                                                    SHA-512:3CF93003C3EA2B4386660F0C87074F9AE2BAC4EE72D88451DCB1EA8B79502D2187B1608B6D5CE8D7EDC00AED99CF9DB7B006EB6ED2A2B5009F2C0E757D282D74
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Santiago)]} {.. LoadTimeZoneFile America/Santiago..}..set TZData(:Chile/Continental) $TZData(:America/Santiago)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.808907056781067
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG7ZAJWXHAIgObT7ZAiFvRL/0bxOdBx/nUDH7ZAZv:SlSWB9vsM3ycJAUHAIgObJAiRN/04dBn
                                                                                                                                                                                    MD5:2EC4FDD1EFBAF1D9F9DBAC8B1B5EDD09
                                                                                                                                                                                    SHA1:FECED8EBC7B666628B7B45C9694FCB3A0B20A42A
                                                                                                                                                                                    SHA-256:1E2DA1862E0E0F131B7C6EB12FAC5F920852C61C162993A30BC843A464A5AAD4
                                                                                                                                                                                    SHA-512:74D61141505BAF1ABAD61FB91941C63C169EFE3C85829FEBB4D29A72EA54D1A07EC84E2E9B48E963E65CBF7663245459FAD288D620B1BEFFE682A2D1C243794D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Easter)]} {.. LoadTimeZoneFile Pacific/Easter..}..set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):175
                                                                                                                                                                                    Entropy (8bit):4.857134440822812
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx02TEMVFfXHAIg202TEyRRL/0lIAcGE2TEMy:SlSWB9vsM3y76EkHAIgp6EyRN/0l9068
                                                                                                                                                                                    MD5:3FB16EA4A9B0529220133C4A7B05215B
                                                                                                                                                                                    SHA1:BD56B6E76A92A5925140CB5CC3D940E1DE90993F
                                                                                                                                                                                    SHA-256:6F4F2D7F5BCA4E5183460C0153D2B98F5239A99F149DE6638B311C73CEDB1329
                                                                                                                                                                                    SHA-512:690EC1BCE7FA979BD55725B8ED6DF042BB331CAD332827B2C64B31F107539934AA5A30268B1F03D52697528E68A1BA72E4D56B5199A68B1ED897B75FAFB33A8A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Havana)]} {.. LoadTimeZoneFile America/Havana..}..set TZData(:Cuba) $TZData(:America/Havana)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7440
                                                                                                                                                                                    Entropy (8bit):3.695300167191082
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:CgDIMcVbf+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlt:KlfyDjivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:34339D40AC889DCB5A09D10F123175AD
                                                                                                                                                                                    SHA1:57E1F70FA8999106FA3874A9CE1E75A7ACBC81E9
                                                                                                                                                                                    SHA-256:64E284F9F7A36CC0A352809141D76E73A99344A9F30CFFEA254CBB9D2C589ADA
                                                                                                                                                                                    SHA-512:2DCF16D9D7593FC3E5844E18FD689AADA157866490CFD37A38A47F747DDA189822055F6DD470CA2D77040D2C5A2527512880C22ED8EC16D9424EDF3DC228AFED
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EET) {.. {-9223372036854775808 7200 0 EET}.. {228877200 10800 1 EEST}.. {243997200 7200 0 EET}.. {260326800 10800 1 EEST}.. {276051600 7200 0 EET}.. {291776400 10800 1 EEST}.. {307501200 7200 0 EET}.. {323830800 10800 1 EEST}.. {338950800 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 E
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):111
                                                                                                                                                                                    Entropy (8bit):4.924838898127838
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yLbNMXGm2OHLVva0v:SlSWB9eg/ylDm2OHLVi0v
                                                                                                                                                                                    MD5:B221E7141FFC9DEA317F64F81C7BB4E0
                                                                                                                                                                                    SHA1:B13BBDE790B169D8B9075275523F319D5173E2C7
                                                                                                                                                                                    SHA-256:6344BE02529C1CC5F7B5FE14B7E9BBCED4DDE68A24B824601EEBCAE207ABFDF2
                                                                                                                                                                                    SHA-512:FFFA733476D6C7DCF49C0B88C9F5E381DE2B69BAEDF6C7B1D91C6F45CE2D36E06D40F25B6BB65D4B5D650471BB52CD2EC3F68703DAB4BD5414F8D3F831D92BD2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EST) {.. {-9223372036854775808 -18000 0 EST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8505
                                                                                                                                                                                    Entropy (8bit):3.8091719283634853
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:R+kNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:RXoSItON0HY2iUmUFLqU
                                                                                                                                                                                    MD5:4578FE48781599B55F4BCF5560019789
                                                                                                                                                                                    SHA1:4EAA7134621DFDEBFD1405F5CC58227FA7E80C3A
                                                                                                                                                                                    SHA-256:0BE6161403BC5A96BFAB174F2C3FCBA8A677D4349699B408E9872B9DD0FE15CE
                                                                                                                                                                                    SHA-512:9ACC2EF396F635D22E3DF6B785831AD74B510049F1BE85F996467A5BBC0DF49A28B2FC3E4CA0CA9DC8FC2C29EA50D909F0B153265B107445D3052E81D9A4D50A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:EST5EDT) {.. {-9223372036854775808 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-84387600 -14400 1 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):170
                                                                                                                                                                                    Entropy (8bit):4.862365884559795
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsPHV5XHAIgNGE7TRRL/yCh0DcPHy:SlSWB9vsM3y7fHAIgNTRN/yg0DH
                                                                                                                                                                                    MD5:ACD69F34396296BA553243267D06CEE0
                                                                                                                                                                                    SHA1:9575FFE5E7833B9532F17AC5413EA9DB23F07ECA
                                                                                                                                                                                    SHA-256:936B6484469351DEF8FAFE8EC180862729F5E43BDE4E53E2E9636E221B54C3C2
                                                                                                                                                                                    SHA-512:149D23FF35747127E9A2F4056D09472E8E689970BC795D5411C5BF621D949ADDEBDA68674D375A248A63106ABDFF6C54A8AFE5385C45BE2916CAED0C30F7C4A1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Cairo)]} {.. LoadTimeZoneFile Africa/Cairo..}..set TZData(:Egypt) $TZData(:Africa/Cairo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):172
                                                                                                                                                                                    Entropy (8bit):4.901791318009318
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV5QH+o3vXHAIgoq6QHFRRL/yMQs/h8QanQHuv:SlSWB9vsM3ymnQeoPHAIgonQzN/yM/hm
                                                                                                                                                                                    MD5:E9C2C97EB65526F1D4BE1AD7385336FA
                                                                                                                                                                                    SHA1:09E4000CE320F779E2DFCA2FFD6B9258FFBA6CE4
                                                                                                                                                                                    SHA-256:B78A833337EFEC8B5F64622F1BFDA21FCB79CF290E9CF32A54B206EB20C6FDE9
                                                                                                                                                                                    SHA-512:EAEC097B58BF466CC7D6C0C6297628AF910CC308AC822565FD6CDABF96CD4EC57D4CC724FE782B6C1B606DFF9424013F6A890A871339577F7CB68BBB3C425E65
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Dublin)]} {.. LoadTimeZoneFile Europe/Dublin..}..set TZData(:Eire) $TZData(:Europe/Dublin)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):110
                                                                                                                                                                                    Entropy (8bit):4.928744204623185
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDMbNMXGm2OHvDwy:SlSWB9eg/yRQJDm2OHsy
                                                                                                                                                                                    MD5:9C08898081382F52CE681B592B8E2C8D
                                                                                                                                                                                    SHA1:165944424740B1FA9B4B3B8E622198ABD0BDA0F8
                                                                                                                                                                                    SHA-256:66B0DF8888883BFF44B18728B48CDF24AAED0BB745D601F3422C4F2D4063E0AC
                                                                                                                                                                                    SHA-512:86EA639F999169F2FBA2457BE5042463A1938031268CCA71FDD03CCBC6194932937BA58B49FBED461E055E9AA668FF6EBF391AA7EC603C0A425416DF2E6CC84D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT) {.. {-9223372036854775808 0 0 GMT}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):159
                                                                                                                                                                                    Entropy (8bit):4.910789466104329
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDOm7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRSw8RQy
                                                                                                                                                                                    MD5:333F2BFA92742A49BB88F11C7CD896A9
                                                                                                                                                                                    SHA1:BB5BEC010C36427AEEBDDA2FB72083E22A3F5073
                                                                                                                                                                                    SHA-256:64466EA3759301E88C29AD1A833CDCBBC495EB4A5A3AC45E7B2987FECD6702BD
                                                                                                                                                                                    SHA-512:E2270F4B57C5F1C849726259B886E8644DCF497FA0D034AD48885146BEDC70DC8899900DA9AC01F2609A2DA881E10F9042CCBF75A3F5DA7344D7E92F1B070806
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT+0) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.980500771169276
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOveyXMXGm2OH1VOwVn:SlSWB9eg/yRSvPDm2OH1VOwV
                                                                                                                                                                                    MD5:A7C3FD06D1E06F125813C9687C42067C
                                                                                                                                                                                    SHA1:515622C0B63E977AFBFC78AD8466053C4A4A71A6
                                                                                                                                                                                    SHA-256:3BE1EC71D2CC88FA9A3DB7DC0476475F33FE5BCBE6BC35C0F083859766466C32
                                                                                                                                                                                    SHA-512:548DA608CFCA5B8539652F94CA2040D624602D2DF64B2C8CCDB8B219B9B384E01386CDF95F3BF77409DF0584FA12A3B73D56D13107D98BEB4C2555F458B3F374
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+1) {.. {-9223372036854775808 -3600 0 -01}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):118
                                                                                                                                                                                    Entropy (8bit):4.965033464829338
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOPFNMXGm2OH1VYU7vV:SlSWB9eg/yRSPXDm2OH1VYW9
                                                                                                                                                                                    MD5:FF71149E56D4CB553D0ED949B5F4C122
                                                                                                                                                                                    SHA1:3459B47E0EEC80D7A29512CA4F3F236C89E86573
                                                                                                                                                                                    SHA-256:E61E826E6FBC2396EF152640698098F4477D4FFDFE5F791F62250C3EC5865304
                                                                                                                                                                                    SHA-512:43B0CC8BD7F1EFC80C3F14F115D651EADD5743B17B854C2FB7AC25995138D3DF8792915C2952B80F35784A7115F8FB335ACE171479B24C668190AC175523DB21
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+10) {.. {-9223372036854775808 -36000 0 -10}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):118
                                                                                                                                                                                    Entropy (8bit):5.002239901486653
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOeJMXGm2OHaBByVn:SlSWB9eg/yRSsDm2OHa7yV
                                                                                                                                                                                    MD5:08AABA917A8D6B3BB3D0DD1637F5ABFC
                                                                                                                                                                                    SHA1:D1D704F0250D4CBD450922A02D021E0000FBF5CF
                                                                                                                                                                                    SHA-256:143528946275DDC8B894218D3F1BE56C950F740828CEC13166C3D7E8E1B6BB7E
                                                                                                                                                                                    SHA-512:F37AE54864A613C830308CB94AB7CEA9534A86A53B52B4A2C28CEEFE6F5BC0518143AAFD77A6DA5EC55D392F5BD34FCD4B5BE51794B1A386ED783B9BA89C10C3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+11) {.. {-9223372036854775808 -39600 0 -11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):118
                                                                                                                                                                                    Entropy (8bit):4.97889339723103
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDONdNMXGm2OH3FNyUFFv:SlSWB9eg/yRSNDm2OH3XyMv
                                                                                                                                                                                    MD5:7374B66D6E883D7581E9561C3815EB92
                                                                                                                                                                                    SHA1:235E96A7420DF6733F3CA368D4A2D57766656043
                                                                                                                                                                                    SHA-256:A93EAFAC2C1089C608C8536127D0E8B53D8C7CFD13AE7DD69339E12A89F803C6
                                                                                                                                                                                    SHA-512:9BA59B17F20D65DFF1A5A2D557B535F69B04C172AECB15F88CA3484D74CC7D53894985C08653CF13D868BCBD5E7E5041E0CB2F457B5B603F3851198E552E33A7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+12) {.. {-9223372036854775808 -43200 0 -12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.922268982357521
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOcF3vFNMXGm2OHnFQVIyV:SlSWB9eg/yRS0fXDm2OHnFQVb
                                                                                                                                                                                    MD5:FDDC663E40F8FFFE27959E94625725DF
                                                                                                                                                                                    SHA1:EE3FBC1F6C8BBCF1BDC9E5DB4D2EA1A57E2E9BB3
                                                                                                                                                                                    SHA-256:AD5833153446960BDE0653A22AE2111BF80CFD61C3010993CE87B81D40C75C72
                                                                                                                                                                                    SHA-512:A1B2A153834FEAD7DC27C0918E1B1CB905671F82850C1CAAEBD89F5535703FB259F02F699EA7F82F3044E37668EE93DFA4D4EB862CD437AFF0DABA84867B1963
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+2) {.. {-9223372036854775808 -7200 0 -02}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.949132511023475
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOFfMXGm2OHBFVGAvFv:SlSWB9eg/yRSlDm2OHBFAKV
                                                                                                                                                                                    MD5:5C6F16F2CFD46030688066F9BFBE675D
                                                                                                                                                                                    SHA1:1DB5F36584822EB92E75B9AC9F440FD671BD90AE
                                                                                                                                                                                    SHA-256:C7BEE4C71905EDDB40BAF42C0CD0DC70BB9F298EAAB8B9367D484B8431DD084A
                                                                                                                                                                                    SHA-512:FFB2C4CD8EA7DE165C3D989454898FF2023D1A1E3B2B34EC23B1B71EFA7BF2538488DA0069E59F1152B8933D2263B762D2D7C56ADBED826C33FC0BA6672E34DB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+3) {.. {-9223372036854775808 -10800 0 -03}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.971627677226461
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOqJMXGm2OHBvGQy:SlSWB9eg/yRSQDm2OHBON
                                                                                                                                                                                    MD5:E35244C1A6084C7BC1D79E437677C55C
                                                                                                                                                                                    SHA1:898619DA4B8B9AC72E69C7BD30DEA2ADEF9440FE
                                                                                                                                                                                    SHA-256:26D1EF512CC5797FC63BA2B83C7D6271025F4D4F5C904D9FA8E97F053393D9A7
                                                                                                                                                                                    SHA-512:0687758558C4C5FF7802F3A57212694A1515761A8337D4B75FFE81434D2AD8A221B005DEC36BF013F2FC3DE1E46DFBED36352811EB7C5A5AE3A167A2E314F57C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+4) {.. {-9223372036854775808 -14400 0 -04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.956438091983076
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOJNMXGm2OHLVvyV6Aov:SlSWB9eg/yRSDDm2OHLVKVg
                                                                                                                                                                                    MD5:7C560A0F3C42E399AC1247CB6C516DC6
                                                                                                                                                                                    SHA1:C314B09D4E369C69C23A8DC1FB066FD0CFDC7211
                                                                                                                                                                                    SHA-256:054910BDDFC44D9B806BBD3008C30547FA57ECD3C043418C406A725158144688
                                                                                                                                                                                    SHA-512:FCE8431B759BD5359847734FD98D9D91394916235B2AF587FC927D5F3196FB283E241A6A9200EA852F9265ECEF81402FF6ACD0FA3A4AAEF6DF9DB1B056B3A9EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+5) {.. {-9223372036854775808 -18000 0 -05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.974743300958087
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOAkSMXGm2OHvTmULyn:SlSWB9eg/yRSbSDm2OHviX
                                                                                                                                                                                    MD5:EEB1A3E0FD3339E332587D19C116D4EF
                                                                                                                                                                                    SHA1:5DBF046031CD354B1EF88E46D3FED74706D21AC6
                                                                                                                                                                                    SHA-256:D53BB247E0E429A6243AB9A9BDCAE1EE1CF5F271D79748A843631906AB63A988
                                                                                                                                                                                    SHA-512:07BDF9056DC335C773684E634B1D389FBD139464D4597DE862B7EAC096676A093934682BF911F4E68F299789931218C0E431F0CC6BEBD7275B5FC8015EDD0942
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+6) {.. {-9223372036854775808 -21600 0 -06}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.930134062078826
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDONeyFNMXGm2OHrXVYVny:SlSWB9eg/yRSNPDm2OHriVy
                                                                                                                                                                                    MD5:F92B31548D6BF8CCFA326C0CA6E205A0
                                                                                                                                                                                    SHA1:3FFC6C214EDBCBE9C2509306CE73B429113E1C8A
                                                                                                                                                                                    SHA-256:6BA5779E35D581B409F53B14B6E28ECC16F536FFEDD45DDBC8DAE4B8C28F66E7
                                                                                                                                                                                    SHA-512:317872E986099D02AF083397AE936854043D54CEBF45A70672F02DDC9E2F3B27BC3FA80902F9675131C51A09BBD3C2BD1CD437330935CEA113C643769E0DF20C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+7) {.. {-9223372036854775808 -25200 0 -07}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.915798027862021
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDOOF3vXMXGm2OHmFvGpn:SlSWB9eg/yRSqfXDm2OHaOp
                                                                                                                                                                                    MD5:B31B15E6006F8DF0D7627D6C90FF39AF
                                                                                                                                                                                    SHA1:7C4137BE11DA84771DF6DC5EBC32D5E5E87E060F
                                                                                                                                                                                    SHA-256:CA87559B154B165E83482AEE3D753BA8E38ABCA347A005E8504C566433CF4CB3
                                                                                                                                                                                    SHA-512:220F7E7379EABBC8ACD7ADBB7A4AC8E93E4B268F8F1C0965B7E6A09735EE86E293EF1C492990331EEB4176B8301A91EC20579756B962AE45C858A96C09349CCD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+8) {.. {-9223372036854775808 -28800 0 -08}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.95764928386407
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDO3fMXGm2OHNms:SlSWB9eg/yRSPDm2OHNms
                                                                                                                                                                                    MD5:5B10173EB7119F1219250763504A3526
                                                                                                                                                                                    SHA1:A845021437C4638079040EF27AEF163C865FF8F8
                                                                                                                                                                                    SHA-256:A0987A1D078B0993FB3B07208E3F4538A2319DCDDDEB2FAEA32FC463DEAFB8DB
                                                                                                                                                                                    SHA-512:D213285D0A723B7771263122AFA269C2ABD0325A97D32C3870341255C06597DD6851C22860CFF42BF54E3FF5A36FC88C306F3BF1C69E7BD7FD7F69FE7601ED1A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+9) {.. {-9223372036854775808 -32400 0 -09}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):159
                                                                                                                                                                                    Entropy (8bit):4.898210849752128
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDIyHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRUyJ8RQy
                                                                                                                                                                                    MD5:5AFB7F12BA056619252D48904523DFA9
                                                                                                                                                                                    SHA1:CD6E6681C8302BF38095975DF556BD14959FDAC8
                                                                                                                                                                                    SHA-256:EFF27B3DEE9306641FF344801E06BB33FF768CDCCFE2409FA8AF752FF6D39F66
                                                                                                                                                                                    SHA-512:2869BB347F42667A3D174816466B15916FC61FCB5A6A1BE1DD750C5C1751602FEE0FE5A27651B7A19C9F6764872DD0F00D3D5AA16CA1A743DBA09646D25A4EB2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT-0) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):115
                                                                                                                                                                                    Entropy (8bit):4.979902281541545
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDI/fMXGm2OHMKUrn:SlSWB9eg/yRUXDm2OHtUr
                                                                                                                                                                                    MD5:4000096844091488200125FC8F50E2F5
                                                                                                                                                                                    SHA1:9FFEAE66405CFB254180C7DBE185288791DFEE5F
                                                                                                                                                                                    SHA-256:B4BF883FBE9246EF4079179A746B1F9E59F2C77D4F598794B60732D198DC6044
                                                                                                                                                                                    SHA-512:25C69E04018C2978A2E5748F0D3C61157453D998C16FA4B3C257A6515B87F5FD2B754893B47604BBC60AB60B60BA162BF2D1463E616E72CB8713C736F1B4D428
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-1) {.. {-9223372036854775808 3600 0 +01}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.964101313797091
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDINFeyFNMXGm2OHMUUMy:SlSWB9eg/yRUN5XDm2OHXFy
                                                                                                                                                                                    MD5:AE6601FACF6BE1E68083F8D353901181
                                                                                                                                                                                    SHA1:8B3BFA307D2A94BADD3A1A5E42545D6F7C620BCE
                                                                                                                                                                                    SHA-256:EF3046D7789CAE069B5473D053F3EF0157248F8A359A1282EE02BA613A75FC94
                                                                                                                                                                                    SHA-512:1859E6A2CB94EFEE7CD5C17803AA4F2DEEBE4DCF43D3B1EA737DF00BA86ECEC79D296D75E69D5829DECB48380B6B650724104FFA7959FD18FE032DF7D002A88B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-10) {.. {-9223372036854775808 36000 0 +10}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):5.00162575418652
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIVSMXGm2OHlVVtyn:SlSWB9eg/yRUVSDm2OHlVLy
                                                                                                                                                                                    MD5:D864BA451C9E441BF47D233626C57B99
                                                                                                                                                                                    SHA1:6C38E6F8BA292575C496124572D187F97C9F8E73
                                                                                                                                                                                    SHA-256:CCDEADBD18BE81E59A669A460A14AFCBFF733C3A5D164FC2B6B93DEAF009B78A
                                                                                                                                                                                    SHA-512:5C16BD1189F3FE6789CB3630C841FD168EC87D0498EE6FCC4C8D635F8CF4BCAF0558B44F859C37E418F6BC5A7F6693D6EF1DD218A1DB6DA2D54FF55916685119
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-11) {.. {-9223372036854775808 39600 0 +11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.978079707159482
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIjbNMXGm2OHwvv0UIoAov:SlSWB9eg/yRUjJDm2OHwvv0YAov
                                                                                                                                                                                    MD5:C3E7748C7CB9D8A7F7FA5170D5098983
                                                                                                                                                                                    SHA1:54F5374A32173BEC6EDA430745DCD18749ABC233
                                                                                                                                                                                    SHA-256:23B61B18C653E25F7245B0BB6E04AD347E038585B145962FD1EEACE26F118D54
                                                                                                                                                                                    SHA-512:4783A7CD4C94CCC67C1C71F9C5D9CD99A3918EA4792D8CE2443ACE8F034B9023EBC02405B5DEAB919AA35FD1FD29D8980774316AC96D32ECDEBEFA15BBE6878D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-12) {.. {-9223372036854775808 43200 0 +12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.994320173226919
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIaMXGm2OH1dNv7Dy:SlSWB9eg/yRUaDm2OHty
                                                                                                                                                                                    MD5:224AAAA8A31C283F50149A090E3970D5
                                                                                                                                                                                    SHA1:E7E4876EC2474FEFD82D4B174CA8E3A3427062F5
                                                                                                                                                                                    SHA-256:A9F1AD5A7CB5ED43C5E6E8A7A9B887329890ABB75B9FC9483B8543A367457EBE
                                                                                                                                                                                    SHA-512:6EE0C6F519AAB2DAA3F7D802F0F838BA9F6BF1D56530000D3C9EA4FDA81DCB9832A3285E36208F29EEB23C27EC5BFD3438DC272929A7531268B7C0626A65D6A5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-13) {.. {-9223372036854775808 46800 0 +13}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):117
                                                                                                                                                                                    Entropy (8bit):4.9895752453470585
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIxhfMXGm2OH0FVtXvFv:SlSWB9eg/yRUxJDm2OH8jNv
                                                                                                                                                                                    MD5:8ADF71739DCADE63433B7BF8321EAC77
                                                                                                                                                                                    SHA1:AA6BDE83FF0D8BCFDE0426160250F2D17D3AF81D
                                                                                                                                                                                    SHA-256:A37A7160027BD38356764C4D1AA5B9B17F8D5DC3CFB81EF2ED399E44C41734CE
                                                                                                                                                                                    SHA-512:AEE3929DE269ADB5265A54841F041E41595359C101539F6309A4E737E3F5DF0BC91560781C7118975398C29A084113682C78F66E07E2E4AC5EAC8DFC33C4F0ED
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-14) {.. {-9223372036854775808 50400 0 +14}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):115
                                                                                                                                                                                    Entropy (8bit):4.921164129348819
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDInWNMXGm2OH/VXF9:SlSWB9eg/yRUnSDm2OH/Vb
                                                                                                                                                                                    MD5:CABB864F4E76B90928F5C54CD9334DEB
                                                                                                                                                                                    SHA1:4818D47F83F16B9F7612D1E979B2440C170ECDB9
                                                                                                                                                                                    SHA-256:7211BF8329B2388563ED8FA8C5140099A171B8A303A9473E9A6F3AF0C5D239CB
                                                                                                                                                                                    SHA-512:1FDCB05D675F1D28CB52B9F5EAC7EC52FDF2CE7E7411740A6F8FB5E9D443ED636CE268E3AF9E08605CC3E13A49B2D86FF4EA6A85F518D5C79E263BA94263361D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-2) {.. {-9223372036854775808 7200 0 +02}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.948161547682094
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIYyXMXGm2OHkNsWYcv:SlSWB9eg/yRUlDm2OHkKWYe
                                                                                                                                                                                    MD5:4AE5F29A13A86E4A7064E9200668E43B
                                                                                                                                                                                    SHA1:2460BD1BB0FF3A3C774A5C7CC3DA10235DA06B0D
                                                                                                                                                                                    SHA-256:BFC86D65B0B94725DCE4C88EDC4300141ABBCA4B6CDECF037C437DF49F0C1D6A
                                                                                                                                                                                    SHA-512:190DC38B4A20F964C967866507086317D85D979DFCFA415D1569C485C6476024922BC6E7103273C41889D9D7B22E97933F286FCF4D341248077C1BA777D0EE3B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-3) {.. {-9223372036854775808 10800 0 +03}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.970850637731657
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIQXMXGm2OHkVsRYovV:SlSWB9eg/yRUQXDm2OHkSN
                                                                                                                                                                                    MD5:BBAF760E27C02D176A675AC3CF2D1E6D
                                                                                                                                                                                    SHA1:E524FAA7D424A1C1545D1D8EC00169125A68E8E5
                                                                                                                                                                                    SHA-256:02E2EEAF88EE179EF63DD29ACC7384A4B46DE1E3A151C1F3A5DD31BBB5A05AEE
                                                                                                                                                                                    SHA-512:6AC7CC0E52E7793C7F2D3DDA9551709DEAE654C1182EAD7108D04F1BAAAB7E1C473B6E8A3A126B0E421D8A246294A03B2EE9E070330924502DF2869CC61C37F7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-4) {.. {-9223372036854775808 14400 0 +04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.955530107787899
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDI7tNMXGm2OHM0VQVFv:SlSWB9eg/yRU7PDm2OHnVQVV
                                                                                                                                                                                    MD5:17F64A5969D3755211E60C0A9F83974F
                                                                                                                                                                                    SHA1:FEFA84725EFAE6405F43797296C342B974F2D272
                                                                                                                                                                                    SHA-256:3A2C75DCA11D1167126F0D44A8682420FAF75B0B82B3DCFC35A9F028A9A759E8
                                                                                                                                                                                    SHA-512:77DBCD8284A470E4869976E2E8A5EDE28104283F120C863785A6B2E64CF87E06243196817C0055A9B32D6FFFE94A25772F67D58BF8E885F7EC06C34FABE38766
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-5) {.. {-9223372036854775808 18000 0 +05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.973993120288556
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIg3fMXGm2OHETNSTVVn:SlSWB9eg/yRUgPDm2OHETMX
                                                                                                                                                                                    MD5:51CAF7956E133C8A9788AE0B8C6145AB
                                                                                                                                                                                    SHA1:47F8B49DF9ED477BD95F908693A483AE4FDE881F
                                                                                                                                                                                    SHA-256:D22C87321373EC0EFB0F312925476CD0747323EF303E17621A871BF814C8ABB1
                                                                                                                                                                                    SHA-512:EC4B4BE74C1BA64DEC8EF11DAAA338C52BD67D55E8A2352FBC6C83FA142F8DBE424CC1110E9A9D9A891E1E858D1FFA6D1E3B997D41BBB374556FA1F9A708559E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-6) {.. {-9223372036854775808 21600 0 +06}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.928999319005163
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIpdNMXGm2OHAXUVSYovV:SlSWB9eg/yRURDm2OHAXUVSYyV
                                                                                                                                                                                    MD5:56D88B54CA33B43E2E7D3EA6AD3A4D6E
                                                                                                                                                                                    SHA1:9351E0C001C5D83325281AF54363D76D65548B7D
                                                                                                                                                                                    SHA-256:70CB3A766A2E84148B68613D68687D263D3592ED4B6E672797FB20801ECA8231
                                                                                                                                                                                    SHA-512:32B58AD16F64590903C7AB49BA4890DAF6F1F3D33187A7654D3DA88A1C0047483EAA58B2498D824A30116E235FCC8F8FB3FADD57F86396240E5D92B2CA337027
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-7) {.. {-9223372036854775808 25200 0 +07}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.9145396982864895
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIlSMXGm2OHN/VsdYLyn:SlSWB9eg/yRUlSDm2OHUp
                                                                                                                                                                                    MD5:E462AD5E0C046EA6769EDB4B2C80F4D4
                                                                                                                                                                                    SHA1:6DDB94485648622875E0927BA1E8CFE67CEC1382
                                                                                                                                                                                    SHA-256:80C85D59416CEC91DB3DAC5FDD2FD7B91D6FC74A37BBBEF6FF58F6F6816E8FC9
                                                                                                                                                                                    SHA-512:42734FD2DA8BD6E0BC271FF1375A31DEB72EED85AB5EA6E1E0F81EE4E3E7E74380FFC98FAC30409684F736DB580AAAF4F62DB4757AA35C10383584F6144EF363
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-8) {.. {-9223372036854775808 28800 0 +08}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                                    Entropy (8bit):4.956751740978211
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRDIeyXMXGm2OHENScFAy:SlSWB9eg/yRUPDm2OHsScr
                                                                                                                                                                                    MD5:98F70EC1B1AC7D38CB8D01705FB0CA56
                                                                                                                                                                                    SHA1:EDAFA132E48935ACEB8E72D3FF463E4FC857C1A9
                                                                                                                                                                                    SHA-256:57395BB968AFA5A041EADA4B684B82F0379A9333F9522D69F069A79FDEA2B8D7
                                                                                                                                                                                    SHA-512:97B8D7603D6B54C075B005B905B2A7A28B8BEA67894F055663C44D2BF730BB937AC8EF5B2DF182BDD2D9EFFDBD135DF9467C813AEE39AA6B34256908A12DC011
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-9) {.. {-9223372036854775808 32400 0 +09}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):158
                                                                                                                                                                                    Entropy (8bit):4.886484135647838
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDVMFHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRC1p8RQy
                                                                                                                                                                                    MD5:F879FB24EA976394B8F4FAF1A9BF268C
                                                                                                                                                                                    SHA1:903714237EBD395A27EAF00B3DAAA89131267EE5
                                                                                                                                                                                    SHA-256:AB742F93BE44BD68AB8FE84505FA28120F1808765D9BAED32A3490AF7C83D35B
                                                                                                                                                                                    SHA-512:F5EE4C331E37036516F2A1BF12F2E088B2E2C7F6475127BF4E7B4937F864550D64D570BC855B6058D4311755E8696EC42095A36AEF13BB29E62192EE0AFB6EAF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT0) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):163
                                                                                                                                                                                    Entropy (8bit):4.911342539638601
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRp+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRp6BURQy
                                                                                                                                                                                    MD5:CDD2DE9CF0FECFEA0CDD32DAC32DCDE2
                                                                                                                                                                                    SHA1:311CD4C6E819E18BAAACC382F81359BC208E2F73
                                                                                                                                                                                    SHA-256:F89167B6117838D9679C0397496B6D96D3A7BEAEF0BD99406ABACDBDB658FBCC
                                                                                                                                                                                    SHA-512:1AF061D07D2F579A089905B6B259AABD7C58F4FA0CD379EE54206164F0DCAEA5C720FB1F5E76F5782F8613E62D8F83BD55F1848D5D7A73D4A5C9F7BC6B9F5DB1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/Greenwich) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):157
                                                                                                                                                                                    Entropy (8bit):4.838936002050477
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRKh8RFB:SlSWB9vsM3yzTHAIgm6N/yR68RX
                                                                                                                                                                                    MD5:0587EB7D1B1C684A4A0F90D3CB0959C8
                                                                                                                                                                                    SHA1:3F2840AE512774494D9A0B6357C52CCB7DBA5265
                                                                                                                                                                                    SHA-256:0856D14DBBC53D46460BCD530BD070E9E8966D1C96BA01BA556E215A98C09CD4
                                                                                                                                                                                    SHA-512:DE38EF28893853219AC24AE4A522307ADAA1502F6D0C129219FAD9D75CFCE03A505C3E0758CFF2D2D4F7101414A5F7E4FC1C1B119B667E6A9C89B60DDA641E86
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/UCT) $TZData(:Etc/UTC)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):110
                                                                                                                                                                                    Entropy (8bit):4.903699772785336
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/yRF3yFNMXGm2OHvL:SlSWB9eg/yR9SDm2OHj
                                                                                                                                                                                    MD5:3D3F94B6AC5FA232E509356C703D9177
                                                                                                                                                                                    SHA1:502B8EE9D4A1EA75A91272181AC87B9B6ECE1F84
                                                                                                                                                                                    SHA-256:4D74D9EC2397B1708FEF47806294B0BCA26679F3A63149AE24E4E0C641976970
                                                                                                                                                                                    SHA-512:205A761A01C577F602236CB5C9938C834B7F3F9F681B94036B0A86101119893EF87D206D0C3F7737075ED833D4E35E374ACAE6605163E9C37B705D99BEBC928C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/UTC) {.. {-9223372036854775808 0 0 UTC}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):163
                                                                                                                                                                                    Entropy (8bit):4.874807282103623
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRYzXDJMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/yRY7VMr8RX
                                                                                                                                                                                    MD5:65E28EFF342B625E79175793FD38F9FD
                                                                                                                                                                                    SHA1:08B11474822E670DEAB8F0EA168BAED7D5E3DBE1
                                                                                                                                                                                    SHA-256:A2B62C5914DE169A68A018A5B47C1253DBCA10A251862D17B0781ECFD19B6192
                                                                                                                                                                                    SHA-512:79641D0E05F81BFB80034937D34E74B7483A790F33C1F9A0FA92C6A7913AC8C03036CFDEFB43850B84EFB3DD3C4A39022DC8F22E5B5DE6353586A546E03A5789
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Universal) $TZData(:Etc/UTC)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):158
                                                                                                                                                                                    Entropy (8bit):4.874356623237119
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRaQEBURFB:SlSWB9vsM3yzTHAIgm6N/yRYaRX
                                                                                                                                                                                    MD5:EDABCAC858EC9632D5D8DCCFB28F4D6E
                                                                                                                                                                                    SHA1:E5BEF1367A97A1900749CE6B1E01CF32F582BDD9
                                                                                                                                                                                    SHA-256:BBD6E93206FF3B7017AFBE63905B4C932C422B582F3CE2A79A7B885D390EE555
                                                                                                                                                                                    SHA-512:3A22364D423F2F970123561408018A2B72F43C4978836D3B6DF7517217445605838DCB8DDBDA204FD01C49A4A7D5ADAD4CA8BDA7C3B412D54750BAEAA589B683
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Zulu) $TZData(:Etc/UTC)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9102
                                                                                                                                                                                    Entropy (8bit):3.899679308991091
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:UvV6eHuZ+y+2KDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:SVJUSs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:262A99D2D471F855C2A3C96CACB0C431
                                                                                                                                                                                    SHA1:2CAC8BFAD1A626A189413203ADA2E2B753A6DA69
                                                                                                                                                                                    SHA-256:5808F77CAB37ED4F52F0A02FF0B75EA194F8799A2165695CA3650579CAD498D9
                                                                                                                                                                                    SHA-512:6DC3BD4177292C07390CD0EC2F672FB6846CEEFA1A2C57B2C8E84CE43C90486544350DA998A5E36CA7A02C46859B4183D829B26013E01071014C6E2849D6573C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Amsterdam) {.. {-9223372036854775808 1172 0 LMT}.. {-4260212372 1172 0 AMT}.. {-1693700372 4772 1 NST}.. {-1680484772 1172 0 AMT}.. {-1663453172 4772 1 NST}.. {-1650147572 1172 0 AMT}.. {-1633213172 4772 1 NST}.. {-1617488372 1172 0 AMT}.. {-1601158772 4772 1 NST}.. {-1586038772 1172 0 AMT}.. {-1569709172 4772 1 NST}.. {-1554589172 1172 0 AMT}.. {-1538259572 4772 1 NST}.. {-1523139572 1172 0 AMT}.. {-1507501172 4772 1 NST}.. {-1490566772 1172 0 AMT}.. {-1470176372 4772 1 NST}.. {-1459117172 1172 0 AMT}.. {-1443997172 4772 1 NST}.. {-1427667572 1172 0 AMT}.. {-1406672372 4772 1 NST}.. {-1396217972 1172 0 AMT}.. {-1376950772 4772 1 NST}.. {-1364768372 1172 0 AMT}.. {-1345414772 4772 1 NST}.. {-1333318772 1172 0 AMT}.. {-1313792372 4772 1 NST}.. {-1301264372 1172 0 AMT}.. {-1282256372 4772 1 NST}.. {-1269814772 1172 0 AMT}.. {-12507
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6927
                                                                                                                                                                                    Entropy (8bit):3.8182041031531897
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:CA34elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:CI41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:D897DCA686A03495EB2C3323FAB0BEAD
                                                                                                                                                                                    SHA1:1433BC303DE92F7B36F881C8595A42B35E0814FC
                                                                                                                                                                                    SHA-256:F0B48DA7CA3659450D87CC0DDFDDFD28B464543DF1EE40D935C44D5CD7C9B9B3
                                                                                                                                                                                    SHA-512:A1C4AE1E0EC26B159B0F5D058A7A77B8774F611A4D3C6AECEDD7186957D6BD9F15CDFCBA248FCC8A4B4146BD72CD7D66B9F88A2BF7CDEF416F1831A2F335D48C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Andorra) {.. {-9223372036854775808 364 0 LMT}.. {-2177453164 0 0 WET}.. {-733881600 3600 0 CET}.. {481078800 7200 0 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0 CET}.. {733280400 7200 1 CEST}.. {749005200 3600 0 CET}.. {764730000 7200 1 CEST}.. {780454800 3600 0 CET}.. {796179600 7200 1 CEST}.. {811904400 3600 0 CET}.. {828234000 7200 1 CEST}.. {846378000 3600 0 CET}.. {859683600 7200 1 CEST}.. {877827600 3600 0 CET}.. {891133200 7200 1 CEST}.. {909277200 3600 0 CET}.. {922582800 7200 1 CEST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2063
                                                                                                                                                                                    Entropy (8bit):3.679377249443024
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:TvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDOP:rCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
                                                                                                                                                                                    MD5:CB860328FA96A14055BF51A3B2D35A08
                                                                                                                                                                                    SHA1:CFA49DC861F4AC3D29A78D63D71C2D6D83D68F84
                                                                                                                                                                                    SHA-256:4B5FB0AF225974D117374028285F20A02B833FF4136E6BFAE7B65E6D6D28829E
                                                                                                                                                                                    SHA-512:960152826F4245012462E53F80B69B0C45C27D75D46C70D485674CA19071DF268671C7691B614BE53B9E7BD8CFEC5D24F3DCF933F2F14D827F2A32EB347D7540
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Astrakhan) {.. {-9223372036854775808 11532 0 LMT}.. {-1441249932 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {7
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7954
                                                                                                                                                                                    Entropy (8bit):3.7252594544513795
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:1D/8QdzFu+f+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:Z/8ohvyDjivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:8B2C99E1CD04D7559709FDF8D382343C
                                                                                                                                                                                    SHA1:C595D5159C742B815AF89EC8604376E01291F9F1
                                                                                                                                                                                    SHA-256:47353319419505AAB205C23F8C97EA0B12E5DED2113147794F77B67349AFF52F
                                                                                                                                                                                    SHA-512:227CA21A3B6160357988582E261A62AE7B09D46D479EABFAC8039185D710EFA765CD1694F4388EBF8800978A1E1DB69F6AF9BB9BF82C0FCD66E883930E1F8249
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Athens) {.. {-9223372036854775808 5692 0 LMT}.. {-2344642492 5692 0 AMT}.. {-1686101632 7200 0 EET}.. {-1182996000 10800 1 EEST}.. {-1178161200 7200 0 EET}.. {-906861600 10800 1 EEST}.. {-904878000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844477200 7200 1 CEST}.. {-828237600 3600 0 CET}.. {-812422800 7200 0 EET}.. {-552362400 10800 1 EEST}.. {-541652400 7200 0 EET}.. {166485600 10800 1 EEST}.. {186184800 7200 0 EET}.. {198028800 10800 1 EEST}.. {213753600 7200 0 EET}.. {228873600 10800 1 EEST}.. {244080000 7200 0 EET}.. {260323200 10800 1 EEST}.. {275446800 7200 0 EET}.. {291798000 10800 1 EEST}.. {307407600 7200 0 EET}.. {323388000 10800 1 EEST}.. {338936400 7200 0 EET}.. {347148000 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.876296755647751
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQahs3QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/y72
                                                                                                                                                                                    MD5:7160C6EE32380846653F016AE8AFD52A
                                                                                                                                                                                    SHA1:DE7805089639C54893F2107FA67342DA72A79BBC
                                                                                                                                                                                    SHA-256:557023674F6E8376707517103EE69C1DEBBE53CDD4BCAB11E763CC53B9CB1908
                                                                                                                                                                                    SHA-512:FDBDECBBDB0C419226E2604608FD2923CFB06E4B6948493208FD83FD796880E81F6147C0FAFEB572079C9C916831B7B055620EC939164CCA1DAF76897BE60F2C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Belfast) $TZData(:Europe/London)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7309
                                                                                                                                                                                    Entropy (8bit):3.8204712502914653
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:lp+/4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:lY41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:02A003411B61A311896A6407B622152A
                                                                                                                                                                                    SHA1:3B8BC6D1AF698CE7BB14A08307F5A4295EB8ED03
                                                                                                                                                                                    SHA-256:74B225511B518B0CED972CBB33D694697712CCB96A6D81E0F50ADA28CF6E2C92
                                                                                                                                                                                    SHA-512:9E03B3EB1E528E5B1ADBA09F808E73BF9C4314EDCBF6F96E46844D51A5F425BED3EE8FD5BA8706C46A7FB9882485F119F81996F2EAB7E1E9B598978C402DDE0F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Belgrade) {.. {-9223372036854775808 4920 0 LMT}.. {-2713915320 3600 0 CET}.. {-905824800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-777942000 7200 1 CEST}.. {-766623600 3600 0 CET}.. {407199600 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 360
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8020
                                                                                                                                                                                    Entropy (8bit):3.820756136386754
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Pi9+qFR274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:PQs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:84027C3C8315BD479B38DE11F38E873F
                                                                                                                                                                                    SHA1:6E92A2A9734A9C6B02ECCD99F114D667C909C5BA
                                                                                                                                                                                    SHA-256:7E7111F06288069B52A4E1CA0B016216DF9328FB3B1560A740146497CCDD4D24
                                                                                                                                                                                    SHA-512:5FFDE523021FC0C490261F55999204C9CE6C8C274888525EA6EE7C01BC5CCABC7A3877FD454B4167D81F4B89BACB087E8BA6AB0BAC46C2874ED9257BE2092340
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Berlin) {.. {-9223372036854775808 3208 0 LMT}.. {-2422054408 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-776559600 10800 0 CEMT}.. {-765936000 7200 1 CEST}.. {-761180400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717631200 7200 1 CEST}.. {-714610800 10800 1 CEMT}.. {-710380800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.943205109348136
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVtXrAeovXHAIgoquXrsY6RL/yQahcvEB5yQazXrH:SlSWB9vsM3ymzbAeSHAIgozbsY6N/y7c
                                                                                                                                                                                    MD5:C69AB60BE74D4BB7E31BE4E5ECCD8FD2
                                                                                                                                                                                    SHA1:9DD0BA6171080F074858EF88ADA2E91C1F465619
                                                                                                                                                                                    SHA-256:1D7C539AAA1E3AD5EF3574A629523B5B781F1A91D352C9B39B8DE7316756026E
                                                                                                                                                                                    SHA-512:C273B97CCFB5F328EB7A13CCA3126DE8D91B3876CBD248990C0BE063DDBE5B0F31EA138E31A1C5C43B1ABCF42EA511448E6DC589EB99E8172D7C2A68BA31A8E7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Prague)]} {.. LoadTimeZoneFile Europe/Prague..}..set TZData(:Europe/Bratislava) $TZData(:Europe/Prague)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9223
                                                                                                                                                                                    Entropy (8bit):3.8450929464870804
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:RhcSQnG1Czyc1+FdDKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcM:Rh8zyc4Ss41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:E6C1153C3F71C8C005D7A46DDF6461FB
                                                                                                                                                                                    SHA1:CBDF7D5D36AF57D83859C910B493464617EC9571
                                                                                                                                                                                    SHA-256:1402A2072ADC9EBB35F4C0368D2E9A7A11493626C667C022614FFB7CC05B6CB6
                                                                                                                                                                                    SHA-512:8B1B47678F75DBE59DB08E034F0701BD11FF4FD3AD0304C8ABF45E848F717D2787B8E47558D3C334D369E0938C633DC217178D3EAE6486CEFBE25CF1668479F6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Brussels) {.. {-9223372036854775808 1050 0 LMT}.. {-2840141850 1050 0 BMT}.. {-2450995200 0 0 WET}.. {-1740355200 3600 0 CET}.. {-1693702800 7200 0 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1613826000 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585530000 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301263200 0 0 WET}.. {
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7974
                                                                                                                                                                                    Entropy (8bit):3.7264631277913853
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:vMSsQMAz5CXNU5paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:vMS1kdUoivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:88DB5686937D3499A8142413B2CF2EB5
                                                                                                                                                                                    SHA1:E37BAD2127553600D0E38A43053D1B07B2498DA8
                                                                                                                                                                                    SHA-256:C560D45104A8DD73FC7370B5AC1615E22043DBC93DFB46A9ECC6468C2D38B19A
                                                                                                                                                                                    SHA-512:375B8A63CFF2E278CD8C78BF9DBC86288FFB1AD57DAED00CD2199F0B05F4FBFA7D17D93C6458B20B86F6D05F3E3A49D594E60AC97DDB47141E21D7CDE10F8456
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Bucharest) {.. {-9223372036854775808 6264 0 LMT}.. {-2469404664 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {296604000 10800 1 EEST}.. {307486800 7200 0 EET}.. {323816400 10800 1 EEST}.. {338940000 7200 0 EET}.. {354672000 10800 0 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8287
                                                                                                                                                                                    Entropy (8bit):3.8244305880244567
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:rHw0+D5xp4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:rQXj41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:11468F958796F971ADD5FB1A0C426D78
                                                                                                                                                                                    SHA1:3FA58BEF391BCF7BAC6A124D093B6505B4EAC452
                                                                                                                                                                                    SHA-256:B58F3E9066B8B57EB037D509636AA67A06ACC8348BE6C48482D87CDC49844A4E
                                                                                                                                                                                    SHA-512:0492EABD6EE16392C00A196AF38995E5F9E55E30A82A50EFFB381DC978E9E63E801555CDC219869E6251BD51115972F742D8A7D9524372B8B11702AE4B28BFB7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Budapest) {.. {-9223372036854775808 4580 0 LMT}.. {-2498260580 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1640998800 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1600470000 7200 1 CEST}.. {-1587250800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555196400 3600 0 CET}.. {-906775200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-778471200 7200 1 CEST}.. {-762656400 3600 0 CET}.. {-749689200 7200 1 CEST}.. {-733276800 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-686185200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-492656400 7
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):183
                                                                                                                                                                                    Entropy (8bit):4.952483060656419
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQahDZALMFB5h8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/y7D17/f
                                                                                                                                                                                    MD5:CED145F8D9B231234E021D2214C1064B
                                                                                                                                                                                    SHA1:7B111DC24CA01C78A382CECD3247CF495D71CD34
                                                                                                                                                                                    SHA-256:F511A80AB70FF93A0EB9F29293F73DF952B773BB33EB85D581E4FB1FE06E4F05
                                                                                                                                                                                    SHA-512:E2323C04BF99909ABA9A09A66F9B4696519B5F9FE3AF178FB04D5E0053F41CAA8B937DC4148954ED093D317F454E0547786BEC934F2ABF22A60AAA6A24E63BF9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Busingen) $TZData(:Europe/Zurich)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8096
                                                                                                                                                                                    Entropy (8bit):3.7635458172251406
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:jXSsijEpkv2XkN8qc/OyEie8hF5WQ9VX/Zs1cw27oXqdCA5XqjqFLigTE9s5VpJ:jXS+WeUqKie8hF5f9PwdXM9
                                                                                                                                                                                    MD5:E7F52393523729CA3916768B3F3B4E55
                                                                                                                                                                                    SHA1:1524A3E610DCD33AC0006946BAB2929CA7F5A33F
                                                                                                                                                                                    SHA-256:2BD1C0AB412A5E9C97F533C4D06B773D045215B92568A4E89ADC93C7462D62EC
                                                                                                                                                                                    SHA-512:218674ECD9FD6C1A1C83EE69AFE6AA5AD0D5A8BB59FF497FDF2573B7CF52DAE98ECE0815CF99668CA4E172FF67D220B227369865076333B3EE802A8839C65279
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Chisinau) {.. {-9223372036854775808 6920 0 LMT}.. {-2840147720 6900 0 CMT}.. {-1637114100 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {-927165600 10800 1 EEST}.. {-898138800 7200 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-800154000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7722
                                                                                                                                                                                    Entropy (8bit):3.8237774522471564
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:vFKb+vS74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOR:vFKX41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:F9BC892F4BAE6712718C75AA5A07E1C7
                                                                                                                                                                                    SHA1:D7BDB30B9E10A7B6FABB5A257F9F6C538C1E3371
                                                                                                                                                                                    SHA-256:C6ABC78AD0F03F903E04DB41067B555F9E589E321E253A01ED819189C6FFFC0E
                                                                                                                                                                                    SHA-512:A8F8BF7ED070A5DA021BC0A5F87003B7DE433EA66B38A09CA6BDC5F4DC964D35758AE325B0687694AA5F712EF563D1EB8444D11CBDD8332457AB8BBFF8602363
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Copenhagen) {.. {-9223372036854775808 3020 0 LMT}.. {-2524524620 3020 0 CMT}.. {-2398294220 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680490800 3600 0 CET}.. {-935110800 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 0 CEST}.. {-769388400 3600 0 CET}.. {-747010800 7200 1 CEST}.. {-736383600 3600 0 CET}.. {-715215600 7200 1 CEST}.. {-706748400 3600 0 CET}.. {-683161200 7200 1 CEST}.. {-675298800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9810
                                                                                                                                                                                    Entropy (8bit):3.7669748644882417
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:fbxxHZiMU8EKTy74jT56XdEN1+UZBdMN186LPR:fbzZiMUZ6y0jT5bZHMN186LPR
                                                                                                                                                                                    MD5:726F01B47BB99952639200AB73E29425
                                                                                                                                                                                    SHA1:FF38CF353CE007BE871A27DDF836D198D21F167F
                                                                                                                                                                                    SHA-256:930F4E37B6D60B6701CBA95EEA1F6053D85E5F9DE6BBE287A0D43E24B9D63FB0
                                                                                                                                                                                    SHA-512:CF3567BCB23C75527F154C987FAFAD09A5E84E0745A3DB55D268688E5BB37D4E17E2D71EF608FA9C1CA99066BD384108AB9F8C7AD5CAC9A95BC6A541B0135699
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Dublin) {.. {-9223372036854775808 -1500 0 LMT}.. {-2821649700 -1521 0 DMT}.. {-1691962479 2079 1 IST}.. {-1680471279 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1517011200 0 0 IST}.. {-1507500000 3600 1 IST}.. {-1490565600 0 0 IST}.. {-1473631200 3600 1 IST}.. {-1460930400 0 0 IST}.. {-1442786400 3600 1 IST}.. {-1428876000 0 0 IST}.. {-1410732000 3600 1 IST}.. {-1396216800 0 0 IST}.. {-1379282400 3600 1 IST}.. {-1364767200 0 0 IST}.. {-1348437600 3600 1 IST}.. {-1333317600 0 0 IST}.. {-1315778400 3600 1 IST}.. {-1301263200 0 0 IST}.. {-1284328800 3600 1 IST}.. {-1269813600 0 0 IST}.. {-1253484000 3600 1 IST
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9509
                                                                                                                                                                                    Entropy (8bit):3.8837074152297704
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:QTOKVA1oCobz0W4x2+ZE74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNA:QyoCvTZ641sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:D04F8EDDA1C3611692FB91E317CCADFE
                                                                                                                                                                                    SHA1:1C483FC95459EC6F1D5FE4DD275879A9EBCA1718
                                                                                                                                                                                    SHA-256:0524A31131405347C1D5D86C5EE38A2064AB055C030AB3B43F25DB3B28FFD8D2
                                                                                                                                                                                    SHA-512:4E2E18EBDE2765F2251B1FE41EF8E6AC79875617348974A28619F5E59EC0467239C682CCE8DEBD7A698BE2F00252C77D1F7FA50B6CAFF920B3BE53A0B836F815
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Gibraltar) {.. {-9223372036854775808 -1284 0 LMT}.. {-2821649916 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):183
                                                                                                                                                                                    Entropy (8bit):4.879252060643389
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQakQAL/yQavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yYU
                                                                                                                                                                                    MD5:07AF23DA01CB963EA9E57534E34E7704
                                                                                                                                                                                    SHA1:1C4A214FF3B722E80C0ECACA0FFD5DFF302F6AE9
                                                                                                                                                                                    SHA-256:F7046808A8E80B7AE449D1A49AE3E480096736B7D3F554A240C7DFB10F82076A
                                                                                                                                                                                    SHA-512:713860D340C0EBA5EEF873ECB9B28CCDE9BFAD31B6A8626EF507E96585F5CC1091BF8D8A2DB7E5CB532E44F4561FBAE1797141724EF934755B69919FEA09A78A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Guernsey) $TZData(:Europe/London)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7368
                                                                                                                                                                                    Entropy (8bit):3.7258352536809705
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:OsR0uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hzj:OkyDjivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:7FF902B06FA79F14553670A70E77FF8C
                                                                                                                                                                                    SHA1:0105051541F38956EA6192BD0C7ED4047668005E
                                                                                                                                                                                    SHA-256:5B5C0A9261A414EA8DC34F594EE05BEE16F695488B230857D2B569A6B603BC39
                                                                                                                                                                                    SHA-512:551940199783A0FF9D73695B77B10300644F50E91D6B02FE79BB0CD4B78C7BA88CCE56F4B9408EC146361BF408F52D01A1F435183360C801EA5E219FB718247F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Helsinki) {.. {-9223372036854775808 5989 0 LMT}.. {-2890258789 5989 0 HMT}.. {-1535938789 7200 0 EET}.. {-875671200 10800 1 EEST}.. {-859773600 7200 0 EET}.. {354672000 10800 1 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {410220000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 EEST}.. {717555600 7200 0 EET}.. {733280400 10800 1 EEST}.. {749
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.914274131294981
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQaqpfioxp8QavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/ycS
                                                                                                                                                                                    MD5:F9A0F19FAF3131D8A70C50FF21B365B7
                                                                                                                                                                                    SHA1:7FC2B5302FAD06BC4C633CD22A80A7D40073FFF8
                                                                                                                                                                                    SHA-256:2F1151B0528A5325443379D4E7CCE32C00213722AD9DF764E1DC90198084B076
                                                                                                                                                                                    SHA-512:6D04DF4480FE132A6641C4BF7E01936E2E4A71A3A6C2AB9F7DA7A9D8A4B836BC66EE2BB597B8C318D07A06F72C05B07E6785B53308ED9BC1103AE6DBDD0FF24E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3683
                                                                                                                                                                                    Entropy (8bit):3.814835316757376
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Qi0p05zvSPBUUl0ZFzo4ay0CREDcxn6nH78BV0QbCgkCPviiM0H7hdli80+j7x9L:Qiq66OFEIFMssCfMsXV3heM2MRlA0
                                                                                                                                                                                    MD5:A8256656B971F58CB991BC270BF93B26
                                                                                                                                                                                    SHA1:189796E1B8E29A7A7B8B0E143DD9B44BAF217AB2
                                                                                                                                                                                    SHA-256:08061A80FC0F1EF375EEFE784EACDF0812E289FD67E8613BDEC36209985CA1D7
                                                                                                                                                                                    SHA-512:1F11308B5BAC1F3DB75CAC7322BBEA6E51C6B4A2A3450F1DB84DE6AA127F0F1BAA7DAB409FAF1288C100BDA77DA6FA1C6E3C0BA962F9406D1445D7C9E2AA3A60
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Istanbul) {.. {-9223372036854775808 6952 0 LMT}.. {-2840147752 7016 0 IMT}.. {-1869875816 7200 0 EET}.. {-1693706400 10800 1 EEST}.. {-1680490800 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1440208800 10800 1 EEST}.. {-1428030000 7200 0 EET}.. {-1409709600 10800 1 EEST}.. {-1396494000 7200 0 EET}.. {-931053600 10800 1 EEST}.. {-922676400 7200 0 EET}.. {-917834400 10800 1 EEST}.. {-892436400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-764737200 7200 0 EET}.. {-744343200 10800 1 EEST}.. {-733806000 7200 0 EET}.. {-716436000 10800 1 EEST}.. {-701924400 7200 0 EET}.. {-684986400 10800 1 EEST}.. {-670474800 7200 0 EET}.. {-654141600 10800 1 EEST}.. {-639025200 7200 0 EET}.. {-622087200 10800 1 EEST}.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181
                                                                                                                                                                                    Entropy (8bit):4.8801202136140915
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQap6cEBx/yQavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yzx
                                                                                                                                                                                    MD5:FE10770868A75F4F8D76C5E23D99AA81
                                                                                                                                                                                    SHA1:30AC768BA47AF7A53831F5142B58ECEC41933621
                                                                                                                                                                                    SHA-256:97EB33915ED7C9C34144F8F42357FAB2262B3CD45287F3CFFD26C33D65F7651E
                                                                                                                                                                                    SHA-512:1D82DF45AB0CCDFBFAD0431C668794996E01776800F34DD4131C5287D37291657A749D497AA5B0AB81CAFF3190896633FBFF456BFFEB7E93A3420AA841E54842
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Jersey) $TZData(:Europe/London)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2512
                                                                                                                                                                                    Entropy (8bit):3.941165221943348
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:coNlj+X2uxhuHJkw0QqXknzaVV04v3TfdGY3kNmneVuNlh000sGpdh:coN9+1EpkwCXkSV3A8qc0
                                                                                                                                                                                    MD5:104CCB93300F40BAF8F4D7CC882EFC05
                                                                                                                                                                                    SHA1:EA83F3C3791BD6F083844939DC405B248E738FE3
                                                                                                                                                                                    SHA-256:2387D26DF5429DF9867F42F7D4F872DC146643B4B3CC57DA7298C18561DE8BFE
                                                                                                                                                                                    SHA-512:12724C5BBEE0835626A98B66BF55C3DF1311F07018C70D76FC5C50E7E7BA5C4A9F064D9EDC376CC3B06C4FFFECA3FAF5B66948615A03DFECA7C361E326D950EA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kaliningrad) {.. {-9223372036854775808 4920 0 LMT}.. {-2422056120 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780368400 7200 0 EET}.. {-778730400 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-749095200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7453
                                                                                                                                                                                    Entropy (8bit):3.762620506765216
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:j3C1LyEpkvIpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:j3C9VWdivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:1F0C92A6E5C6BAD82AD7E35814ACC388
                                                                                                                                                                                    SHA1:F29C94DF4EE211481051186BBE5CD77EEDC6C33F
                                                                                                                                                                                    SHA-256:08B137B7B933393F8F4574615A370013288E5297937B5C59D4179744273FAB26
                                                                                                                                                                                    SHA-512:88E8B89439022D219D752340E28C21E461D8E288DA135DA4765C87037B610515E6D9E1B716707025B5BAE652FA2F2A89577949C8A923E5C8667AA6CB5C1BAD7A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kiev) {.. {-9223372036854775808 7324 0 LMT}.. {-2840148124 7324 0 KMT}.. {-1441159324 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-892522800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-825382800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {638319600 14400 1 MSD}.. {646786800 10800 1 EEST}.. {686102400 7200 0 EET}.. {701820000 10800 1 EEST}.. {7175
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2029
                                                                                                                                                                                    Entropy (8bit):3.668326642402654
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:FFvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDM:FhCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
                                                                                                                                                                                    MD5:57BB199152815B12FE4491C92FE25186
                                                                                                                                                                                    SHA1:7BC5ECDE9EFADE812AF40CB92CCE5323FB57C78D
                                                                                                                                                                                    SHA-256:60884D4B8B17A9AB8FB5697DA95F62E570755348109C661D783D56CD047BBE9E
                                                                                                                                                                                    SHA-512:2043FDBA860E8F6578F7E26A80C7787B82C7D15188327923EC36D153FDF9BEEAE063012ACE4309B76DB9DBA2DFFB7404DE370BA85023CCE93159FCAD3B9B92B5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kirov) {.. {-9223372036854775808 11928 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {78044
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9878
                                                                                                                                                                                    Entropy (8bit):3.8275310275285723
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:j76abXsyZLEjx82YbtIaFF1w0us4qE3+sSGjT:j77bXsyZLEjx82atysLE3+sSGjT
                                                                                                                                                                                    MD5:0DA331C2A815739E6758797BD24554EA
                                                                                                                                                                                    SHA1:3829C441E908BEFDC4ED6AB65FD4ACD0C97D5E1B
                                                                                                                                                                                    SHA-256:9FAC9812411F88014779D34722F3E0D2750E45BF21595DF1AE14CB9CCFD3F33F
                                                                                                                                                                                    SHA-512:FEBBA05F64AC1F3066AF6351493DD89768154FD171D447503DAEDB90D16858BEDBCE4A74E24AC0C37B5FF191692AF44AADDE4A92E752F88C48DA646352AD9A0B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Lisbon) {.. {-9223372036854775808 -2205 0 LMT}.. {-2713908195 -2205 0 LMT}.. {-1830384000 0 0 WET}.. {-1689555600 3600 1 WEST}.. {-1677801600 0 0 WET}.. {-1667437200 3600 1 WEST}.. {-1647738000 0 0 WET}.. {-1635814800 3600 1 WEST}.. {-1616202000 0 0 WET}.. {-1604365200 3600 1 WEST}.. {-1584666000 0 0 WET}.. {-1572742800 3600 1 WEST}.. {-1553043600 0 0 WET}.. {-1541206800 3600 1 WEST}.. {-1521507600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1426813200 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1221440400 3600 1 WEST}.. {-1206925200 0 0 WET}.. {-1191200400 3600 1 WEST}.. {-1175475600 0 0 WET}.. {-1127696400 3600 1 WEST}.. {-1111971600 0 0 WET}.. {-1096851
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.948438246006353
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQavPSJ5Qahs0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNl
                                                                                                                                                                                    MD5:56C6C95484FEAF9BAF755683E7417B58
                                                                                                                                                                                    SHA1:A43176BEBC5B4D7144A7E1109E0AAEFD95C21EC6
                                                                                                                                                                                    SHA-256:713A842197516D618F2D86977262542A1CA334D7DF6026539FA2F2980DBF4CD3
                                                                                                                                                                                    SHA-512:566B6DF2D76A8A4D3405C4785C7A471A23D65CD8838831BD0DEDF5BF194E8A3B304CA9920CB4A8EC9D6CD60EAA9BE0335E38D9547A4D23C7E4E5E5A39A09DDAC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10211
                                                                                                                                                                                    Entropy (8bit):3.826887992237191
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:GNoCvTZtcf80KYiK3BG0Myj9TYQOeMAwbccM0Fp:GNNTZtcf15iOBG08eNwbccM0Fp
                                                                                                                                                                                    MD5:0625C99E16D3C956DED1C0C0F867DEC3
                                                                                                                                                                                    SHA1:6ACDF0DB619B63E21EC89046B9320A85FBD3397A
                                                                                                                                                                                    SHA-256:D04C4E25DF4DE1C1CFE1EF84B3B6DD746CF08A271AB0958F22C7D580A3ED10E6
                                                                                                                                                                                    SHA-512:07AC42F0635DF01CC0AFD13F9668B143D4943BA0E4C377D254B5AF034D9DDBAB77BA813187E9AB73D2EEAD86EBAA26DC15599FD74FC82EEF287F5A6AB9C01635
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/London) {.. {-9223372036854775808 -75 0 LMT}.. {-3852662325 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9139
                                                                                                                                                                                    Entropy (8bit):3.8497931755359303
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:TkR06ZldaKsc1+FpbdKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiT1:wxRscASs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:789594ED1BB0EDA605DFB567C1E7FE9E
                                                                                                                                                                                    SHA1:66C7116CCBED0917A429BB277CF4E0B3361A5B41
                                                                                                                                                                                    SHA-256:380E49D38F6ABE946A90A9343A277ED28492EB800747D6D14F4639FD3EA80EDE
                                                                                                                                                                                    SHA-512:62CC68E72E79B7A377EAFE92B64D829CD5B9651FCA6782DEF4886C91BB9DF5FCFCD0CF8C5C7628F49E8C523A4AF917DA2745ABA56107683CA014C3E0254E780E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Luxembourg) {.. {-9223372036854775808 1476 0 LMT}.. {-2069713476 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1662343200 7200 1 CEST}.. {-1650157200 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1612659600 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585519200 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552258800 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520550000 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490572800 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459119600 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1411866000 3600 1 WEST}.. {-1396224000 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269813600 0 0 WET}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8517
                                                                                                                                                                                    Entropy (8bit):3.8326167134909177
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:k5m01LdXKc0TJp+bwS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:+DaNVLSs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:63263380F57B756A1DFA3796E4188CD3
                                                                                                                                                                                    SHA1:8EEE707AC4FEA1C098C81AC2D289A46239121A5E
                                                                                                                                                                                    SHA-256:5337C9843C56DEEC6B91C4468C76EC1C896E80421B72B583B69DE5579063E09A
                                                                                                                                                                                    SHA-512:ACA4830020715C471741E27EB2292ACF002D2CD7EDCD1061978B64967EB447F61AA095F960D8A75A01B9B87558D83FF409F30BDACA83E063024F1E2381FA64C4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Madrid) {.. {-9223372036854775808 -884 0 LMT}.. {-2177452800 0 0 WET}.. {-1631926800 3600 1 WEST}.. {-1616889600 0 0 WET}.. {-1601168400 3600 1 WEST}.. {-1585353600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269820800 0 0 WET}.. {-1026954000 3600 1 WEST}.. {-1017619200 0 0 WET}.. {-1001898000 3600 1 WEST}.. {-999482400 7200 1 WEMT}.. {-986090400 3600 1 WEST}.. {-954115200 0 0 WET}.. {-940208400 3600 0 CET}.. {-873079200 7200 1 CEST}.. {-862621200 3600 0 CET}.. {-842839200 7200 1 CEST}.. {-828320400 3600 0 CET}.. {-811389600 7200 1 CEST}.. {-796870800 3600 0 CET}.. {-779940000 7200 1 CEST}.. {-765421200 3600 0 CET}.. {-74849
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8724
                                                                                                                                                                                    Entropy (8bit):3.816380386871747
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:KAGvi2GmkwwnpH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZN:KLsww141sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:9B09D6EED8F23BAFFB62929C0115E852
                                                                                                                                                                                    SHA1:4AEF15333C73C2836C09D818FD0E20440D7C4780
                                                                                                                                                                                    SHA-256:C5C240BAAECE8235D1FBDD251C1A67CB2D2FC8195DD5BBE37FF9CFF0445FCDA2
                                                                                                                                                                                    SHA-512:43AA3492BD335A290C6EFEE275B47EA18E544199E37A9BBAE2E350D42BDFF42F0E9ED461A4BB1824CA33F84A90D4060906844A3E22DA49C9821E4CB460832D6E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Malta) {.. {-9223372036854775808 3484 0 LMT}.. {-2403478684 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812588400 7200 1 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 3600 0 CET}.. {-81997200 7200 1 CEST}.. {-71715600 3600 0 CET}.. {-50547600 7200 1
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.959733196757503
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV1AYKjG5XHAIgoq2AYKjo0ARL/yQausWILMFJ8QaC:SlSWB9vsM3ymrAdjGJHAIgorAdjo0ANn
                                                                                                                                                                                    MD5:C1844961691214F6E6DF6487788A7758
                                                                                                                                                                                    SHA1:6D08E9FB7B8602A80622148BFACD9676F45F0E2B
                                                                                                                                                                                    SHA-256:6136C3CFA4A767E7C9DDA23A283AD98B72E9868F192E6A8E3BFE6396F6989BD1
                                                                                                                                                                                    SHA-512:B2D1EA51AC5B34792AC02820A9D60FD41F3B91AB6505896476FCB0DC339B8DC1DE9E2C89A7627F69E16247661AE8040D789FFD2F8F1CD59F243B57C4845B450F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Helsinki)]} {.. LoadTimeZoneFile Europe/Helsinki..}..set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2177
                                                                                                                                                                                    Entropy (8bit):3.9354590900153172
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:K8cVnR7xhuHJkminzaVV04v3TfdGY3kNmneVuNlh000sGpde:5mnRtEpkmiSV3A8qcN
                                                                                                                                                                                    MD5:9C10EAE9FA0DE192C5FD4F76E12606F0
                                                                                                                                                                                    SHA1:AFD5650410EC3E6ED564A8B2ABF91709D090B4AD
                                                                                                                                                                                    SHA-256:8C95EA696EA578DEF726502AC181AF475A676030878F56B4E2D667757BBD1C49
                                                                                                                                                                                    SHA-512:3B9ED6B68858485B9A46A0863B7D9D3C1E4C5BBA269457F24A9A12C274F0F9B35E63D8C25EB53E7200DB57DD35ACCB7FD7D8AB005FEE2C4D7FC6E72E8CF57194
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Minsk) {.. {-9223372036854775808 6616 0 LMT}.. {-2840147416 6600 0 MMT}.. {-1441158600 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-899780400 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-804646800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {670374000 7200 0 EEMMTT}.. {670377600 10800 1 EEST}.. {
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9186
                                                                                                                                                                                    Entropy (8bit):3.856050322706834
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:2d4STO1C+4qoM9JfKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcot:wvp+hSs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:859DF194457CED25EA3EC247CDEA5025
                                                                                                                                                                                    SHA1:970579F53446EBE50438CC3582D88094C7D7DEEB
                                                                                                                                                                                    SHA-256:654B92E8B9E8FBDC967D094B48110908F458454D7057F680AC745B9C8D48FCC1
                                                                                                                                                                                    SHA-512:3E589FC8CA5E0B0F7F6F17A6983813460AB7E07B9B631D8380836F00A8288FF80650D4139B2A6DEDFF245DE571C7726E087DFF3E6F5F9E7E9C9DFE72B839DC7A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Monaco) {.. {-9223372036854775808 1772 0 LMT}.. {-2448318572 561 0 PMT}.. {-1854403761 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2430
                                                                                                                                                                                    Entropy (8bit):3.942836780611272
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:7fnjazk7e+LxhuHJkvVineTeCTU50x0Y7:7fnjazk7eoEpkvVieTeCTUax0Y7
                                                                                                                                                                                    MD5:4547D47E9364ACAFB2A4BEE52D04BFBB
                                                                                                                                                                                    SHA1:1E7F964692F81D49AEAF581FE70AD22D4E36226B
                                                                                                                                                                                    SHA-256:31F9C3C2F17B3EE4FA6D9EE6A86BF407AC0377DE4D666C65E86CE5AC591F829F
                                                                                                                                                                                    SHA-512:7F1D7C80A1BF611D5440EEF9085DA6CDED86B5EF4C2737C105640030E5AA998A0951182E72DC224190A25DA8846CDE856A78EBAA8876AA0B18B1CBCADBB060FF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Moscow) {.. {-9223372036854775808 9017 0 LMT}.. {-2840149817 9017 0 MMT}.. {-1688265017 9079 0 MMT}.. {-1656819079 12679 1 MST}.. {-1641353479 9079 0 MMT}.. {-1627965079 16279 1 MDST}.. {-1618716679 12679 1 MST}.. {-1596429079 16279 1 MDST}.. {-1593820800 14400 0 MSD}.. {-1589860800 10800 0 MSK}.. {-1542427200 14400 1 MSD}.. {-1539493200 18000 1 +05}.. {-1525323600 14400 1 MSD}.. {-1491188400 7200 0 EET}.. {-1247536800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179
                                                                                                                                                                                    Entropy (8bit):4.7873368289068905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85GKLlXHAIgNwMGKLZRRL/yQatHefeWFKYGKL8n:SlSWB9vsM3yZdL1HAIgGMdLZRN/y3HeA
                                                                                                                                                                                    MD5:BE82205480617CF07F76BA0DF06C95BC
                                                                                                                                                                                    SHA1:46D2D8D9FE4FB570C2A09BC809B02C8960F9601F
                                                                                                                                                                                    SHA-256:FC93B7516933EDFDC211AC0822EE88BF7ACAD1C58A0643B15294F82EB0F14414
                                                                                                                                                                                    SHA-512:F490A70053A6011D80FB0A4E96D2871BFEEB168690E21C4EC31F2F5C0E24A67C706528C81322A1D48E71242F0FFA277550192925FDE5B1F34BFCB308290E11FC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Nicosia)]} {.. LoadTimeZoneFile Asia/Nicosia..}..set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7922
                                                                                                                                                                                    Entropy (8bit):3.818430983275607
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:MC+4twRQqvSO774elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:MXRQqvSOv41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:9923D3F3C50D2BD96BD36558FBCD8E92
                                                                                                                                                                                    SHA1:56584B8B9CB27B0ADCAD490C029EE58308C4D7C5
                                                                                                                                                                                    SHA-256:5A28B5CEC79B57D4856E3F05615245E6F74DF6388B48BF3F605B792CA3BD972D
                                                                                                                                                                                    SHA-512:1FA928EA5F468F2B4AA40B6B73CE6E42267832413B333C399431FE08C6CB4FD4BDD7E3DB15682C76E5EDEB5849224F1EE5B9667E68A8C5C89AF09B075E4F7755
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Oslo) {.. {-9223372036854775808 2580 0 LMT}.. {-2366757780 3600 0 CET}.. {-1691884800 7200 1 CEST}.. {-1680573600 3600 0 CET}.. {-927511200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-340844400 7200 1 CEST}.. {-324514800 3600 0 CET}.. {-308790000 7200 1 CEST}.. {-293065200 3600 0 CET}.. {-277340400 7200 1 CEST}.. {-261615600 3600 0 CET}.. {-245890800 7200 1 CEST}.. {-230166000 3600 0 CET}.. {-214441200 7200 1 CEST}.. {-198716400 3600 0 CET}.. {-182991600 7200 1 CEST}.. {-166662000 3600 0 CET}.. {-147913200 7200 1 CEST}.. {-135212400 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9152
                                                                                                                                                                                    Entropy (8bit):3.8506895725632746
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:fySTO1C+4qoMYOKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdi:fdp+3Ss41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:9CAF8C5C5AF630E7F782C0480DD786E7
                                                                                                                                                                                    SHA1:9FBEF9EEDD8BAFB48B17E3AC388CFEF8DCD10CB0
                                                                                                                                                                                    SHA-256:AE61491C4A587F56426A9F2118E31060276F2B0231E750C461781577551CA196
                                                                                                                                                                                    SHA-512:F809744BB597184A2815758A27B6A07C515C65DB96CFFB3625FD059DEBBF05EE903E999483B3459C7C8D3991824746F8530CD1378F8A63B1F54F60CFACE9F89B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Paris) {.. {-9223372036854775808 561 0 LMT}.. {-2486592561 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800 3
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.910162937111088
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQazKIGl1/yQ0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNK
                                                                                                                                                                                    MD5:52C36955D6BD1D9FE9CB64822D04B6DB
                                                                                                                                                                                    SHA1:D5FF82EC486409E6FB314AD5ACE608577C9632CF
                                                                                                                                                                                    SHA-256:B87630FF459DE07EB16CD0C2452660772E3FFC4EEB8419EA77A013B6F63A5900
                                                                                                                                                                                    SHA-512:ABA49D3F05A41A4982600E4DA5C225D8994251F447401EE6FE8478E008BCD5D41C057034185B5CFF805634D571F3CC98EFE98093ABC8E6271351E11A4DA1E7AD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8038
                                                                                                                                                                                    Entropy (8bit):3.8240363895915914
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Kr9+neXAS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlh:KnASs41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:828134FA1263FEFA2B06A8B2F075F564
                                                                                                                                                                                    SHA1:4B332DE6E0855F8B9517F7098A3FB439671FC349
                                                                                                                                                                                    SHA-256:5D3AFED5C1B07C6C6635D6BDEB28A0FB4D11A61F25F26C91227B2254BE5F4AA0
                                                                                                                                                                                    SHA-512:9AB1462CDBD7F13F0CECDCCC2D91A85D8C0576B71508F935D26638C25ED023CF8FF4BA4FFDA402B308E6142B135D1B9D88700A519DBE2381E8E945329A5354F7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Prague) {.. {-9223372036854775808 3464 0 LMT}.. {-3786829064 3464 0 PMT}.. {-2469401864 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-777862800 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-746578800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-728517600 0 1 GMT}.. {-721260000 0 0 CET}.. {-716425200 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654217200 7200 1 CEST}.. {-639010800 3600 0 CET}.. {283993200 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7658
                                                                                                                                                                                    Entropy (8bit):3.7750218768791806
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:eq+cEpkjXkSV385aNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:ePWjUS7ivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:0D3C919F60081388524BD5DB22E6904B
                                                                                                                                                                                    SHA1:6691EAB901C8B57D2F2693120A45A67799D05FCB
                                                                                                                                                                                    SHA-256:8B64A42BAFD90F9255CACFDBAC603D638DD7C18DC27249F9C9B515E1DA634424
                                                                                                                                                                                    SHA-512:62A2820B8C1C5468AC1F1BB626F9AAAD0BA1DEC5B73740F00FE4DB8CFA3F2BCF9947968E693824FC8770BA20AB962F93F7E5E345AE8A85F99CDB18E2B510308E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Riga) {.. {-9223372036854775808 5794 0 LMT}.. {-2840146594 5794 0 RMT}.. {-1632008194 9394 1 LST}.. {-1618702594 5794 0 RMT}.. {-1601681794 9394 1 LST}.. {-1597275394 5794 0 RMT}.. {-1377308194 7200 0 EET}.. {-928029600 10800 0 MSK}.. {-899521200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-795834000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {6
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8813
                                                                                                                                                                                    Entropy (8bit):3.8168470239811736
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:hhGvC2GmkNXEq74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:hUsF41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:C4F49446D3696301EDB339691DCB2FDB
                                                                                                                                                                                    SHA1:537963A77B9BE9BE6B997A812A6E6DD120F6F247
                                                                                                                                                                                    SHA-256:DCD2D9144507311E573568598E1FFD0E0574FB677AA0DAFC5641D80A19EB6E58
                                                                                                                                                                                    SHA-512:1F0A9A549FA0995C51E90AC392671E3F09744B268F1EE6A27CA7E3C41C2B02A4BA0F98369BE40BA482FBA1FED8F1EE712F0B3217AD86164D1AD498E369C24D76
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Rome) {.. {-9223372036854775808 2996 0 LMT}.. {-3252098996 2996 0 RMT}.. {-2403565200 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-830307600 7200 0 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-807152400 7200 0 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 36
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2118
                                                                                                                                                                                    Entropy (8bit):3.664269700453612
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:7PvCAs6kKR6aQmF1cSNWrI+AjQnTRYZ/YF0LUdt/LkajuZbIJltiabs2Tb:7HCAs6kC6aZF1cSN4I+AjQTRYZ/YF0Lw
                                                                                                                                                                                    MD5:965D987F6576F66A08871697144D4CDB
                                                                                                                                                                                    SHA1:AF7226DF81C2B3C3A5832F59FC708A6BCBF389CA
                                                                                                                                                                                    SHA-256:8F395352AA05D35E7D13380E73659A0D5B56FFC17E3F4E40E4F678A902F0E49B
                                                                                                                                                                                    SHA-512:B82E0CFA5EDA0FCDF03609AE439255F8937A7E9EFA0AFE15EA8877316782AFC74514BCD2B4F06F1B5F0F3C5A64A933D73CB50D5AED2BB1491BD6CACBB77B10E8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Samara) {.. {-9223372036854775808 12020 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-1102305600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 10800 0 +03}.. {687916800 14400 0 +04}.. {701820000 18000 1 +05}.. {717544800 14400 0 +04}.. {733
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179
                                                                                                                                                                                    Entropy (8bit):4.955758257767983
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQawELDX7x/yQaxE:SlSWB9vsM3ymx5PHAIgoxvN/yt/yrE
                                                                                                                                                                                    MD5:D253DA6880630A31D39DB0CFA4933ABD
                                                                                                                                                                                    SHA1:E5798DAAE574729685FE489F296B964BC1CCF2E4
                                                                                                                                                                                    SHA-256:B6856A0E38C2404F7D5FA1821559503F8AE70923A562F0D993124D131515F395
                                                                                                                                                                                    SHA-512:CFB6005F3E8D1C585AF36EB7A8C9F49760EF6F446C97E7804EB61EFD0804424C4FB6AE81B71C5A867274EF89A17DAC0D2A0FF882A0F6AEA1D5FFD51593726C5F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/San_Marino) $TZData(:Europe/Rome)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.937834327554967
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawEX3GEaQa5:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNZ
                                                                                                                                                                                    MD5:F7C7DAE9C5D371EF9EE1F490246ED3CC
                                                                                                                                                                                    SHA1:40C388FE2A55078C8E0524A4385B3F8846960E24
                                                                                                                                                                                    SHA-256:BC00D953C2F3E55E40EDA13838AB66B9E9D0BDAD620E4EB917637761ABB06FB1
                                                                                                                                                                                    SHA-512:EB22C59F4D58D96797A718FC59B010795F587626E456D44A3E6398E0FBF4ECD97BCDC151BC1359151798B5AF2964FE5708233F8ECD0D344C3E27629F2645687F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2061
                                                                                                                                                                                    Entropy (8bit):3.6638125261109824
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:yFvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDQ:yhCAs6kC6aZF1cSNcjXgV/ApDFjDQ
                                                                                                                                                                                    MD5:CC4D7C478790588D232568CAB12D8E67
                                                                                                                                                                                    SHA1:07A7CFCFFFF91D124EDFC99F5053BAFC79FBB12B
                                                                                                                                                                                    SHA-256:AB90363DEE5077C39EC55FE8E519593FF08223E5A8E593F6CCE01FB5B8B35BAE
                                                                                                                                                                                    SHA-512:23944D20624C942CFDE58F1019160D64401BD0AFB8C3EC49F904038482FAA6741812548C860A2DAE050B8D17A7E08ED9C6EBE7FF19393CFA46D78B1D21B1CACA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Saratov) {.. {-9223372036854775808 11058 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {780
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2389
                                                                                                                                                                                    Entropy (8bit):3.9502615086649637
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:wM2wE0xhuHJkN+2kCnbdSisa0ewEKGfUslIYtq8X:UwEAEpkuCgaNl7
                                                                                                                                                                                    MD5:1953A171614196D2FD2CA12FFE6F70D4
                                                                                                                                                                                    SHA1:20958D5888F94C1FF2C90DDB97915435095AA67C
                                                                                                                                                                                    SHA-256:4186A873A6218FF746957A0AAED1D61FC28FF5ED6D44BF38F36B5120A21C06C6
                                                                                                                                                                                    SHA-512:35A628EBB2C2068A7DE07175494E195D75ADE30CB4B8BFE7EE7EA0A3B30F68BF6E0F21590A0A2DA0E02B944473545A5887BF95692A9C9E9DCD08CB8D542D142B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Simferopol) {.. {-9223372036854775808 8184 0 LMT}.. {-2840148984 8160 0 SMT}.. {-1441160160 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-888894000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-811645200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 7200 0 EET}.. {694216800 7200 0 EET}.. {
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):187
                                                                                                                                                                                    Entropy (8bit):4.953089768975736
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawOgpr8Qahr:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNO
                                                                                                                                                                                    MD5:0BF8ADBB63F5D6187C75FF1B0BAC761E
                                                                                                                                                                                    SHA1:7DE15E767D34812F784CE6E85438A592E2CBA418
                                                                                                                                                                                    SHA-256:52F20858433261B15797B64F0A09CEE95D552EF93B5DAA7C141BFAB6D718C345
                                                                                                                                                                                    SHA-512:27D395635427C8FA1A4E0063A32F482701D2CC7C7724B4A06E661D4A419D23E219672888D37367FE5E70B6872914EB9EE034AE359DCB6A4C4CE05CA34C3589A9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7654
                                                                                                                                                                                    Entropy (8bit):3.727428614069594
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:8lmG4+K7Gjz5CXNUatpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:8lmGWwkdUasivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:91357DFC23ADB0CE80C463E4B6D896BE
                                                                                                                                                                                    SHA1:273F51BE4C67A9AC1182F86AC060E963684151D5
                                                                                                                                                                                    SHA-256:6415F279CB143EA598CF8272263AC5B502827B10CEEB242B39E6EFCC23A2EE12
                                                                                                                                                                                    SHA-512:8EA7E2D4C2239879A4D6CCE302C38A6D2A9093A2CADEF4F4294E60D373AB9A2C468BA6E3D54DEC7F73D954CE5226EF2B022F8BDEF29B3B4AAB3838B05C72EA29
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Sofia) {.. {-9223372036854775808 5596 0 LMT}.. {-2840146396 7016 0 IMT}.. {-2369527016 7200 0 EET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-781048800 7200 0 EET}.. {291762000 10800 0 EEST}.. {307576800 7200 0 EET}.. {323816400 10800 1 EEST}.. {339026400 7200 0 EET}.. {355266000 10800 1 EEST}.. {370393200 7200 0 EET}.. {386715600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465350400 7200 0 EET}.. {481075200 10800 1 EEST}.. {496800000 7200 0 EET}.. {512524800 10800 1 EEST}.. {528249600 7200 0 EET}.. {543974400 10800 1 EEST}.. {559699200 7200 0 EET}.. {575424000 10800 1 EEST}.. {591148800 7200 0 EET}.. {606873600 10800 1 EEST}.. {62259
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7308
                                                                                                                                                                                    Entropy (8bit):3.817544865319589
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Skhe74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:Sky41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:A17318A055D4BB049FB4621CDC2AFED3
                                                                                                                                                                                    SHA1:61BA62F253BD4D8B34C2CFCDB96AB458D413E214
                                                                                                                                                                                    SHA-256:12447CE016745FC14584CB5F753E918C23ECA5D028CA50042E0714CF3783608A
                                                                                                                                                                                    SHA-512:90CF037C1DBF55C5D70164D2B2CBDC9580F7FE496279416F578E42A444AD6CEBFF29336921619AAFC4E872B886A9AC5EF45006D2B9585D17AA3864F773C89610
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Stockholm) {.. {-9223372036854775808 4332 0 LMT}.. {-2871681132 3614 0 SET}.. {-2208992414 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7549
                                                                                                                                                                                    Entropy (8bit):3.76585669030767
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:dUusEpkjXkSV3AMaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:O0WjUSWivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:54EF0224F5E28FA78F212EC97D4AE561
                                                                                                                                                                                    SHA1:FA7C9A951ED943F1E1E609D2253582016BC26B57
                                                                                                                                                                                    SHA-256:6F3594CCDA78B02B2EE14C8FAE29E668E47193AF2DFCF5AF1ECD210F13BCE9CE
                                                                                                                                                                                    SHA-512:2D1CA2BB1945AE5E3F56AF8FA7F950CE7169F215C783E683634581C5EC01B54159E47A0E9551897077BBEAB06158906029A4E4B0051A263D9E5D903EA9DA1692
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tallinn) {.. {-9223372036854775808 5940 0 LMT}.. {-2840146740 5940 0 TMT}.. {-1638322740 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1593824400 5940 0 TMT}.. {-1535938740 7200 0 EET}.. {-927943200 10800 0 MSK}.. {-892954800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-797648400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 10800 1 EEST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7675
                                                                                                                                                                                    Entropy (8bit):3.809498345470167
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:n05NWKIHBJ9AE4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt:0iKqxAE41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:1983B88075A92942209BB2B80E565F4E
                                                                                                                                                                                    SHA1:12A0401026C5C036144FD1D544173AAB39969F61
                                                                                                                                                                                    SHA-256:C62686BF598138FEFB72E8CC6632BA75A5FE147F2A30124EE3583BE1F732E38D
                                                                                                                                                                                    SHA-512:E95C38FA0A2B526C00B9DCF5CDF53059DECF64B085AA18BE000968DA626561944415D053CF7A5C32BC672085538920CFD67A3A3B627CFD5B1A4C9CEC49AA3F96
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tirane) {.. {-9223372036854775808 4760 0 LMT}.. {-1767230360 3600 0 CET}.. {-932346000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-843519600 3600 0 CET}.. {136854000 7200 1 CEST}.. {149896800 3600 0 CET}.. {168130800 7200 1 CEST}.. {181432800 3600 0 CET}.. {199839600 7200 1 CEST}.. {213141600 3600 0 CET}.. {231894000 7200 1 CEST}.. {244591200 3600 0 CET}.. {263257200 7200 1 CEST}.. {276040800 3600 0 CET}.. {294706800 7200 1 CEST}.. {307490400 3600 0 CET}.. {326156400 7200 1 CEST}.. {339458400 3600 0 CET}.. {357087600 7200 1 CEST}.. {370389600 3600 0 CET}.. {389142000 7200 1 CEST}.. {402444000 3600 0 CET}.. {419468400 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {457480800 7200 0 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 C
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.906212162381389
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV+NM/LWXHAIgoq9NM/HARL/yQa3MPgJM1p8QagNMj:SlSWB9vsM3ymI6CHAIgoI6HAN/ytM4MO
                                                                                                                                                                                    MD5:E0C99DB7673EEE440BA1848046455BA1
                                                                                                                                                                                    SHA1:1BCCC1BE46306DEF8A9CA249DE8FA11FC57CC04D
                                                                                                                                                                                    SHA-256:FDD53FDB5F754BBBA8FF98F0B1555FE0BAEB7852843220A7CF93A190B641A9AD
                                                                                                                                                                                    SHA-512:CD56B540AE9084DEAA9D0A1DBBAF89733C465424C22CE74696B9AE90FD4FEFAB265CF23C5B13A7F04597D75FD0147BD593E0552B56D87372170CB4CA1BFC8259
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Chisinau)]} {.. LoadTimeZoneFile Europe/Chisinau..}..set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2119
                                                                                                                                                                                    Entropy (8bit):3.680951255407528
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:kFvCAs6kKR6aQmF1cSNWrI+AjQndgV/Ap40FjDOP:khCAs6kC6aZF1cSN4I+AjQdgV/ApDFj4
                                                                                                                                                                                    MD5:83C86E437B5FBA1DC9CC5235396AC381
                                                                                                                                                                                    SHA1:5493A59C3A5A1B55ACD493E67F9E29D2A415A8DB
                                                                                                                                                                                    SHA-256:9FA9D09509B4F8F5A9C8E422DBA02605070C3EBDAEB7C1DF8527C8EEF5E3632D
                                                                                                                                                                                    SHA-512:86222489C65C87646939DECF91C2EC336EB46F64B644526A3FA8A4854B9D11819F6FD253107AB8A3DE911E254C88092D25137442164A6E437CDAF258A7CBB66C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Ulyanovsk) {.. {-9223372036854775808 11616 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 7200 0 +02}.. {695779200 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7541
                                                                                                                                                                                    Entropy (8bit):3.769633712898356
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:dpSlo5Epkn/paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:dpUWnmivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:4AD237C8A1D94E2CB70377C49867AC76
                                                                                                                                                                                    SHA1:121303331223925BFB708918BAED3CD2F0E33C60
                                                                                                                                                                                    SHA-256:747F543B7A875214F8EEBFDAE3182D91B1E93CEB57B58D2B7657672F949B13A9
                                                                                                                                                                                    SHA-512:FD2FB930CB81BD3427AEF374ACAC2A120F6AD447625824AD6D08E68868A3B389FDDE7E2A82FCFF3490488601ADE646AC989AA7CEF1FE77A700E232D7561B6E74
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Uzhgorod) {.. {-9223372036854775808 5352 0 LMT}.. {-2500939752 3600 0 CET}.. {-946774800 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796870800 7200 1 CEST}.. {-794714400 3600 0 CET}.. {-773456400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 3600 0 CET}.. {67
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.953146873643623
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQa1NEHp8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/yvNEJ8G
                                                                                                                                                                                    MD5:A0BAEC8B6AF1589ECBE52667DDB2A153
                                                                                                                                                                                    SHA1:37093F4F885CBFA90A1F136D082E8B7546244ACC
                                                                                                                                                                                    SHA-256:06B235BF047FC2303102BC3DC609A5754A6103321D28440B74EEC1C9E3D24642
                                                                                                                                                                                    SHA-512:DBEC235AFB413FA8D116FA1AFFE73706762E7458038B6D68E0BFD71C339510D766825BA97055A06DEE14D5880EAE6CD035BFE0C935C0DF44B0107A356D293A78
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Vaduz) $TZData(:Europe/Zurich)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):176
                                                                                                                                                                                    Entropy (8bit):4.914414313741477
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQa1xLM1p8QaxE:SlSWB9vsM3ymx5PHAIgoxvN/yvN+8rE
                                                                                                                                                                                    MD5:2404265F8DE1F7D7745893DD4752BA1C
                                                                                                                                                                                    SHA1:C07E7F72DBDC7F5F746385523EA733C2714F5DA2
                                                                                                                                                                                    SHA-256:C203E94465BD1D91018FC7670437226EF9A4BB41D59DDE49095363865CA33D00
                                                                                                                                                                                    SHA-512:5C20834542B74041AAB1DBE35686781B32EEB5814B1A35A942E87D1FC3B6D8F9264CB90433C44A480EA86DDEA65D8C152F41CE3E983C1DE5FA74D6FB5208F701
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/Vatican) $TZData(:Europe/Rome)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7930
                                                                                                                                                                                    Entropy (8bit):3.8193566380830273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:8F6zq+gH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:8ozE41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:6A3A8055DD67174E853C7A208BABAC9B
                                                                                                                                                                                    SHA1:64445543DE9D6C01FA858442976E249E37BE23EF
                                                                                                                                                                                    SHA-256:A8165313C9B51DAEF130401439CBA60DAA9887FC5EAA61A5AFD4F7BAD1AD934F
                                                                                                                                                                                    SHA-512:4407B9E8709A8DD05337A10030895AA9876EAF64EF5347952249EE2A541E304331B46D38532FD7CDFF9E633BF8C9884282F0A5ED259EBA1D99DC0914AF1A50C6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vienna) {.. {-9223372036854775808 3921 0 LMT}.. {-2422055121 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1577926800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555801200 3600 0 CET}.. {-938905200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780188400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {323823600 7200 1 CEST}.. {338940000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CE
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7485
                                                                                                                                                                                    Entropy (8bit):3.7711709848169592
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:FAhEpkwCXkSV3A/PplKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:FfWHUSKivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:1AB5FCEACC4E09074BA9F72F0B7747D5
                                                                                                                                                                                    SHA1:E0134E61EC0ADC60BF6DB4544EA7B7FFA4EC7857
                                                                                                                                                                                    SHA-256:B762DB4A068DC79FA57691E070D7026086E5A6D2FC273D5C1872E7C8E3711533
                                                                                                                                                                                    SHA-512:07565071D05CF972DD64F6060599EB68A00BF264172873BA310168AD07CE0CFCF90D0019B775433EC910DA748B89F0C614E7FD4E821993DA53C7E33F194C6A97
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vilnius) {.. {-9223372036854775808 6076 0 LMT}.. {-2840146876 5040 0 WMT}.. {-1672536240 5736 0 KMT}.. {-1585100136 3600 0 CET}.. {-1561251600 7200 0 EET}.. {-1553565600 3600 0 CET}.. {-928198800 10800 0 MSK}.. {-900126000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-802141200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 7200 0 EEMMTT}.. {606873600 10800 1 EEST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2123
                                                                                                                                                                                    Entropy (8bit):3.667144931158014
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:menvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDqR:mevCAs6kC6aZF1cSNcjXgV/ApDFjDqR
                                                                                                                                                                                    MD5:53E5BA5747B3255BB049F6FF651CEE25
                                                                                                                                                                                    SHA1:A69E2BFDB89AC8756E1CD2EAA9109ACD924A0850
                                                                                                                                                                                    SHA-256:22968D40DAC2B669E6D2BC43ED6B16C8A9CA3E1F9DACBF8B246299C3C24CC397
                                                                                                                                                                                    SHA-512:3269D20DF9C9DDFF8252F33ED563B118771FC71049542DA7C6678E0B5B75FFEA00845FA6F3BC26EDABB4BB7CE449B0B7E00B72473D8D95F126AB3893A9A969B4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Volgograd) {.. {-9223372036854775808 10660 0 LMT}.. {-1577761060 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-256881600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8662
                                                                                                                                                                                    Entropy (8bit):3.8187545871488995
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ELn9M9Nivtctwwoy4qelPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCso:E6Nivtctgq1sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:992C1D268E336AF1FB8200966C111644
                                                                                                                                                                                    SHA1:C893B82224C8EF282DB2E16A5BBCC3A21C49B6FE
                                                                                                                                                                                    SHA-256:F9DC10EC2AE2CC810A6C08837059B34BE651900BA4E1CEDB93C209972CCFB5A2
                                                                                                                                                                                    SHA-512:EC4E0D8684D57FA66144F11D8E8C80E5272D4A7304300FEBE20E236476C1B8B33BBC5E479BF96D9ED12900FE6D41DD1DC0D11CBE02B89E0C4C7A153B4BFBCB1F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Warsaw) {.. {-9223372036854775808 5040 0 LMT}.. {-2840145840 5040 0 WMT}.. {-1717032240 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618696800 7200 0 EET}.. {-1600473600 10800 1 EEST}.. {-1587168000 7200 0 EET}.. {-931734000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796870800 7200 0 CEST}.. {-796608000 3600 0 CET}.. {-778726800 7200 1 CEST}.. {-762660000 3600 0 CET}.. {-748486800 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-715215600 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-397094400 7200 1 CEST}.. {-386812800 3600 0 CET}.. {-371088000 72
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):187
                                                                                                                                                                                    Entropy (8bit):4.899266605519742
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQa5rXv1/h8Q0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNB
                                                                                                                                                                                    MD5:B07D9D3A5B0D11A578F77995A5FBE12B
                                                                                                                                                                                    SHA1:1C4E186F2D53C0A1E6A82A6D33B172E403A41D6D
                                                                                                                                                                                    SHA-256:A49B3894EB84F003EB357647D6A40CEAF6213523196CC1EC24EEFD7D9D6D3C3E
                                                                                                                                                                                    SHA-512:43520AE325980B236C47C866620D1DA200AC0CD794E8EB642D2936D4B0ECEFE2DA0A93C9559D08581B3CCE2BC75251A4D5B967D376B16EB0C042B0ADCE1DCD01
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Zagreb) $TZData(:Europe/Belgrade)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7490
                                                                                                                                                                                    Entropy (8bit):3.767302554706298
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:rnziEpkvV5lpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:rhWd50ivBeRF+W35Syrwl9h5j
                                                                                                                                                                                    MD5:CC195C2ED7DEE40A4A42C6CCF64E4DB6
                                                                                                                                                                                    SHA1:34DC86891FBAAAE0FF328D4896566C777CDF1075
                                                                                                                                                                                    SHA-256:F0045F64F64A2C40088F2960616AB8E0AABB8D6309F489FEE842056FB8412F72
                                                                                                                                                                                    SHA-512:8F58C8023260B5BBA51EE05811F33A2315A79996C900F04069372114EF3B1AB593CE7155288B8699BF2B2E9B284FE5109827B3FC8644012DB54D039E73F2B8EA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Zaporozhye) {.. {-9223372036854775808 8440 0 LMT}.. {-2840149240 8400 0 +0220}.. {-1441160400 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-894769200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-826419600 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {638319600 14400 1 MSD}.. {654649200 10800 0 MSK}.. {670374000 10800 0 EEST}.. {686091600 7200 0 EET}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7305
                                                                                                                                                                                    Entropy (8bit):3.8199799674700277
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:94hH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:9Y41sFpM5vwA6Efv03TBZLl
                                                                                                                                                                                    MD5:EBD66FAEA63E1B90122CC1EB21634ECE
                                                                                                                                                                                    SHA1:C6487BB8AB2A6A72B2170B220F383ADB6B9AC91C
                                                                                                                                                                                    SHA-256:95AFA61E439CA38551306D8FDB11C2788D935C42768D0407C9E4337F105A3E93
                                                                                                                                                                                    SHA-512:25A8D0ED9BBE6BF23A1A76CC6D5378CF4D50544AA22DA97DDCD0673D7A5CCFEFFD81B660A1AEFB254B8BBEA55F6EF734BBBD3F0CB903E0721BE107667CA1E328
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Zurich) {.. {-9223372036854775808 2048 0 LMT}.. {-3675198848 1786 0 BMT}.. {-2385246586 3600 0 CET}.. {-904435200 7200 1 CEST}.. {-891129600 3600 0 CET}.. {-872985600 7200 1 CEST}.. {-859680000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):170
                                                                                                                                                                                    Entropy (8bit):4.8978035005721265
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/wox6QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/wRj
                                                                                                                                                                                    MD5:68667037110E713DB3F51922DDE929FE
                                                                                                                                                                                    SHA1:2EB02BE3FD35F105B59847892A78F1AA21754541
                                                                                                                                                                                    SHA-256:E20D829C605A7C5B2A96B83C3480DF28C964A13381A8BD2C72C2A37295131FA7
                                                                                                                                                                                    SHA-512:3A8CC2EC9E3053283F996CA2C4B422061D47F1D16CA07985CBA2C838DF322C23CC9DD28033646F22EAE0E401781480B9D3AF82A539444166A4DD9B7BCCAE45FE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:GB) $TZData(:Europe/London)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):175
                                                                                                                                                                                    Entropy (8bit):4.90874180513438
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/w4b/h8QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/w4E
                                                                                                                                                                                    MD5:625520BAAB774520AC54BFB9EDCF9FCA
                                                                                                                                                                                    SHA1:C72F0FD45F448901C6B2E24243175729591B9A54
                                                                                                                                                                                    SHA-256:C9334480D0A970254B6BA6FF22E958DC8DD8BF06288229461A551C7C094C3F1D
                                                                                                                                                                                    SHA-512:1B672218FF9C86168E065A98C3B5F67DAB710D1C2A319E9D6599B397C4B4C00D3721B76C735C8AB04BCB618C1832B07F6CCDAF4266CC0D12A461A3A862D1AEB2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:GB-Eire) $TZData(:Europe/London)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                    Entropy (8bit):4.867609984313873
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wZ8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wZ8RQy
                                                                                                                                                                                    MD5:A01FE6FC260711F0E11C85DC3DE3550A
                                                                                                                                                                                    SHA1:988311B71498591425C63669DC3F802F270B2C44
                                                                                                                                                                                    SHA-256:747C15CDC239855D5380B7A7F47112F2A26C61B0BF300EEB9711E6521550D189
                                                                                                                                                                                    SHA-512:BE4678DCBAE5DBC72865665413206C1909F28BA54F4943257870EFFBA6525457866DED7A985E89F2689C810B314DE4AA2FA3A0A1826A664727F5F7113AA56595
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):155
                                                                                                                                                                                    Entropy (8bit):4.917182390229381
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/we7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wI8RQy
                                                                                                                                                                                    MD5:3327B1BF3118AC6AFC02C31DF5B67CD9
                                                                                                                                                                                    SHA1:3932577E66801AD31519B0BB56CCE7B9E36221A9
                                                                                                                                                                                    SHA-256:BE48462CCFBB3AEE19597F082A17C2C5D2FD8BB1C9122245EFAB0A51F8F413B0
                                                                                                                                                                                    SHA-512:53866FD513B039E8203E51FF3434D5736D3A4C4E0A46874D1C99A17115181AF749F0D079C2E14C5B0538D3DFA52B1645C977CD6599DA3EDA57CC7F84EEAB2D06
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT+0) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):155
                                                                                                                                                                                    Entropy (8bit):4.904279164422928
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/w4Hp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/w4J8RQy
                                                                                                                                                                                    MD5:0CFFC5655F031D954BD623CC4C74DC9C
                                                                                                                                                                                    SHA1:CE5E7AD67252F52D7E70719725FF5BE393DD6EF0
                                                                                                                                                                                    SHA-256:944C86F516141DDC3AEC1AE4A963E9769879C48ED12DADDF4ED63A01313ACD00
                                                                                                                                                                                    SHA-512:C7352D1394E8B8AC90CD19EE753D5277259BE5512ADDCAED2A2DEF144762CF20BE7A9FA09AAA1829EE401DD195C2AED8C967A7FF46739236E042AF4298EC84A2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT-0) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):154
                                                                                                                                                                                    Entropy (8bit):4.892526720357546
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wPHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wvp8RQy
                                                                                                                                                                                    MD5:565B41A5DB28F9FE7D220E9BA39062A4
                                                                                                                                                                                    SHA1:5183689210F07C8A71F880DCE8E5C2CB62CEB17D
                                                                                                                                                                                    SHA-256:54850A5F488205DB01FBB46E2DA9FFF951C4571029EA64D35932DDEA5346DAAF
                                                                                                                                                                                    SHA-512:BD6E5141F06B03D62DCF725E9E48D6AA8ECD6E8E47A4015B25DC3F672392065FFFD80D688C6695324DC105EA528025CF447FA77E6D17E15D438E61DC51879CB7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT0) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):159
                                                                                                                                                                                    Entropy (8bit):4.917976058206477
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wE+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/wE6BURQy
                                                                                                                                                                                    MD5:443FA76F107ED438F9571A044B848C6A
                                                                                                                                                                                    SHA1:1CF508429DFC40643B1FAB336A249A3A287D8C7C
                                                                                                                                                                                    SHA-256:9E7A8DAA26CE36E8F7D7F13460915C063EE98E2A4DB276AD9D15CA5C7C06815F
                                                                                                                                                                                    SHA-512:6C0C5FF513A742FBDA349AC3A2581D456701B5348A54ECF38E496DAA1EFC74D937982B6F69F1761CC2FC4B88D9A971EFA2B16096E71EAF002EC5CE4130B533DE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Greenwich) $TZData(:Etc/GMT)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):111
                                                                                                                                                                                    Entropy (8bit):4.90682088010982
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x//LhdNMXGm2OH1V90v:SlSWB9eg/jJDm2OH1VGv
                                                                                                                                                                                    MD5:79C82A5F8B034E71D0582371E3218DBB
                                                                                                                                                                                    SHA1:1476CE8EA223095094B6D25D171E6319C96669F4
                                                                                                                                                                                    SHA-256:8D710699AF319E0DDB83E9F3A32D07AE8082EA2F7EABBD345EFFFFB0F563062E
                                                                                                                                                                                    SHA-512:ADEE55581D1A158929F09A63B03883ABE9193337DDF225C61AFDBB8A2C7D0BD248ADC4714E0EEFD334826C54C1AFFC8B1E6C2B0D6EF830C3CCA50CC79834F473
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:HST) {.. {-9223372036854775808 -36000 0 HST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179
                                                                                                                                                                                    Entropy (8bit):4.913328649996328
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8Li0vXHAIgN2qfvRL//XF1p4WFKQyvn:SlSWB9vsM3yW2HAIgAOvN///p4wKlvn
                                                                                                                                                                                    MD5:6A307B229C302B1BAE783C8143809269
                                                                                                                                                                                    SHA1:EA169AF81AD12380A69FB6B7A12479BA8B82878B
                                                                                                                                                                                    SHA-256:359C9C02A9FA3DE10BA48FA0AB47D8D7AFF3B47F950CFAF5EB68F842EA52AB21
                                                                                                                                                                                    SHA-512:505445FD0B3E140384EDC27993923BBF9ACD23A244B0F14D58804BFAA946D0BC4C0D301FBCCB492BAFDA42C8A92F4163FB96F4D75DD7374858D1C66183BEC24B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Hong_Kong)]} {.. LoadTimeZoneFile Asia/Hong_Kong..}..set TZData(:Hongkong) $TZData(:Asia/Hong_Kong)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.888934660651573
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqLGsA/8rtyXHAIgvMGsA/8rJARL/+GAKyx/2RQqGsAW:SlSWB9vsM3yj6SHAIgv1sAN/+XZx+RQK
                                                                                                                                                                                    MD5:F51C5B80789F65136304CE107E4E60E1
                                                                                                                                                                                    SHA1:3F4690BCCA45C0ADEC184175DEC53730C326733C
                                                                                                                                                                                    SHA-256:E4AB3A08ED590D907F9741D4B8FE27E552B19FE0257F14CE2ED5289D5685974C
                                                                                                                                                                                    SHA-512:9D0BB2D8C9D42C3F7274E0831B4320023069A7DF2069AA5EB6FF1BBBF5781629020BBB70C9ECCC38955FC79A5E2CB3110AB90C21191A6FB421F3195C31FC984C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Atlantic/Reykjavik)]} {.. LoadTimeZoneFile Atlantic/Reykjavik..}..set TZData(:Iceland) $TZData(:Atlantic/Reykjavik)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.807410166086502
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6EL/liEi2eDcVVMB:SlSWB9vsM3y7VTHAIgNTxcAN/+LzM2eV
                                                                                                                                                                                    MD5:0F20CBF1F7600D05F85D4D90FDAB2465
                                                                                                                                                                                    SHA1:2F3C9479C4F4CD7999B19C07359B89A5FB1B9839
                                                                                                                                                                                    SHA-256:1B1177CE4D59D7CBCAE9B0421EB00AD341ECB299BD15773D4ED077F0F2CE7B38
                                                                                                                                                                                    SHA-512:657341FC2CCD6A4F7B405ABC8E24C651F6FFEFD68EBD6E2086ADF44834DCBF21D1B9D414436E42C8DCE46FFB88116B98C1D073782E214B3996D49EC00DFF4383
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Antananarivo) $TZData(:Africa/Nairobi)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.853088038233057
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL9WJx3vFNMXGm2OHi/FvoHscfJ7XH0VQVFV6VVFSTVV:SlSWB9eg/+LxWJxPDm2OHqFvoH9+VQV3
                                                                                                                                                                                    MD5:06143C3DFD86B3FE4F2A3060C0E05BB6
                                                                                                                                                                                    SHA1:88E0E30CEE4AB8117860A35AD03B16AF48988789
                                                                                                                                                                                    SHA-256:11044AD7CB0848CC734D2A67128AA6AC07CB89268399AA0A71A99024DE4B8879
                                                                                                                                                                                    SHA-512:79195D3D0D475BEA982F40683D4BA14AC33B3FA91311F513DCED955C9297C2B0F12D94CCA930FAE0FB7F95DB34CD4E74B5AF0233E792122646592B7EFF0F3163
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Chagos) {.. {-9223372036854775808 17380 0 LMT}.. {-1988167780 18000 0 +05}.. {820436400 21600 0 +06}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):154
                                                                                                                                                                                    Entropy (8bit):4.957836950238227
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL9FBIEW3odNMXGm2OHAWMx5oHvTLyvMVSYovV:SlSWB9eg/+LxpW3SDm2OHAnx5oHvTIMI
                                                                                                                                                                                    MD5:DA36A8158AF3480E67CD6EF3ABB875E3
                                                                                                                                                                                    SHA1:9DA259BFB6B39AB0425E67A1E4F1ECAA1321AD72
                                                                                                                                                                                    SHA-256:CB43DEAFAD0F8BF7DE8567841790A58D358EF2B210BB2022686B3EB7F97B2E5B
                                                                                                                                                                                    SHA-512:48B20BFD14B0C756CD3AAA9A422837D7D5012612294EB01EBF12A26D0147D85087DED1B95C3E5CAB1485E8BC3B19A69B9DB234D06562AD0482CB7518977256BE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Christmas) {.. {-9223372036854775808 25372 0 LMT}.. {-2364102172 25200 0 +07}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):152
                                                                                                                                                                                    Entropy (8bit):4.861380366254495
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL9dsFNMXGm2OHGXTvxoeoHvmVUXxXW5d6TW7Ay:SlSWB9eg/+Lx2Dm2OHGXCeoHv3BG5UI9
                                                                                                                                                                                    MD5:4D5285269D6F0A54495B10EEF4994E01
                                                                                                                                                                                    SHA1:FEE44907B02B660390CFDC560E3981112D5774BB
                                                                                                                                                                                    SHA-256:71194B896CC00967EBBE3F9F4609F8C5CD73CE56B2529646A7A6AC679BB03400
                                                                                                                                                                                    SHA-512:068D29EA51465A5232724A0CEF0274FD5DFC16A44720823CEA470125129FF527BF411EDAAFAEBE5F9783334BD93DB92372D0847207E4A42C79A0F6158163F1C8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Cocos) {.. {-9223372036854775808 23260 0 LMT}.. {-2209012060 23400 0 +0630}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):184
                                                                                                                                                                                    Entropy (8bit):4.825881690094318
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6EL9TKlBx+DcVVMB:SlSWB9vsM3y7VTHAIgNTxcAN/+LxGV+V
                                                                                                                                                                                    MD5:7EBDFA311C7852AFADF880395071DE48
                                                                                                                                                                                    SHA1:F6EC21FDFB75EC1BE45B1C4170147CBA3E870E7B
                                                                                                                                                                                    SHA-256:53FA58E32DC2E4ABB574B2F78011815EEB7F89F453CC63C6B6C1460ABBB4CA5C
                                                                                                                                                                                    SHA-512:DFBCD4EA4AFFA1D1CAE7308168874527FD36B5CAE76153AADA9C5E5F628258AB26654A16C8A5F8906FC5918398FD880B15B6DD4E3EF6AD3BE63D4A2455701FA8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Comoro) $TZData(:Africa/Nairobi)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):149
                                                                                                                                                                                    Entropy (8bit):4.871582172327986
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/+L6EL12h2FNMXGm2OHvavFd9vM0VQVFv:SlSWB9eg/+L53XDm2OHEd1nVQVV
                                                                                                                                                                                    MD5:5D07EBAAF83E8E473C23142CB09A05BF
                                                                                                                                                                                    SHA1:34FD76789085EB6336193889D8FB5A8B3142383E
                                                                                                                                                                                    SHA-256:C7AFDE6978D8CE5413730D370E2776E2ACC7D96570A6034EB504C0F42CA5D1E7
                                                                                                                                                                                    SHA-512:FC5613EFC3B8EFA3553ECD3232383FF4CF5F4D777A1E46C4D212080711EA33F38A59449F828C6E33CB1F359249F254B4869AFD8F434FBD5213E657732D832777
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Kerguelen) {.. {-9223372036854775808 0 0 -00}.. {-631152000 18000 0 +05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):149
                                                                                                                                                                                    Entropy (8bit):4.942285614866899
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/+L6ELzJM5FNMXGm2OHuVdF+YoHscfNmHIRNVsRYovV:SlSWB9eg/+L/YDm2OHWgYoH9YHkSN
                                                                                                                                                                                    MD5:ECA9671460E65583ADF4892E40F2402E
                                                                                                                                                                                    SHA1:6E5DE51DD1FB619E33254F5967647A77A5D7C496
                                                                                                                                                                                    SHA-256:8E1D0F7268A5EE75E8A7C17FD6E1A9880BAD18A612346C29D70B462024D7371E
                                                                                                                                                                                    SHA-512:CBD970D789943120B8DE5A166B97ABC7E221F7692DE26FC5523FB0D76C4BF9D10F541778ED1ABB7A3B9529547C20B804B702B7221516970B7B3225A87682AC93
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Mahe) {.. {-9223372036854775808 13308 0 LMT}.. {-1988163708 14400 0 +04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):183
                                                                                                                                                                                    Entropy (8bit):4.883092265054605
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/+L6ELzE5FNMXGm2OHnz8eoHvZT5lxV/uUQwGN0VQVFv:SlSWB9eg/+L/EJDm2OHnz8eoHvZT5rdI
                                                                                                                                                                                    MD5:4DF975C040D78FA8F9C92E5565D63A73
                                                                                                                                                                                    SHA1:48488F076871530D32278084F1C9CB90CB1E6AB4
                                                                                                                                                                                    SHA-256:9FAC69DC609CC6074ECD67E0BE8AE62E33D8D9C7F055A3E0DEE1430C7FFC54F6
                                                                                                                                                                                    SHA-512:880B920FB51F48731BA8C741B9583038A3276221C55F1CE0B464D2797D71EF9D22B4E166841BAB0544B7091CE683697BFCA5A4235FF1E6264B0619DBDD4BB619
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Maldives) {.. {-9223372036854775808 17640 0 LMT}.. {-2840158440 17640 0 MMT}.. {-315636840 18000 0 +05}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):272
                                                                                                                                                                                    Entropy (8bit):4.5144164346164715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/+L/GDm2OHlNnoH9SvulvSNFF+c0FSFFMVhvSNFFVBjvVFSFFVGlvSN:MB86+L/CmdHlNnCy6qB0FScZq9BjVFSL
                                                                                                                                                                                    MD5:05362B6A17C5F4F4E8CBE5A676D5D0DE
                                                                                                                                                                                    SHA1:84675D5E8D1425A5E9DB07D1BC1E6A5921B5AC91
                                                                                                                                                                                    SHA-256:A2B1B93CBEECBD900ED71E61A4932509EB52688E97A6015DAD067066D0D42072
                                                                                                                                                                                    SHA-512:351D2BC5F5888D8E842BF160D11D57E059811186D63B0413061768C7FE348CECB700748A0C0125F0ABCBB039FC74FF7BEEFDD42088BA1E28C785E545ED2CDF24
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Mauritius) {.. {-9223372036854775808 13800 0 LMT}.. {-1988164200 14400 0 +04}.. {403041600 18000 1 +04}.. {417034800 14400 0 +04}.. {1224972000 18000 1 +04}.. {1238274000 14400 0 +04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.828945679595274
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6ELzO1h4DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/+L/O1hm
                                                                                                                                                                                    MD5:8ABBEC0E138C1A68CB5D096E822DE75E
                                                                                                                                                                                    SHA1:E9C5CE1A249F6DC0F6EDBB3F5B00F3106E3BD6CA
                                                                                                                                                                                    SHA-256:845C45FD7B6F0604B03A3C72DB117878B568FB537BCA078304727964157B96AB
                                                                                                                                                                                    SHA-512:15790CCA70140D3139F3E2A202DC8F12E68466A367C68458D6A78CDDC7822FB5EDB87D630926B51F3DE48D95DE7CA3FCB946CD7B762FE5B15866DAA9DBA40B46
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Mayotte) $TZData(:Africa/Nairobi)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):152
                                                                                                                                                                                    Entropy (8bit):4.978742383555601
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/+L6ELsAcCFNMXGm2OHuU7oeoHsdvcUeNVsRYovV:SlSWB9eg/+LBXDm2OHb7oeoHTfNSN
                                                                                                                                                                                    MD5:A03BEEC3F4CF0F6E1077A04C67CF3375
                                                                                                                                                                                    SHA1:4C39038341E26C2E68F2E46AD243A0955098F149
                                                                                                                                                                                    SHA-256:E039B16CAAB8F5D8F85625E0CC1D0FE42369715F2A4810BDF7F9CF19A28B5603
                                                                                                                                                                                    SHA-512:B23C6C28FEE0A8CA93DB2928A9AC97DD8475B7C1FC6DCB70E696F066D67DF4FF0285D7631400DEDD780C4B5F868B194CC59108FCFA519473D1ADDEC36CC53262
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Reunion) {.. {-9223372036854775808 13312 0 LMT}.. {-1848886912 14400 0 +04}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):166
                                                                                                                                                                                    Entropy (8bit):4.809541513808179
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8g5YFeovXHAIgNqjyVHRL/+XiMr4WFKBpv:SlSWB9vsM3yA5oPHAIgcjeHN/+Xvr4wY
                                                                                                                                                                                    MD5:A90C26358FEF60E49044E3BE02866FAC
                                                                                                                                                                                    SHA1:137AC8CCA23F39E7A16C4050EA9A3A8731E9AAD7
                                                                                                                                                                                    SHA-256:FE7F4453CB5F6B81B23C1C795356B91FE319F0762BE7868FAFE361DB1F9C2A2B
                                                                                                                                                                                    SHA-512:D6C74CACF69D29E14CB46E5DD885234AC50EE2E258E0C5E3AC76465061622F064F974D33E91A6A020B9D618D90799DDA6EB1EA53022EDB6E26A9CB6ADFE0AA30
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Tehran)]} {.. LoadTimeZoneFile Asia/Tehran..}..set TZData(:Iran) $TZData(:Asia/Tehran)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):177
                                                                                                                                                                                    Entropy (8bit):4.8290104377288925
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/+WXnMr4WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/+zr4wKY+
                                                                                                                                                                                    MD5:6BCC43951637D86ED54585BE0819E39C
                                                                                                                                                                                    SHA1:6F04F306B3AB2A6419377294238B3164F86EF4A3
                                                                                                                                                                                    SHA-256:805105F5F17B78929F8476BAE83ED972128633FF6F74B7748B063E3C810C27A6
                                                                                                                                                                                    SHA-512:ABB9F4308BF4BD5C62C215A7ECD95042CBFB3005AF1E75F640962B022574C930DD5A12CD0CE0AF8A3D7E38B999E37C3A45A55091683F6A87E9D0CDA9EE417293
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Israel) $TZData(:Asia/Jerusalem)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181
                                                                                                                                                                                    Entropy (8bit):4.722012123002917
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx00EIECWXHAIg200EIE/vHRL/9S//2IAcGE0EIESvn:SlSWB9vsM3y795VHAIgp95HN/029095c
                                                                                                                                                                                    MD5:1F020341AD51AA82794B8018F214DE0D
                                                                                                                                                                                    SHA1:4414E56C1277B4D31FE557F8652D522C0594F4B2
                                                                                                                                                                                    SHA-256:F01B00D52BD7B2694BF5CB55A17028C30A41BD22A774CA54740E8B1DDE4FCB2E
                                                                                                                                                                                    SHA-512:CC41848A851D4992AE9F27C38669CB87CE2FD05A33AB6989EA21AFCB1A2707DE0CB4D62BCC45E536DD944859991D7564847205F47509A42D41932370496A77D7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Jamaica)]} {.. LoadTimeZoneFile America/Jamaica..}..set TZData(:Jamaica) $TZData(:America/Jamaica)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):164
                                                                                                                                                                                    Entropy (8bit):4.8422204749795545
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8aofXHAIgNqsRL/9hM7/4WFK9vn:SlSWB9vsM3ypPHAIgcsN/4r4wKNn
                                                                                                                                                                                    MD5:9554A65BFFCFFCFB2C1588569BB4638E
                                                                                                                                                                                    SHA1:B377ECB04586396D37093856AEF8BBDC93192F66
                                                                                                                                                                                    SHA-256:98DBD07AE3B9251B9091F4D265336CE98BDFB492AF863C1F3FF25248A2CADF35
                                                                                                                                                                                    SHA-512:E2E761B8B1995B68721BC714A546E0F45EEC025FAF81DE579FF0D73D37783D0E031B9E78BA2FAC6B097E3673C47AFB8761FBC58E42E33018FD44B77F2871E0C6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Tokyo)]} {.. LoadTimeZoneFile Asia/Tokyo..}..set TZData(:Japan) $TZData(:Asia/Tokyo)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.810216093939366
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG1/EOM23vXHAIgObT1/EOMH6RL/8/FMKpUDH1/Ex:SlSWB9vsM3yc1EiPHAIgOb1E+N/8xMEx
                                                                                                                                                                                    MD5:05C0C40F2AA456F580EAAFC4F7E49B56
                                                                                                                                                                                    SHA1:5796A9122693B2D6010BC5E617A6091F46330B0C
                                                                                                                                                                                    SHA-256:85E95363ACF468043CD5146927A97B2D9E3B141EDA0A7993DADA9382D1D6DD54
                                                                                                                                                                                    SHA-512:2155F8E3EB73312F0AFD5CDDF4B19EBB67A15658101870C2CEDF96955470DBC7B30F34E143D9C14CBFA7A138F63324009581BD0B807AE295C68588CA0470D7AD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Kwajalein)]} {.. LoadTimeZoneFile Pacific/Kwajalein..}..set TZData(:Kwajalein) $TZData(:Pacific/Kwajalein)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):176
                                                                                                                                                                                    Entropy (8bit):4.829980800076139
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqsbKJqYkyXHAIgNGEnKJp0ARL/7beDcbKJ6v:SlSWB9vsM3y7JSHAIgNTxAN/PeDE
                                                                                                                                                                                    MD5:4D44D88336212E162CCEFADE6321EDBC
                                                                                                                                                                                    SHA1:B9EE7AFE26DC61AA9EA37EB99A3C10DD176E8063
                                                                                                                                                                                    SHA-256:F776839C1999056E6A0D2ECFDF9054FC309454AFDFF8E8BC803F33EC423B7361
                                                                                                                                                                                    SHA-512:FDDCBD194DE07B51DEBBDEF4FD96762EE3507117443FB9F7975FB56E0AE97B0D1F8657FE26B092021FB12B5A5D3EFFAB9E0A54B1C2AFCEC1029855442A0A95AB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Tripoli)]} {.. LoadTimeZoneFile Africa/Tripoli..}..set TZData(:Libya) $TZData(:Africa/Tripoli)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7736
                                                                                                                                                                                    Entropy (8bit):3.799706947156251
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:aJCP8D3pCS2JWk55EyqJNSPTub3NDOyFyJYVtLbTxdqs0xcQVq+O7JSAmwQZjltB:FSyWBSPTujlOyqc3JuzVNvTN
                                                                                                                                                                                    MD5:02B993B4A6956014A2DB844E8A5498C0
                                                                                                                                                                                    SHA1:378333547254AC43BEB4FA2CBC24B8DE241B3078
                                                                                                                                                                                    SHA-256:DF45F5414F1636B1856C7534BB5F3D4387C32D56283A68BB47D8C48C1DDAD5BC
                                                                                                                                                                                    SHA-512:CC3ABCC1FB5ABD10A685F140931DE38D6875142D3595F8D9A581F5B31A7F354FA4CCC9727B69F58E0D2F773EA0F76D9ACFDF7ACBAFC6BAA6E93A46EAE8F18672
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MET) {.. {-9223372036854775808 3600 0 MET}.. {-1693706400 7200 1 MEST}.. {-1680483600 3600 0 MET}.. {-1663455600 7200 1 MEST}.. {-1650150000 3600 0 MET}.. {-1632006000 7200 1 MEST}.. {-1618700400 3600 0 MET}.. {-938905200 7200 1 MEST}.. {-857257200 3600 0 MET}.. {-844556400 7200 1 MEST}.. {-828226800 3600 0 MET}.. {-812502000 7200 1 MEST}.. {-796777200 3600 0 MET}.. {-781052400 7200 1 MEST}.. {-766623600 3600 0 MET}.. {228877200 7200 1 MEST}.. {243997200 3600 0 MET}.. {260326800 7200 1 MEST}.. {276051600 3600 0 MET}.. {291776400 7200 1 MEST}.. {307501200 3600 0 MET}.. {323830800 7200 1 MEST}.. {338950800 3600 0 MET}.. {354675600 7200 1 MEST}.. {370400400 3600 0 MET}.. {386125200 7200 1 MEST}.. {401850000 3600 0 MET}.. {417574800 7200 1 MEST}.. {433299600 3600 0 MET}.. {449024400 7200 1 MEST}.. {465354000 3600 0 MET}.. {481078800 7200
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):111
                                                                                                                                                                                    Entropy (8bit):4.902637155364683
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/6xtNMXGm2OHrXV4foAov:SlSWB9eg/6lDm2OHrCAAov
                                                                                                                                                                                    MD5:36119516E87814F3C219193069CD6A90
                                                                                                                                                                                    SHA1:BDB25531B30E6FC454100F37177EC9D4A0FB4E39
                                                                                                                                                                                    SHA-256:E57746D5DB479A8B30973F2BC16E2B8DFB6E2BFAECBFF0FB956F04526E4B935B
                                                                                                                                                                                    SHA-512:2730C5DABA0B2CCFD32A799C48EE07351659F51B9C2B91DCD145675AF276F2D0B5AA51ACF7D283C0DC236D3AFA3A75E58EB9F970B1831A6E36F02139CAF6A655
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MST) {.. {-9223372036854775808 -25200 0 MST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8505
                                                                                                                                                                                    Entropy (8bit):3.8405400251137207
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:T1ktwmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:TswDPlLv/PCenJzS6cy
                                                                                                                                                                                    MD5:87B3BCD4A793BA383889ECFDB44C846E
                                                                                                                                                                                    SHA1:3EA34B5E6E3078A9501653BA069D5E5E879D7FE4
                                                                                                                                                                                    SHA-256:A5DEB89D59613D9A54C1E146056A805B3DE9F2A2593AEC2B8A25F863328699C0
                                                                                                                                                                                    SHA-512:AA4DAC2614661EF18A2A60A5BD4D5BBBCCB5D721F90A25E9D11C5B6AF8C39FD475B3E23894719E2F8F74469F13D5492FF31DDD193D9E3172182FBCBCDD860A41
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:MST7MDT) {.. {-9223372036854775808 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1 MDT}.. {247046400 -25200 0 MST}.. {262774800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.884776849010803
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0qfSfXHAIg20qfORL/6AdMSKBbh4IAcGEqfBn:SlSWB9vsM3y7ekHAIgpeON/68K5h490m
                                                                                                                                                                                    MD5:3050A0100A2313C1D3AB4278B464F17A
                                                                                                                                                                                    SHA1:1A140447B3972900F13768659FD6979F68126E97
                                                                                                                                                                                    SHA-256:F8CA38A845CD01BF785EE222277DAD9325AB6BD17E44A362C450855AEB522814
                                                                                                                                                                                    SHA-512:C91C4BF2318C50D473E6051855C12F0E11CBAA8580B88115CDDE054D36476A1D8DDC5D17A7A123BD84148C20B96BD839511EAD573F5FD2C9A8556646B9CDE5E5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:Mexico/BajaNorte) $TZData(:America/Tijuana)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):191
                                                                                                                                                                                    Entropy (8bit):4.8897674180962145
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0zjRJ+ovXHAIg20zjRJ8yHRL/6AdMPCoQIAcGEzjy:SlSWB9vsM3y7zjRJvHAIgpzjRJ8yHN/Z
                                                                                                                                                                                    MD5:FAFD9727A0E153AFCB726690D215DA76
                                                                                                                                                                                    SHA1:3CD3B2737FC781F38DE26E255968CBB88B773CBF
                                                                                                                                                                                    SHA-256:2E6E32A40487F0146B59150B66FF74901CA853B12D47922819AF23EEA5B4149C
                                                                                                                                                                                    SHA-512:76D110494D4EB76961C818B2A2CCB2303B31DA161664FA712C87B95B81DE7B8F3E50DC7B2836C6ECC6437AE9595668E62E4E706F1B343EFEA12C32210F113540
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Mazatlan)]} {.. LoadTimeZoneFile America/Mazatlan..}..set TZData(:Mexico/BajaSur) $TZData(:America/Mazatlan)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):200
                                                                                                                                                                                    Entropy (8bit):4.877941255622543
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y7zBDSHAIgpzBx6N/6BXl490zBf:MByMYzppzH6t6Bi90z1
                                                                                                                                                                                    MD5:29ACBFCD0FD521EC0C9523906B9E2252
                                                                                                                                                                                    SHA1:BBC1AD3F78CAA634A2F0BC38059975EF8E4A2CE9
                                                                                                                                                                                    SHA-256:2DFF1B83FECFAD5C27EC47B206696C29B91398F8185B5D406A66FA9E0AECA93F
                                                                                                                                                                                    SHA-512:802502010CFB6F1F4E60C22ECB0E6CA22750975E5838BE7E7DC9D12EA019CB6508F0F87465A113A98356CC9E145E32E6633AE2B45B93412A358C4AD13E923EFE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Mexico_City)]} {.. LoadTimeZoneFile America/Mexico_City..}..set TZData(:Mexico/General) $TZData(:America/Mexico_City)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179
                                                                                                                                                                                    Entropy (8bit):4.888611285267583
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG/u4WXHAIgObT/KvRRL/5E1nUDH/uov:SlSWB9vsM3ycqXHAIgObOvRN/iy
                                                                                                                                                                                    MD5:92548E239012515D756E002768CA876A
                                                                                                                                                                                    SHA1:6BDC73DBD7356C3F82C5C76E6E2D58656FA9E21D
                                                                                                                                                                                    SHA-256:E22D629D53C54960AD156C377DE0AE461C27F554990A3D1305724CA8F869BCE4
                                                                                                                                                                                    SHA-512:42AD074EE08E083EE91270F203707698A8B3308005C94514B8B2D950F4C6F0B37D7D32973EC9F6AB49A0875209076FB40341B31433A27E47B3CC0EA711ECE321
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:NZ) $TZData(:Pacific/Auckland)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):181
                                                                                                                                                                                    Entropy (8bit):4.881663364410736
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG9WQ+DyXHAIgObT9WQiovRL/5AmtBFB/pUDH9WQg:SlSWB9vsM3ycwQ+DSHAIgObwQTN/zzJ7
                                                                                                                                                                                    MD5:3811C133C6311E33FDAF93660E1EAED5
                                                                                                                                                                                    SHA1:64756FF877B2EB91BAED2889B3924DAB6784DF43
                                                                                                                                                                                    SHA-256:83F4CA3522B64F9B151EDEFAE53E0F28C2E6C4CE16D0982186B3344F2A268724
                                                                                                                                                                                    SHA-512:7724D6CD08E13E116CCDF073F86CE317C0D4A849C5FE81DF3127D435704507FBF554BFC6E7A50CCA3852F6001D8654B7FF90466878DB8C3298338BE16149FD32
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chatham)]} {.. LoadTimeZoneFile Pacific/Chatham..}..set TZData(:NZ-CHAT) $TZData(:Pacific/Chatham)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):177
                                                                                                                                                                                    Entropy (8bit):4.8545620422964015
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/5vf1+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/pd+90+B
                                                                                                                                                                                    MD5:5E9F3294F68873BF503F3DDDDF6713B0
                                                                                                                                                                                    SHA1:954CD6F123C043E64F5E49733327E2C78877BDFB
                                                                                                                                                                                    SHA-256:2CC8CE235F2EE3160E6AFD04A4E28AA0312494EBB6FED08D8CC81D414EC540EE
                                                                                                                                                                                    SHA-512:200FC489989CA57219D5B28FB135BE5BDAC67239F3D243C496545D86D68089E51856CEAC4D2E700C0E47BAE4D5FEAB18A367C554235615B2B860F4E5E1BB08C3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:Navajo) $TZData(:America/Denver)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):171
                                                                                                                                                                                    Entropy (8bit):4.902914099699953
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/nL75h4WFKdy:SlSWB9vsM3yMPHAIgO8AN/H5h4wKU
                                                                                                                                                                                    MD5:87C439DC623BF5C7EB01ADA6E67FB63A
                                                                                                                                                                                    SHA1:1CC357558E09CDEA49F821826D2AEA9A6EF2C824
                                                                                                                                                                                    SHA-256:6A5BAA9CA54B2A2C6D21287443BE0B1064AA79B5C4C62939933F8A0AD842B73E
                                                                                                                                                                                    SHA-512:E628B8F1C967AABAEFBB68A33416F6FE47422970BA18414BB3396AC063E65A4DC892595D4071395194AF320633EE915A494E1F8D4216EE8194A034739D275C49
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:PRC) $TZData(:Asia/Shanghai)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8505
                                                                                                                                                                                    Entropy (8bit):3.836877329152454
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:0KhTG0hjvZkR/bvtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:0sG0U9bFzN6IkWq/WHQt/RY4yP
                                                                                                                                                                                    MD5:45E7E9E183A990F56E17C04FA48CE620
                                                                                                                                                                                    SHA1:A1F39E0ECEA3C64E761A9A3159E331FA51B625F9
                                                                                                                                                                                    SHA-256:D148708F1E70EEFA51E88E5823776CBE710535D4D6D6356E7753A44463A1C5AB
                                                                                                                                                                                    SHA-512:1D1F4BA90D07D7EE12DFD0E37DBFD5410A4EAFFBA8960B816FDD5963CD6B20938080A4248E7B249AAE02F068E817AB9A85735D226F7DA8DD2C5462A70B18E8EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:PST8PDT) {.. {-9223372036854775808 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-84376800 -25200 1 PDT}.. {-68655600 -28800 0 PST}.. {-52927200 -25200 1 PDT}.. {-37206000 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):909
                                                                                                                                                                                    Entropy (8bit):4.042826306713664
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86HbmdH2oVCvcCfdf3NaDyTb6Dye78ubUt1NEUtszIVbUtoUtoUt3mbUt4qUt6:Yekv5fcfem+Cuy
                                                                                                                                                                                    MD5:E5B913965F72AB807BAE67BD20C0A699
                                                                                                                                                                                    SHA1:2161B73EC868C8D18C09970766D19A8583FF7981
                                                                                                                                                                                    SHA-256:983884249ACC11C3FE740D78E72B1A89BE9C8B077283549BF6BCD8C93FA71731
                                                                                                                                                                                    SHA-512:F8807C52DB852C48C62F25569C990C31D977BC7D0DF502CF2B92F9ED6BCB89A6DD8A6758FBD1185E0B5C34DE5450D5C748B71760AC93E72DC3976B3B31D1A605
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Apia) {.. {-9223372036854775808 45184 0 LMT}.. {-2445424384 -41216 0 LMT}.. {-1861878784 -41400 0 -1130}.. {-631110600 -39600 0 -11}.. {1285498800 -36000 1 -11}.. {1301752800 -39600 0 -11}.. {1316872800 -36000 1 -11}.. {1325239200 50400 0 +13}.. {1333202400 46800 0 +13}.. {1348927200 50400 1 +13}.. {1365256800 46800 0 +13}.. {1380376800 50400 1 +13}.. {1396706400 46800 0 +13}.. {1411826400 50400 1 +13}.. {1428156000 46800 0 +13}.. {1443276000 50400 1 +13}.. {1459605600 46800 0 +13}.. {1474725600 50400 1 +13}.. {1491055200 46800 0 +13}.. {1506175200 50400 1 +13}.. {1522504800 46800 0 +13}.. {1538229600 50400 1 +13}.. {1554559200 46800 0 +13}.. {1569679200 50400 1 +13}.. {1586008800 46800 0 +13}.. {1601128800 50400 1 +13}.. {1617458400 46800 0 +13}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8772
                                                                                                                                                                                    Entropy (8bit):3.900078030355782
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:pj4hKuZaqaaiFKgjGeGV3atL67G9kJGsU+mpe7Vy:Cla1KgjGeGcQMsa
                                                                                                                                                                                    MD5:8174D7205622711F58E0B515246FE89D
                                                                                                                                                                                    SHA1:9777B2633ACF5588268D5072F817E65C879358AC
                                                                                                                                                                                    SHA-256:201CFADB00FBCD3283249DAD73872ED75C5BEC07F5A5B157726638C20728B833
                                                                                                                                                                                    SHA-512:64121ED1EE70D5423710319E806B19261576AECC89A64CBEC44A29BF4AC9FEE21C6484CC3C4550CC92C315B3855BE265F696F8CD4D95027226D608B3ADD022F1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Auckland) {.. {-9223372036854775808 41944 0 LMT}.. {-3192435544 41400 0 NZMT}.. {-1330335000 45000 1 NZST}.. {-1320057000 41400 0 NZMT}.. {-1300699800 43200 1 NZST}.. {-1287396000 41400 0 NZMT}.. {-1269250200 43200 1 NZST}.. {-1255946400 41400 0 NZMT}.. {-1237800600 43200 1 NZST}.. {-1224496800 41400 0 NZMT}.. {-1206351000 43200 1 NZST}.. {-1192442400 41400 0 NZMT}.. {-1174901400 43200 1 NZST}.. {-1160992800 41400 0 NZMT}.. {-1143451800 43200 1 NZST}.. {-1125914400 41400 0 NZMT}.. {-1112607000 43200 1 NZST}.. {-1094464800 41400 0 NZMT}.. {-1081157400 43200 1 NZST}.. {-1063015200 41400 0 NZMT}.. {-1049707800 43200 1 NZST}.. {-1031565600 41400 0 NZMT}.. {-1018258200 43200 1 NZST}.. {-1000116000 41400 0 NZMT}.. {-986808600 43200 1 NZST}.. {-968061600 41400 0 NZMT}.. {-955359000 43200 1 NZST}.. {-936612000 41400 0 NZMT}.. {-923304600 4320
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):280
                                                                                                                                                                                    Entropy (8bit):4.715653436088026
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/FtTfDm2OHHhp5oHvZiuo2HvDVeEU8vScH9syZEizy:MB86FtTLmdHf5CvZiIvJeJ8HH9F6izy
                                                                                                                                                                                    MD5:4E858B3754BD8864719A61839ACA64E6
                                                                                                                                                                                    SHA1:597025A8DAFD5AE75EBD162AC0E9DA71815816BA
                                                                                                                                                                                    SHA-256:2D3BFDED297214BA25CFD8C6F508D0C8B1A1CD7D46701A78EC5E510076185EB6
                                                                                                                                                                                    SHA-512:720F301B73C852EA8EEFA79DEF6B6762554E50222DE114FE87EB5178507F1895A9A39B3872A1A4B9DFF58D1CC6460BA4A82F2C165E3659E13036451F22E389C3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Bougainville) {.. {-9223372036854775808 37336 0 LMT}.. {-2840178136 35312 0 PMMT}.. {-2366790512 36000 0 +10}.. {-868010400 32400 0 +09}.. {-768906000 36000 0 +10}.. {1419696000 39600 0 +11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8165
                                                                                                                                                                                    Entropy (8bit):3.6566720439018874
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:gpvlGCcn6AadFurBrioCdL49mq9X4a2t3I/KVE:gOCBdFurBr0soaz
                                                                                                                                                                                    MD5:8105A806A1762932897AB59C47BBE89E
                                                                                                                                                                                    SHA1:386E41A4A83FA84DBFCA994F679242D067CEED64
                                                                                                                                                                                    SHA-256:CA0EEF84DBC5964EF2265E9252237BE58BB8D75C34817CC2305CCCFAEC7E690C
                                                                                                                                                                                    SHA-512:8A609E7F4868BD455DA811E62142FECD792D0CA0DAAF7C10C4E4254C9EC44B8EB92D388D9224C8FD3CC3FB326A106D831B80F5E1264CCF3EABBCE177BB82E9D6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Chatham) {.. {-9223372036854775808 44028 0 LMT}.. {-3192437628 44100 0 +1215}.. {-757426500 45900 0 +1245}.. {152632800 49500 1 +1245}.. {162309600 45900 0 +1245}.. {183477600 49500 1 +1245}.. {194968800 45900 0 +1245}.. {215532000 49500 1 +1245}.. {226418400 45900 0 +1245}.. {246981600 49500 1 +1245}.. {257868000 45900 0 +1245}.. {278431200 49500 1 +1245}.. {289317600 45900 0 +1245}.. {309880800 49500 1 +1245}.. {320767200 45900 0 +1245}.. {341330400 49500 1 +1245}.. {352216800 45900 0 +1245}.. {372780000 49500 1 +1245}.. {384271200 45900 0 +1245}.. {404834400 49500 1 +1245}.. {415720800 45900 0 +1245}.. {436284000 49500 1 +1245}.. {447170400 45900 0 +1245}.. {467733600 49500 1 +1245}.. {478620000 45900 0 +1245}.. {499183200 49500 1 +1245}.. {510069600 45900 0 +1245}.. {530632800 49500 1 +1245}.. {541519200 45900 0 +1245}.. {56208
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):305
                                                                                                                                                                                    Entropy (8bit):4.600179085934857
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/ZzSDm2OH9pvoHT1YoHvmdcXALEzvScHoVvXKnOjvScHb01Fy:MB86RGmdH9pvCT1YCvnXALEzHHIfKOjd
                                                                                                                                                                                    MD5:AEC058BE796F1513F3DF3E545290D223
                                                                                                                                                                                    SHA1:27D274974AC95B724A4BFDD65CB1B9DD92F73E3D
                                                                                                                                                                                    SHA-256:492DF366BB0A7D29D2DB4A9C40CF0C15CB47343FF908D1AA86092C8E84E4434B
                                                                                                                                                                                    SHA-512:E0924AB86E512AE1B800DEFA637F6B1743FF77F1FEFDC5068A7C30C1AC0BAC60F0D0351278866FD98A59D56BA2C56A1AFC1EBB4F14AAFE5D450085587B7C8F4A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Chuuk) {.. {-9223372036854775808 -49972 0 LMT}.. {-3944628428 36428 0 LMT}.. {-2177489228 36000 0 +10}.. {-1743674400 32400 0 +09}.. {-1606813200 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 36000 0 +10}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8203
                                                                                                                                                                                    Entropy (8bit):3.546693824302767
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:QXn3AWkHkPp2YXaVU+PO/Un4n6MSmSmiTpk9eL6Z5waKkhWILTc:QXn3AWJB2m+PO/UnOSmSmS6ZaILg
                                                                                                                                                                                    MD5:B8B2048F107528DEB4B04CB3E698A5BD
                                                                                                                                                                                    SHA1:0E82DCB11A4553771760B8B0A748EC03F953D2FB
                                                                                                                                                                                    SHA-256:84B815988D1A5AC16F3EC52844BDCE7A8E8707800C782235B5928473EEF9B433
                                                                                                                                                                                    SHA-512:511E3C51B4016641146D21264C031151F2CE9F916F0D97C47D623B66F6244BA9243108179C786B63B8B71F77885B916AC6D18C10CFA1001290019CE6B73278D9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Easter) {.. {-9223372036854775808 -26248 0 LMT}.. {-2524495352 -26248 0 EMT}.. {-1178124152 -25200 0 -07}.. {-36619200 -21600 1 -07}.. {-23922000 -25200 0 -07}.. {-3355200 -21600 1 -07}.. {7527600 -25200 0 -07}.. {24465600 -21600 1 -07}.. {37767600 -25200 0 -07}.. {55915200 -21600 1 -07}.. {69217200 -25200 0 -07}.. {87969600 -21600 1 -07}.. {100666800 -25200 0 -07}.. {118209600 -21600 1 -07}.. {132116400 -25200 0 -07}.. {150868800 -21600 1 -07}.. {163566000 -25200 0 -07}.. {182318400 -21600 1 -07}.. {195620400 -25200 0 -07}.. {213768000 -21600 1 -07}.. {227070000 -25200 0 -07}.. {245217600 -21600 1 -07}.. {258519600 -25200 0 -07}.. {277272000 -21600 1 -07}.. {289969200 -25200 0 -07}.. {308721600 -21600 1 -07}.. {321418800 -25200 0 -07}.. {340171200 -21600 1 -07}.. {353473200 -25200 0 -07}.. {371620800 -21600 1 -07}.. {384922800
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):789
                                                                                                                                                                                    Entropy (8bit):4.0457106900970325
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86HmdH6mvCON3Xj/kw2eX/xtDedjX24ots0FX2ud5KRGkpFxy:uegazZBzCdXUFQzy
                                                                                                                                                                                    MD5:6841B8A2FB9BBF464AA00088CBDCEC80
                                                                                                                                                                                    SHA1:26CC5CCE00A765F8B6493ED24F50957AA7F0089B
                                                                                                                                                                                    SHA-256:332372E5EFB46123FBB66F9F32F91B59EBD88ADB956249DB3F14CAAB01CE2655
                                                                                                                                                                                    SHA-512:A6C67A0F7361E599369597E9A8A52FC7D5C96DE6B5A7C1BE1D02F5DF11051F448289786C7F0E82E71CDEB825215E64E072CF034C45D6E2F822D7201AB8B41B57
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Efate) {.. {-9223372036854775808 40396 0 LMT}.. {-1829387596 39600 0 +11}.. {125409600 43200 1 +11}.. {133876800 39600 0 +11}.. {433256400 43200 1 +11}.. {448977600 39600 0 +11}.. {464706000 43200 1 +11}.. {480427200 39600 0 +11}.. {496760400 43200 1 +11}.. {511876800 39600 0 +11}.. {528210000 43200 1 +11}.. {543931200 39600 0 +11}.. {559659600 43200 1 +11}.. {575380800 39600 0 +11}.. {591109200 43200 1 +11}.. {606830400 39600 0 +11}.. {622558800 43200 1 +11}.. {638280000 39600 0 +11}.. {654008400 43200 1 +11}.. {669729600 39600 0 +11}.. {686062800 43200 1 +11}.. {696340800 39600 0 +11}.. {719931600 43200 1 +11}.. {727790400 39600 0 +11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.82787610497142
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG11avXHAIgObT11ORL/nUDH7/UDH11B:SlSWB9vsM3yckHAIgObON/h
                                                                                                                                                                                    MD5:CD1AC50AADC3CF9C0E7A055D587E790D
                                                                                                                                                                                    SHA1:BEE0E16D3954DF33C697DEA469A130BD9875AB8B
                                                                                                                                                                                    SHA-256:790E6B48B261D6DEF7D183CC8F38FB8D8A6E3EFB8844281EFABB2DFD621E53B5
                                                                                                                                                                                    SHA-512:B6A93DFB4CBE2F35268AACA88FDCC4D19949A2E8DC9464D8341C38065C6FF48A3C49FE756FFCE777C8F806DE309C8AFC4CE4BC4ABD183C28808F995A0F89B091
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Kanton)]} {.. LoadTimeZoneFile Pacific/Kanton..}..set TZData(:Pacific/Enderbury) $TZData(:Pacific/Kanton)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.913439535905759
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDH4ErKYofMXGm2OH18VkeoHvmUENBBy/aCPFVFv7Dy:SlSWB9eg/BE3ofDm2OH1VeoHvmH7y/Fy
                                                                                                                                                                                    MD5:6250F332356787613A2D1853EF6D1AC3
                                                                                                                                                                                    SHA1:0464B9EE8B691990022295D2DEFE1AAE4B247E63
                                                                                                                                                                                    SHA-256:336058DCA4802C79ED43F6177ADB73085D4FA0754B94051CAE2A19346B0C4904
                                                                                                                                                                                    SHA-512:B8FAB5E128D2EF3CB7050DA717D80247045BE09F7F6542AA154CB85F4A56884F195EE2776421890A3F86D133106DCA4672D7D9329E0DE6F4A7CF8F4030822988
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Fakaofo) {.. {-9223372036854775808 -41096 0 LMT}.. {-2177411704 -39600 0 -11}.. {1325242800 46800 0 +13}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5636
                                                                                                                                                                                    Entropy (8bit):3.637086785452708
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:9QdCQvGPccyGqjXKZ2luR7oVqqJZozv88s2:Wd9vGPfyGi6Z2opCs
                                                                                                                                                                                    MD5:D2A17937A99B50B3BCD50F8C10520B56
                                                                                                                                                                                    SHA1:A27681C6EC2B4625262359E5ADFEA09CAB58FAFC
                                                                                                                                                                                    SHA-256:A29FAAEE67BC07F5DF858DAC070F03E45E29B67A5F9DE6DD992E79A9601979B7
                                                                                                                                                                                    SHA-512:A16F96B17E7221A9C60EF506D7ABFE806304AAAB8C64A69E340E9960BEB64C7334931CD6FBBA5F22A1A3BFFE55690BDF04E60852E516CB3048EE34AC3EAB16CC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Fiji) {.. {-9223372036854775808 42944 0 LMT}.. {-1709985344 43200 0 +12}.. {909842400 46800 1 +12}.. {920124000 43200 0 +12}.. {941896800 46800 1 +12}.. {951573600 43200 0 +12}.. {1259416800 46800 1 +12}.. {1269698400 43200 0 +12}.. {1287842400 46800 1 +12}.. {1299333600 43200 0 +12}.. {1319292000 46800 1 +12}.. {1327154400 43200 0 +12}.. {1350741600 46800 1 +12}.. {1358604000 43200 0 +12}.. {1382796000 46800 1 +12}.. {1390050000 43200 0 +12}.. {1414850400 46800 1 +12}.. {1421503200 43200 0 +12}.. {1446300000 46800 1 +12}.. {1452952800 43200 0 +12}.. {1478354400 46800 1 +12}.. {1484402400 43200 0 +12}.. {1509804000 46800 1 +12}.. {1515852000 43200 0 +12}.. {1541253600 46800 1 +12}.. {1547301600 43200 0 +12}.. {1573308000 46800 1 +12}.. {1578751200 43200 0 +12}.. {1608386400 46800 1 +12}.. {1610805600 43200 0 +12}.. {1668261600 4
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):154
                                                                                                                                                                                    Entropy (8bit):5.018668544746349
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDH4QwyFPMXGm2OHwodGeoHvmcpXrWXVN0UIoAov:SlSWB9eg/BCPDm2OHwxeoHvmgSX0YAov
                                                                                                                                                                                    MD5:C1547FDC362DA1162FE7B53BC16AEA87
                                                                                                                                                                                    SHA1:3249423B61C42E6CE54A77BACA0A8FDFD2594CF9
                                                                                                                                                                                    SHA-256:B2ACF1461318A0B21653B6F21DE5E54651A417A469AAD0DBF8099626040BEB51
                                                                                                                                                                                    SHA-512:76D0F4489CCB32A8CDCA5151E086E93A0199C6FF5066DD73F873F103F7592BFE4A3765BC862246817C2F0CA7F33B02EF40E5A3C9CF461A07D9AF03F623FC08FB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Funafuti) {.. {-9223372036854775808 43012 0 LMT}.. {-2177495812 43200 0 +12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):247
                                                                                                                                                                                    Entropy (8bit):4.687336389955113
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/fEGDm2OHvQYeoHTie7KVQRncRvinrN5/uFifriX:MB86fhmdH0CTV7OcdrN5/uFiGX
                                                                                                                                                                                    MD5:0557D164DCD8DF5D99F7AF5A2AB1AD4F
                                                                                                                                                                                    SHA1:68AFD04303E5F541480425405D82E1827F78A8DF
                                                                                                                                                                                    SHA-256:192545659F971084ADC8489A2B96A6439FF391599DC962AA13375ACCFB3C09D9
                                                                                                                                                                                    SHA-512:1DA004E51F8E7A712EDE920CBB62E81F9F55450FB52B62F78F1CD4F8F4E342B4DAB2C28AA5161E8B24942A7A5BD55F978AFDA1C5E1949241E71D738079DEF9B8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Galapagos) {.. {-9223372036854775808 -21504 0 LMT}.. {-1230746496 -18000 0 -05}.. {504939600 -21600 0 -06}.. {722930400 -18000 1 -06}.. {728888400 -21600 0 -06}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):155
                                                                                                                                                                                    Entropy (8bit):4.976931060677737
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDH5hBYfMXGm2OHKToxYoHsdNfis:SlSWB9eg/DDm2OHPxYoH4qs
                                                                                                                                                                                    MD5:45330CE0FA604304C6ACF8EF8CAF51EC
                                                                                                                                                                                    SHA1:20EEF9646996C2EC9B2641EBCCBE4766BF38B17B
                                                                                                                                                                                    SHA-256:190E02A0C00D165FA45C73AEF9C0D6C82B1720E7406E5610DD860AED10A021A5
                                                                                                                                                                                    SHA-512:51C7931B503405DA0B4078F6BE411895DD00E86AC7C5BE475030664D5302AD614293541DEE7FFC3D86A9DDB1BDA32BCAA746CF1D207DB063FBA2F9E9BE12836C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Gambier) {.. {-9223372036854775808 -32388 0 LMT}.. {-1806678012 -32400 0 -09}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):157
                                                                                                                                                                                    Entropy (8bit):4.9796189407775255
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDH5RyJTLJ5FNMXGm2OHddHvpoxYoHsdMWdHPVtyn:SlSWB9eg/LJHjXDm2OHdFGxYoHgHPLy
                                                                                                                                                                                    MD5:DF09960360D8CEDCA2A4DC19A177C4A6
                                                                                                                                                                                    SHA1:9F73F271B8C85B25FE6392B8BF7465C92EFFE621
                                                                                                                                                                                    SHA-256:161762334DFF48B1D58824911E1FF4171386EA18234DD3DD5B0798515593086A
                                                                                                                                                                                    SHA-512:1BE9E0F90DA529C99E317F399BFDB913A076651CF8801A1849247B26A350A76D8B5807AB139F3DBB97790DDFC332BDBEB57B364BF67FA2BB440AFEDC4130A648
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Guadalcanal) {.. {-9223372036854775808 38388 0 LMT}.. {-1806748788 39600 0 +11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):733
                                                                                                                                                                                    Entropy (8bit):4.244282318063802
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB862mdHanCTCtBCv1yWQkHHLTaWJ+x+87W0x+8+yWSi+JW7+sWU0dwaW1j+FaW2:FeaC2twvY3knLGs+I87p+8d9i+J7s70c
                                                                                                                                                                                    MD5:BA319E451BE323C852A8ABFC299DDA28
                                                                                                                                                                                    SHA1:FC9314C162FF1FE1ED5E2C5DF962A55D4D6D8115
                                                                                                                                                                                    SHA-256:42CB69ABC83415F63CA7D2A3E5314A41817AEE3206ECCC7172C50A74B1597DB0
                                                                                                                                                                                    SHA-512:3BF733B9ED2A57B01BE173A8421B2D5A45888A230461EA0BD8C5B4AC7DC010BB527346731196141C70AFECDF88DD47AFE48636243DFC395D88E58231BEDF7D2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Guam) {.. {-9223372036854775808 -51660 0 LMT}.. {-3944626740 34740 0 LMT}.. {-2177487540 36000 0 GST}.. {-885549600 32400 0 +09}.. {-802256400 36000 0 GST}.. {-331891200 39600 1 GDT}.. {-281610000 36000 0 GST}.. {-73728000 39600 1 GDT}.. {-29415540 36000 0 GST}.. {-16704000 39600 1 GDT}.. {-10659600 36000 0 GST}.. {9907200 39600 1 GDT}.. {21394800 36000 0 GST}.. {41356800 39600 1 GDT}.. {52844400 36000 0 GST}.. {124819200 39600 1 GDT}.. {130863600 36000 0 GST}.. {201888000 39600 1 GDT}.. {209487660 36000 0 GST}.. {230659200 39600 1 GDT}.. {241542000 36000 0 GST}.. {977493600 36000 0 ChST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):344
                                                                                                                                                                                    Entropy (8bit):4.640604617840767
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/PeDDm2OHsVVoHvBrai3UNFv+rUXaWFvAHovj/0nvCv7p+v:MB86WXmdH0VCvBz0GOTA0/0y74v
                                                                                                                                                                                    MD5:F3F0E64655FAA79E40860765EEBB5B77
                                                                                                                                                                                    SHA1:7F6C2FC100AEABC26B7205AB53C1E016B12E4D60
                                                                                                                                                                                    SHA-256:69319015799D32D3CF7C0A3E9991B4B1F3E0C5D1B4FBF400517350CCA9D2C3B7
                                                                                                                                                                                    SHA-512:7C9238BCCB13B90D4DC9B5E776C421A42C25D21B4E026406F57FA1E70983E8F6BF1CE927AB9D0D6261C5C1802A8B810399F506915262F82F487417CFD704B2F1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Honolulu) {.. {-9223372036854775808 -37886 0 LMT}.. {-2334101314 -37800 0 HST}.. {-1157283000 -34200 1 HDT}.. {-1155436200 -34200 0 HST}.. {-880201800 -34200 1 HWT}.. {-769395600 -34200 1 HPT}.. {-765376200 -37800 0 HST}.. {-712150200 -36000 0 HST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):193
                                                                                                                                                                                    Entropy (8bit):4.844454917943834
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3yc6e8SHAIgOb6eKAN/NWyVheo:MByMdniinbtNWzo
                                                                                                                                                                                    MD5:4244078A03C2493009EF2F6BDA2F326F
                                                                                                                                                                                    SHA1:AC2FF3E91A8831A479B33DF32A0118BC2EB255D0
                                                                                                                                                                                    SHA-256:6E52B361AC8A6A578C709F6D58AA7535F06C0CB1707081C2D5A63FA8545D955C
                                                                                                                                                                                    SHA-512:398B32E0FAF80E40DF3ACD203DF380D61DC39322F0BA0388A18281BC26973945F45683A104B9A785BB9DF5E514322F6994F934289E4B56B7982F94D4528D4272
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:Pacific/Johnston) $TZData(:Pacific/Honolulu)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):208
                                                                                                                                                                                    Entropy (8bit):4.669308556946547
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/KyXDm2OHEMmzQwXy29BVyv7y/fTVVFty:MB86KyTmdHEZzQUBVyDy/fZvty
                                                                                                                                                                                    MD5:544A0A83241333805192A6F03888E359
                                                                                                                                                                                    SHA1:99D2BE79D57B44BD538386F9E7551C9E1874D7E3
                                                                                                                                                                                    SHA-256:0B1345555EC2B4738CC4DEBFE496C287966F238386263032FF1E27912CCBFBA6
                                                                                                                                                                                    SHA-512:61C91265632D01FBB7F4C739368756C428258FA6C141E49E88B6C78ABEA6150A74B8DFCF14C5AADDA03C1EA6F04D122734654495C26B8614561786B1C5C7EF10
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kanton) {.. {-9223372036854775808 0 0 -00}.. {-1020470400 -43200 0 -12}.. {307627200 -39600 0 -11}.. {788871600 46800 0 +13}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):219
                                                                                                                                                                                    Entropy (8bit):4.739672105601744
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/iSDm2OHjkeoHvmLVFFz4YWXfSzvjNv:MB86iGmdHpCvU4VfSbxv
                                                                                                                                                                                    MD5:1B695BBB9C50F6AFC05F67DE30374160
                                                                                                                                                                                    SHA1:08AD8BBB6C99EB36FC3E462DB41C6896F52F150C
                                                                                                                                                                                    SHA-256:4F7235B956A5A01676BE05275E086D5157EBC24FD91022E87817020669F915F7
                                                                                                                                                                                    SHA-512:DC35CB1C2E5E035A82F91D1B1F4B48D7B112D9B7A1A7DB9C4A4C42C4D58002E1ECD9D24B2EA5B624DBB526ADDF9A8AB37D4315843207C34C16B2EFE33A254752
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kiritimati) {.. {-9223372036854775808 -37760 0 LMT}.. {-2177415040 -38400 0 -1040}.. {307622400 -36000 0 -10}.. {788868000 50400 0 +14}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):394
                                                                                                                                                                                    Entropy (8bit):4.441317927120857
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB869nmdHlCTvrvCvKcHwzHHI/HKOjHHwZaLYkcy:2ecrrqvGznISknwZaLxcy
                                                                                                                                                                                    MD5:B489D7BDE8EB805B2A24726A6FB0C441
                                                                                                                                                                                    SHA1:7997A33AA56857EC52B1198DBEF4CE1DB50D69FD
                                                                                                                                                                                    SHA-256:B528E5E712E5F878603183E7CCFF55E5DB97CB47D7628BCB635342796317B899
                                                                                                                                                                                    SHA-512:4898AC2747FB8620BE29933CC7AA344AF1A3B7777D1AFF08BB4C6CE6E7AF205581937CCB488F3CB39CC8CA7FB42EDC8E1CAD8BADC9FCA40E3CAD23271CD66FCB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kosrae) {.. {-9223372036854775808 -47284 0 LMT}.. {-3944631116 39116 0 LMT}.. {-2177491916 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 39600 0 +11}.. {-7988400 43200 0 +12}.. {915105600 39600 0 +11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):304
                                                                                                                                                                                    Entropy (8bit):4.5947337310364835
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/yEyDm2OH4T2eoHvmfKnOjvScHrkL/Xy2185k0YAov:MB86XmmdHWCv6KOjHHgLN8tby
                                                                                                                                                                                    MD5:7D1FC9913941693ACBD6A3CCB2F34555
                                                                                                                                                                                    SHA1:D07C8AAED1DF9614BCA6EEF0F72FB98BE46CF5EF
                                                                                                                                                                                    SHA-256:38133BE70100D7DC244A680827879E6B240646C7C0B68F58652051E681A71985
                                                                                                                                                                                    SHA-512:419F0A1D1D71C8F84765C7B54271D7EFD6A81F428751523A214ABB24A8770DD5A7666F634A20AF97D5AAB8F21C0DEF23DCDE068CF4C1CCC7639ABC43864A9DBC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kwajalein) {.. {-9223372036854775808 40160 0 LMT}.. {-2177492960 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-817462800 39600 0 +11}.. {-7988400 -43200 0 -12}.. {745934400 43200 0 +12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):333
                                                                                                                                                                                    Entropy (8bit):4.49621343701744
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/QpDm2OHyexYoHvmf/aHwzvScHoVv3HKnOjvScHr8e0LYX0YAov:MB86cmdHyuYCvMiHwzHHI/HKOjHHYe0I
                                                                                                                                                                                    MD5:CA7ED52987F13BA6A3043C324F72C3D0
                                                                                                                                                                                    SHA1:F5798473DB3A9AA588E5F0D772AD2145A90DE707
                                                                                                                                                                                    SHA-256:67EA1A2A84E0FA686C04EF327E7EEACCC15E21BED79A801E64BB57FE4184509A
                                                                                                                                                                                    SHA-512:4EA25564E1430615D0FE75319B3CFC88E3FB7BCE026B4C59842FC513CBE7BFF3AD39CC283ED88DD7292DFE8185ACECD5E1ED0D5997F27082F3F6B2D1317D86C3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Majuro) {.. {-9223372036854775808 41088 0 LMT}.. {-2177493888 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-818067600 39600 0 +11}.. {-7988400 43200 0 +12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):159
                                                                                                                                                                                    Entropy (8bit):4.976348164850869
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHzrHeWNMXGm2OHOx5oHsdNpNFvvIVVFvYy:SlSWB9eg/cHeSDm2OHOnoH4/FvQVVFAy
                                                                                                                                                                                    MD5:80CB45F42BAB1AA72CD7C7BC394DF3F8
                                                                                                                                                                                    SHA1:8B5ED2BCCA1AEB41F22AFD14F46533959828B2BE
                                                                                                                                                                                    SHA-256:AE0B5055C6E57516F23749B13681205EAD376E682959716A457B1377AF8160BA
                                                                                                                                                                                    SHA-512:71562E340B7A96B91D04FCBCAF71B66EA725CA1BD1094343C4442F8F9A8C67A3BE378034849197407D21C3EE74E2C753B1FD3BAFF2378714B993AD9336236A0E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Marquesas) {.. {-9223372036854775808 -33480 0 LMT}.. {-1806676920 -34200 0 -0930}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):194
                                                                                                                                                                                    Entropy (8bit):4.81307101485774
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/nUDHz0HvUDHurKv:SlSWB9vsM3yciemHAIgObiecN/Zevn
                                                                                                                                                                                    MD5:13CE48F8FF74BFCEFCB8D217D6357E38
                                                                                                                                                                                    SHA1:296D31E3F868934C6EB34BF1BF4C23F3E1839294
                                                                                                                                                                                    SHA-256:F62C6A2DEC1E9EC78115D5F14E5B9DB7C86F788662D2E68F7E6714F4A05DC974
                                                                                                                                                                                    SHA-512:778813FC08EF803743F392000BECE73C1C079883DAFC26FAC0AF8FA3FA4AE1D94BA8F3CAA5E82DD4DB1A5F12AD49E123901908F5483E0E325952622AB4C4A26A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:Pacific/Midway) $TZData(:Pacific/Pago_Pago)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):244
                                                                                                                                                                                    Entropy (8bit):4.702705620563736
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/JdDm2OHceoHx6sCH/ZdqvScH9cd0YAov:MB86J5mdH9CMhcHHauby
                                                                                                                                                                                    MD5:30A8285FCCE2E98889E53DF60B906C3D
                                                                                                                                                                                    SHA1:C7789CB11A2C8FE3861FF3C0A7A41F6CAFD87631
                                                                                                                                                                                    SHA-256:22C367F3219B5FC736260D9DBFEF5FCB767F1A6BDA991C9352F790A3D1FFE884
                                                                                                                                                                                    SHA-512:02DA82680588839B06F820979AECC78B7FBEAB9D6D49176B513B80F1C8BA2D55FB3674B19EFDD574EE6FC01539EF7C3081A4B34D14A54DACF367D816B62E5843
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Nauru) {.. {-9223372036854775808 40060 0 LMT}.. {-1545131260 41400 0 +1130}.. {-862918200 32400 0 +09}.. {-767350800 41400 0 +1130}.. {287418600 43200 0 +12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):184
                                                                                                                                                                                    Entropy (8bit):4.846897598147338
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHwMQA3WNMXGm2OH0SNoHoRWVGXyOyovFaSUGFAZvBByV:SlSWB9eg/Jm3SDm2OHJoHFGXCodZUGFd
                                                                                                                                                                                    MD5:6E8EC957423917AE7A7EF503661C1A77
                                                                                                                                                                                    SHA1:B4FA3C3E3F96C28B7DB87BFD441D2EE99CC81B6F
                                                                                                                                                                                    SHA-256:869CCA656BE88E4E7481C75737C3656BAB6924AD1751505815AC719C59269842
                                                                                                                                                                                    SHA-512:9047ABE673259699C7A548BC7B5636DD646DD382C751B796522F65404162AB1B0BB022FD274653921E5B23C847EE248AEF6749E15ED2CFC1DCE35BBA294D8251
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Niue) {.. {-9223372036854775808 -40780 0 LMT}.. {-543069620 -40800 0 -1120}.. {-173623200 -39600 0 -11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5139
                                                                                                                                                                                    Entropy (8bit):3.65794255179185
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:K/yg8hZbeS07HbbYTqge+gDrWnAxhejtB0e+Pwn1UVimqNQrKvyXrStkCDv:K/y7hNeS07sq0Erk10lINQrKvyXrwv
                                                                                                                                                                                    MD5:E19700A894AA64715D14F501D8D2FA98
                                                                                                                                                                                    SHA1:57CFC96E2EBB985720DB290F59181860AF2AC1AA
                                                                                                                                                                                    SHA-256:5D16C3EF1DB996C1B8E33AD884C33946F77DA872F35F41EC3BD5B288F43CC9AF
                                                                                                                                                                                    SHA-512:E11EAF2A7B217CDBEECB57635184F04171F0DB088FCC4702AA8D40A3A5453904592F5869849913E2EB02DC5941C84203A76D270E8930B0B691A3B9C39B78BF30
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Norfolk) {.. {-9223372036854775808 40312 0 LMT}.. {-2177493112 40320 0 +1112}.. {-599656320 41400 0 +1130}.. {152029800 45000 1 +1230}.. {162916200 41400 0 +1130}.. {1443882600 39600 0 +11}.. {1561899600 39600 0 +12}.. {1570287600 43200 1 +12}.. {1586012400 39600 0 +12}.. {1601737200 43200 1 +12}.. {1617462000 39600 0 +12}.. {1633186800 43200 1 +12}.. {1648911600 39600 0 +12}.. {1664636400 43200 1 +12}.. {1680361200 39600 0 +12}.. {1696086000 43200 1 +12}.. {1712415600 39600 0 +12}.. {1728140400 43200 1 +12}.. {1743865200 39600 0 +12}.. {1759590000 43200 1 +12}.. {1775314800 39600 0 +12}.. {1791039600 43200 1 +12}.. {1806764400 39600 0 +12}.. {1822489200 43200 1 +12}.. {1838214000 39600 0 +12}.. {1853938800 43200 1 +12}.. {1869663600 39600 0 +12}.. {1885993200 43200 1 +12}.. {1901718000 39600 0 +12}.. {1917442800 43200 1 +12}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):326
                                                                                                                                                                                    Entropy (8bit):4.531117764974758
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/JcSDm2OHTYoHgnX2czO/FxgV62JFy:MB86JcGmdHTYCgX2czUjgM2ny
                                                                                                                                                                                    MD5:2F1E92A11DF44C72DC305C13111DEA35
                                                                                                                                                                                    SHA1:847F551C3D6C75CD2D0D6D87FCF3294CA8DD90B2
                                                                                                                                                                                    SHA-256:238683C027D2319C33D975A837E9FC9D24DD53B1A67108EDBF7ABDF0DB050881
                                                                                                                                                                                    SHA-512:E35D8C71AFDBB9A7507E873925001AEDE3734B1D235F509D19952E85279CBCC233A73412EA1F79CB534A45D36FEAA8AFDA98D9964DC93C7892B318F4AFC9A076
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Noumea) {.. {-9223372036854775808 39948 0 LMT}.. {-1829387148 39600 0 +11}.. {250002000 43200 1 +11}.. {257342400 39600 0 +11}.. {281451600 43200 1 +11}.. {288878400 39600 0 +11}.. {849366000 43200 1 +11}.. {857228400 39600 0 +11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.985607855830399
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHurKeTFfXMXGm2OH2ivkeoHvUPi1TsYoHsdfWTVvvVFv:SlSWB9eg/XecDm2OH23eoHvWieYoHiWB
                                                                                                                                                                                    MD5:E86D90DAA694B0EAC42F8C01346BC95B
                                                                                                                                                                                    SHA1:CD29DEFC291C939296E86DC7EF5D0654D85285E8
                                                                                                                                                                                    SHA-256:CCA96640AB3BC707224FA86D9AF66F9D53A204A97B370B2785BA8208688BF8B6
                                                                                                                                                                                    SHA-512:937BA420061E3781F831779B458E914A0FC465C4B41796F8B7CB1E548822F5777A6450FC6002AB13EBC5C9F54E374D3ED731D05B2B302B95359BE34094E5062B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pago_Pago) {.. {-9223372036854775808 45432 0 LMT}.. {-2445424632 -40968 0 LMT}.. {-1861879032 -39600 0 SST}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):183
                                                                                                                                                                                    Entropy (8bit):4.919381181565273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHugEZF3fMXGm2OHKvkeoHucRbgnJnoHvmdQ4+vScFAy:SlSWB9eg/Xg2PDm2OHK8eoHTWJnoHvmi
                                                                                                                                                                                    MD5:2E6C7EC61C7E29A147475C223B163F6B
                                                                                                                                                                                    SHA1:3A98D3441335224E7EBC0648990BCA1DE3BDF5C6
                                                                                                                                                                                    SHA-256:97DE6C2C717BFEAD00F83B5D39D654C32CEE580226F5F084484EBAD57BBCE7FF
                                                                                                                                                                                    SHA-512:5868C43966DDEBA8EC4BBBB29CDFDDFF0C7B01FD4D579FF655F3363029059F969B39C9221190672B6A2F7938583594AA0B103FC2A7ED573E2BC1C3A1623DE8DD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Palau) {.. {-9223372036854775808 -54124 0 LMT}.. {-3944624276 32276 0 LMT}.. {-2177485076 32400 0 +09}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.809907977056877
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHuQTWLMbNMXGm2OHUVFvoHvmXUlgloWkcyf/vGpn:SlSWB9eg/XQyLMJDm2OHUVVoHvmXUKm2
                                                                                                                                                                                    MD5:3F4987676F9C461895EDF9985AD22E06
                                                                                                                                                                                    SHA1:A96E470209010B837EF5BB3AC93BAE74BF2CCF64
                                                                                                                                                                                    SHA-256:5D363729A986E24C79F4B817CC88D2B22ACCCE3ADD20138D51C4422C4297AD6F
                                                                                                                                                                                    SHA-512:988FB98EFD3F57F5D66A932CC6B9D0387E9B0951FC590E08DAF19ACF5E4F39BC1B25265F16E14930BCF394902F5F0EF507E0E91C98902DFB10FA16D716091AB0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pitcairn) {.. {-9223372036854775808 -31220 0 LMT}.. {-2177421580 -30600 0 -0830}.. {893665800 -28800 0 -08}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):338
                                                                                                                                                                                    Entropy (8bit):4.55704384204571
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9eg/XyiDm2OHANgYoHT6WKNoHvmScHwzvScHoVv3HKnOjvScHb0Zzy:MB86C2mdH1YCT61NCvfcHwzHHI/HKOjX
                                                                                                                                                                                    MD5:497B7BE4CE7A51C19CE7D4DDC3109281
                                                                                                                                                                                    SHA1:5ED794E3B95A99CF1B9520174A15396A3A8ADF28
                                                                                                                                                                                    SHA-256:88D62B644BB96A9318427B4CA56DB37C8217DA449328C801ED77007BE9420F9C
                                                                                                                                                                                    SHA-512:2E0898F7135E1634298BD5DE73F129433F9DA47E6F08E5A58D83A4DF4F6FC0F54B6FC2660B0EE4C13561A925841B160B893D4A21A0622125D2E3DC66883C5080
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pohnpei) {.. {-9223372036854775808 -48428 0 LMT}.. {-3944629972 37972 0 LMT}.. {-2177490772 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 39600 0 +11}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.786230343954939
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGuySeyXHAIgObTuyoAFARL/nUDHu3HppUDHuyB:SlSWB9vsM3yciySeSHAIgObiyJAN/X3y
                                                                                                                                                                                    MD5:D32F290A7020C13D7A130A0548112B02
                                                                                                                                                                                    SHA1:314877B3C316D7BD9962DE18A9D57A59556E0D95
                                                                                                                                                                                    SHA-256:EDC43EF78691A1B22D111BC4390EA442B893E61771A6FD76BDAE1D46C5904C0C
                                                                                                                                                                                    SHA-512:9054C22EA382CACE946FE08F0118E2A4120DE4FF1F3FA908869E4BFA20D2DF8AED0DD5F169871BD09743563639F6E24C7DB8BBFB3A7268DE15DB7CCAFE622192
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pohnpei)]} {.. LoadTimeZoneFile Pacific/Pohnpei..}..set TZData(:Pacific/Ponape) $TZData(:Pacific/Pohnpei)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):190
                                                                                                                                                                                    Entropy (8bit):4.945354510868153
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHuwKXI3SMXGm2OHwdvoHvZUeQTnoo3v/vnqMVVMUMy:SlSWB9eg/X/43SDm2OHwdvoHvZZQTnoQ
                                                                                                                                                                                    MD5:2CFB7C2A3D26D7AF0F6AE32ADD81C364
                                                                                                                                                                                    SHA1:80C96E50D23A9A9531E4EE33744CF445C054B901
                                                                                                                                                                                    SHA-256:124C137B091D9D54D5E0579131485428FAAE040ACC978D20D6A8C8E4DE9889AA
                                                                                                                                                                                    SHA-512:A215FF5A69BD3E786BD3F8C952C8593396402EFA85005F5342093028617A6862EAE8BFD7B6D5737F90D90897AB62CF785544A4157A222AE4D0F70797FFBEC2CB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Port_Moresby) {.. {-9223372036854775808 35320 0 LMT}.. {-2840176120 35312 0 PMMT}.. {-2366790512 36000 0 +10}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):969
                                                                                                                                                                                    Entropy (8bit):3.943959457262612
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86VrjmdHI5Cvn9HCFkN00hjNFq++UE+q0hwA+A7VxVnDEFn:IeZv8w0MNFq+xE+uAtx1c
                                                                                                                                                                                    MD5:64AD3A103F4D145C48484BF8FACF41C2
                                                                                                                                                                                    SHA1:40C00CFA56C87E506C254A93A164D7227DFF3BD5
                                                                                                                                                                                    SHA-256:5AB006A686E564E30C94884FF8A9D728AEC74681DA8772E9722B6FE203630B5D
                                                                                                                                                                                    SHA-512:D1088C3B673B5456A8706B69BE4D7AB18615EE53A82BF4ABE76E86700837E6BAD0BD79C13EDA9B04776B08A95B835BA755AA565F86E45BFE507E8783896C1EE2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Rarotonga) {.. {-9223372036854775808 48056 0 LMT}.. {-2209555256 -38344 0 LMT}.. {-543072056 -37800 0 -1030}.. {279714600 -34200 0 -10}.. {289387800 -36000 0 -10}.. {309952800 -34200 1 -10}.. {320837400 -36000 0 -10}.. {341402400 -34200 1 -10}.. {352287000 -36000 0 -10}.. {372852000 -34200 1 -10}.. {384341400 -36000 0 -10}.. {404906400 -34200 1 -10}.. {415791000 -36000 0 -10}.. {436356000 -34200 1 -10}.. {447240600 -36000 0 -10}.. {467805600 -34200 1 -10}.. {478690200 -36000 0 -10}.. {499255200 -34200 1 -10}.. {510139800 -36000 0 -10}.. {530704800 -34200 1 -10}.. {541589400 -36000 0 -10}.. {562154400 -34200 1 -10}.. {573643800 -36000 0 -10}.. {594208800 -34200 1 -10}.. {605093400 -36000 0 -10}.. {625658400 -34200 1 -10}.. {636543000 -36000 0 -10}.. {657108000 -34200 1 -10}.. {667992600 -36000 0 -10}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179
                                                                                                                                                                                    Entropy (8bit):4.854594370903023
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG5RFeyXHAIgObT5RV5RL/nUDHtluKpUDH5Rgn:SlSWB9vsM3ycdeSHAIgOb7N/vKbn
                                                                                                                                                                                    MD5:EFC985F07B24BEDA22993C9D0EA7E022
                                                                                                                                                                                    SHA1:6D05D12925621F1D05999A5DCC81B8C6F4D18945
                                                                                                                                                                                    SHA-256:4F6A1C20A11E186012466091CD4B3C09D89D35E7560F93874DEC2D7F99365589
                                                                                                                                                                                    SHA-512:5FB4D8784D2EB8AEF660D6CBC7C403561EE5874BEC0439762F3688C64830B52B1F557B467CA65B64B1210E82F385E134BF676F3CA443FB480702A2C90B3C3757
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Guam)]} {.. LoadTimeZoneFile Pacific/Guam..}..set TZData(:Pacific/Saipan) $TZData(:Pacific/Guam)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):193
                                                                                                                                                                                    Entropy (8bit):4.78073436515702
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/nUDHthA5nUDHurK:SlSWB9vsM3yciemHAIgObiecN/NXevn
                                                                                                                                                                                    MD5:8E335F5D0A2082BB673E7FEB56167A89
                                                                                                                                                                                    SHA1:EF37235922D4477AC9B3D9576888CDE41E700741
                                                                                                                                                                                    SHA-256:98D06302EFC18FAD7751F7E5A059FE4ABAFBC361FDC365FE1EB576209D92C658
                                                                                                                                                                                    SHA-512:2572D99EE8BAF264B8A2EF3D7647D33A387EE83E036F9E7BDB21F64C2FCB43317AF9C899C8CDD822A2A5A207EF17504E71B217370473ED95AE925BBA2CFA90F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:Pacific/Samoa) $TZData(:Pacific/Pago_Pago)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):154
                                                                                                                                                                                    Entropy (8bit):4.946903999617555
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHqhFPMXGm2OHl/oeoHsdNqRU7vV:SlSWB9eg/TTPDm2OHloeoH4qRW9
                                                                                                                                                                                    MD5:341B0F535043051A91A21297BFA39DC0
                                                                                                                                                                                    SHA1:6AD9177FC237503E6D36DE5408790A68D5D36E2C
                                                                                                                                                                                    SHA-256:440A87DDB4F304DCBEAED1B0DE8F6058840E597918B688E0782F584DA03B1BBC
                                                                                                                                                                                    SHA-512:D97D399A0F1B4347F8AE5F15E43A8787697339AB0EFB4E1106C790528FFC529ADC5B44B231D95449D39DB464D84A5DDF7B61E7D190E3E2B0091D1EC204B530A2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tahiti) {.. {-9223372036854775808 -35896 0 LMT}.. {-1806674504 -36000 0 -10}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):152
                                                                                                                                                                                    Entropy (8bit):4.969953728206455
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHqQ3fMXGm2OHyyFpoeoHvmciRrWFN0UIoAov:SlSWB9eg/T+Dm2OHyyFGeoHvmbu0YAov
                                                                                                                                                                                    MD5:AA67FBBB6A02F5B30486C54E3A5C11D7
                                                                                                                                                                                    SHA1:C64FD3654A47A0ECDD681B8A4D9B621AC6D97DBE
                                                                                                                                                                                    SHA-256:91AA5DA8D5D1E72B1F561D0AEAB4B07E02EDD4EB95AE8C9F1C503C820460599F
                                                                                                                                                                                    SHA-512:FC170904098011C091622A263CA554CEE952D64888D3573EB324E0A262E1A0C0885C059429F0FFF9219FEB8F1B6B97EC34661DD8DD547124D0C6C0A1C8EE24B7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tarawa) {.. {-9223372036854775808 41524 0 LMT}.. {-2177494324 43200 0 +12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):451
                                                                                                                                                                                    Entropy (8bit):4.343299747430587
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:MB86PmdHmCdC/V7XZXw8Ut2rbUtGiAUtb4bUtqVy:iemn/VbKeOSy
                                                                                                                                                                                    MD5:87CFDA2399A8126117E5BFC018B06518
                                                                                                                                                                                    SHA1:6291611BCFB34293F9C20BA77170A13C1502C2ED
                                                                                                                                                                                    SHA-256:ECC9D2E7AD7B5E5D6599CF442941595C99C4D69E802A4DDB4DA321898CDDE91D
                                                                                                                                                                                    SHA-512:846FE07FEB82EC5F87FAE137D23074934246DBB7C7EE30F44F6C5373183B5FD2211B58E5CF1AB9A47938D282CA322FBDE80B58054FE6517CDC549992439F19A8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tongatapu) {.. {-9223372036854775808 44352 0 LMT}.. {-767189952 44400 0 +1220}.. {-284041200 46800 0 +13}.. {915102000 46800 0 +13}.. {939214800 50400 1 +13}.. {953384400 46800 0 +13}.. {973342800 50400 1 +13}.. {980596800 46800 0 +13}.. {1004792400 50400 1 +13}.. {1012046400 46800 0 +13}.. {1478350800 50400 1 +13}.. {1484398800 46800 0 +13}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.913386161054243
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG9CoveyXHAIgObT9CuYFARL/nUDHqAOsvUDH9Coy:SlSWB9vsM3yckGeSHAIgObkXFAN/TAO2
                                                                                                                                                                                    MD5:643A77CAA5D7E031418C150A2D114BC4
                                                                                                                                                                                    SHA1:BE00B59D7AEB6AAB871D87A1C6243233833C4539
                                                                                                                                                                                    SHA-256:BDD8C779AF9D671AD7F20832FFF8EB3B25C9989A619C23337743F112FF4C8764
                                                                                                                                                                                    SHA-512:1CC7BFC35FB4FFE9517F0E6C9CA52E4FC71BFBA9E85F77773E490BCB3EF5F0C041E3C24A08A9A39F749161AB6F4027F703A254CF6158C1AC31E9CFBDBAAA2A45
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chuuk)]} {.. LoadTimeZoneFile Pacific/Chuuk..}..set TZData(:Pacific/Truk) $TZData(:Pacific/Chuuk)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):150
                                                                                                                                                                                    Entropy (8bit):4.981440234973766
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHpDFNMXGm2OH4VkxYoHvmcDVv0UIoAov:SlSWB9eg/8Dm2OHYkxYoHvmyv0YAov
                                                                                                                                                                                    MD5:11F5DFD4F782517FAEFBB7D7FEF3CED6
                                                                                                                                                                                    SHA1:B511E65FCB17E8910E347DE1C94B5BCF1A9A6081
                                                                                                                                                                                    SHA-256:2D18D9AB10C9D8947A88D486D0BC0B0523049A2ED2CA2FBDFA0577E40F189D13
                                                                                                                                                                                    SHA-512:0F72C4ACF54758B61ECC4584B86C0257178D0A82C98076C56B417DC4D0CB6743FD1D47E5DBC5EE9635E8297704C86F6841DB4704706C96F89F47D0CE55883230
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Wake) {.. {-9223372036854775808 39988 0 LMT}.. {-2177492788 43200 0 +12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):152
                                                                                                                                                                                    Entropy (8bit):4.977211872736631
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QF08x/nUDHpEYdNMXGm2OH3UPoHvmcCRQH0UIoAov:SlSWB9eg/tiDm2OHkPoHvmiH0YAov
                                                                                                                                                                                    MD5:DA5CFD5BFC06355B732CAFB11B2BBBCA
                                                                                                                                                                                    SHA1:5AA3838C8799CE33D261331971E42494E2A88041
                                                                                                                                                                                    SHA-256:A3D83E6C504EAC75C4CD87B696F0DF2703D0A78DF27D8B1FAC161ACB07F2A9DE
                                                                                                                                                                                    SHA-512:95444BDD838DAF8C4B70BFE0345C7437DF5E1FA8BF3C8E4AD43C3F9887B2B4A1885E8EDDBE5EF7306BEBFBF597A662603001A5EF4144F204A6EDAB9A5D671EC0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Wallis) {.. {-9223372036854775808 44120 0 LMT}.. {-2177496920 43200 0 +12}..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179
                                                                                                                                                                                    Entropy (8bit):4.935135597072032
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG9CoveyXHAIgObT9CuYFARL/nUDHnHPUDH9Coy:SlSWB9vsM3yckGeSHAIgObkXFAN/eBl
                                                                                                                                                                                    MD5:BF20184F9BBBE1E43490F93E97DA202D
                                                                                                                                                                                    SHA1:D44B0A82DCE2131BDB52BFE70B8B59F412551B52
                                                                                                                                                                                    SHA-256:E348A2D02966CF9599B5F6F1F5B6C3412113DEF548BD322F0C22376106E12D92
                                                                                                                                                                                    SHA-512:C1BA813BB3F8628866C1042669051C2763FD2B13CA724CB91F0BEC0CF97D77FFF353157036C789D3589238D7FC013FB61248356CFB8D14C54D9EE525AF2D1331
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chuuk)]} {.. LoadTimeZoneFile Pacific/Chuuk..}..set TZData(:Pacific/Yap) $TZData(:Pacific/Chuuk)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):174
                                                                                                                                                                                    Entropy (8bit):4.940195299412468
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVqEGIV5XHAIgoqpEGYvWARL/nSi67x/yQa0EGIy:SlSWB9vsM3ymc4HAIgocVAN/27x6qF
                                                                                                                                                                                    MD5:E6AA2F6A05B57AA9B4AEF8E98552EEB2
                                                                                                                                                                                    SHA1:22470C204152702D8826CA52299E942F572C85ED
                                                                                                                                                                                    SHA-256:C27E1179B55BF0C7DB6F1C334C0C20C4AFA4DBB84DB6F46244B118F7EAB9C76E
                                                                                                                                                                                    SHA-512:B28A264907C32F848D356FB0F5776C2CE819DCB6BC08A5E2DCD4FA455EE1616966E816748079C7A55485BABFFB292D567E6F958168F945889E33A267B0E7EDA9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Warsaw)]} {.. LoadTimeZoneFile Europe/Warsaw..}..set TZData(:Poland) $TZData(:Europe/Warsaw)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):176
                                                                                                                                                                                    Entropy (8bit):4.9353841548970205
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVxMvLS3vXHAIgoqyMvLL6RL/nM24h8QavMvLBn:SlSWB9vsM3ymvMv2PHAIgovMvH6N/e8i
                                                                                                                                                                                    MD5:7D7BD6E40D3ADCA04754255D69B5CC9D
                                                                                                                                                                                    SHA1:EE32167B450DE7B0F1A15199795AEF9524BE623B
                                                                                                                                                                                    SHA-256:EFD666F3062D52C5D0B4F83B1A206E6840C1EAEC356CD77A0A71C7EDFA78C964
                                                                                                                                                                                    SHA-512:6056AAF078316A89079D19555F0BAEFB4C1CDBAA5426A8BEE76E0BFA5C69A5DAAFD199DEF978ABD67287AE1B80F754B7845EAFD5CC0995FE10E44D1F34D5435C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Lisbon)]} {.. LoadTimeZoneFile Europe/Lisbon..}..set TZData(:Portugal) $TZData(:Europe/Lisbon)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):165
                                                                                                                                                                                    Entropy (8bit):4.795776391333205
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8qMveyXHAIgNqBLFARL/lOr4WFKfMy:SlSWB9vsM3yKMveSHAIgcBJAN/S4wKfB
                                                                                                                                                                                    MD5:C5AE3A1DAD32C870651C74E367F604CF
                                                                                                                                                                                    SHA1:9FF81383C43D98441841E182BC783381EF565204
                                                                                                                                                                                    SHA-256:9AEC39777013B23D63D0509EBB2F01D57A2C1592264DBB19CE2C61C7D7DDD8DE
                                                                                                                                                                                    SHA-512:3A7217ED885011972262B71DB7F5D7E4C9C6E82B4BEEF0718BCB9452E49FDBDD5ED78564156577AB09150140B862E1944B4B739BCE0C50E63667050C35329503
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Taipei)]} {.. LoadTimeZoneFile Asia/Taipei..}..set TZData(:ROC) $TZData(:Asia/Taipei)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):162
                                                                                                                                                                                    Entropy (8bit):4.900717350092823
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq8ZQckovXHAIgNtvQMHRL/lmFeWFKKQ7:SlSWB9vsM3yJJHAIgbHN/pwKv
                                                                                                                                                                                    MD5:59E4C80F97FAFC92987B08BFA03B5EE5
                                                                                                                                                                                    SHA1:4F86FCE17A51C3789DEB887BE01A1A0E6EA3D2DE
                                                                                                                                                                                    SHA-256:63153B40225270ADB7CD248788CA9F18C6DEBAF222B3165BBAB633337592DF44
                                                                                                                                                                                    SHA-512:9FCC0F747096775D0FB8DD252A73E6F47C16BF2D7DB0C3FBDFD206EE57393276FB40F65C1441296AE2AC115CFEE11098474DF3FEF8EE1FABE139427A8991F052
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Seoul)]} {.. LoadTimeZoneFile Asia/Seoul..}..set TZData(:ROK) $TZData(:Asia/Seoul)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.85623787837429
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyq801c3vXHAIgNtK1tyHRL/kZ8O5h4WFKf1z:SlSWB9vsM3yUgHAIgWv6N/kth4wKf9
                                                                                                                                                                                    MD5:5EABBAAF3B29B5DFF9E54136F7ABC654
                                                                                                                                                                                    SHA1:44615F03264012D97512F9AB386413DD72BE1090
                                                                                                                                                                                    SHA-256:B9443FB17F0128DDB9F2DF657DC5D2DF176F64C61B0D02B272E5DFB108537678
                                                                                                                                                                                    SHA-512:B930D637A1E69E0847ADDEAB013B2C25BC27EBB9CDF20B9CDDFDAC111E9F26BB5EBC83194E845ACC3E1B9A08C386C94FCC4FDE32292EB558E3F7463832BB38B9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Singapore)]} {.. LoadTimeZoneFile Asia/Singapore..}..set TZData(:Singapore) $TZData(:Asia/Singapore)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):201
                                                                                                                                                                                    Entropy (8bit):4.996391010176349
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSNJB9vsM3y7p5oeSHAIgppON/kjx+90ppv:JByMYbpwt8+90b
                                                                                                                                                                                    MD5:1AC81E2C60D528A6C5BF2E6867146813
                                                                                                                                                                                    SHA1:73D2D24FE6D56CA34ABF11B9A95DC22F809C5158
                                                                                                                                                                                    SHA-256:978C4E5256057CE7374AD7929605090FC749B55558495BD0112FB0BB743FA9C2
                                                                                                                                                                                    SHA-512:DB2673FB54C1308BBEB298A186F9130FB9090CE33B958C82D62B9BD88EE39BAB9A1BE40645547BA4167FD475892A323CF8EBA16C97F6FDF5693F1BF7A313FE9A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:SystemV/AST4) $TZData(:America/Puerto_Rico)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):192
                                                                                                                                                                                    Entropy (8bit):4.9470542553730255
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/kRDwh4IAcGE2NEOyn:SlSNJB9vsM3y7UEOXHAIgpUEqA6N/k+H
                                                                                                                                                                                    MD5:2AB4B896957F26B114A990F69989F3FB
                                                                                                                                                                                    SHA1:8048C99F5EE02C021F311709B30EB28D650D884D
                                                                                                                                                                                    SHA-256:0114C111F5BCD838A28F2E16E01ECB79D8AFC8CBF639A672889ED0D692FC6CDC
                                                                                                                                                                                    SHA-512:353744359CD94B1E8184A8B83F762459C69D3AEEA43DA638C1F4CC34E01E9D86C2EBCF7F7BFD059CB23B64051510D1C4556A49D180F8A92DE8449139194DCDC9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:SystemV/AST4ADT) $TZData(:America/Halifax)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.957831162100758
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/kR/eIAcGEsAzEpv:SlSNJB9vsM3y7hzi2HAIgphznN/kc90q
                                                                                                                                                                                    MD5:3EC0B09EAB848821D48849673B24401C
                                                                                                                                                                                    SHA1:41599CBA78E124A7DA9744D2B4EA8CDC10008E0B
                                                                                                                                                                                    SHA-256:30428B85B37898AD98B65BE5B6A8BD599331D9A1B49605FC6521464228E32F8F
                                                                                                                                                                                    SHA-512:9A3303B3338C01B281A40BB48B93C446ADB92BBDC45371667F09EDA92F9EE2AEC60CE8E98CE15C0112B823799C76AEF14895B15DC997DA506494D75BBE58D662
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:SystemV/CST6) $TZData(:America/Regina)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):192
                                                                                                                                                                                    Entropy (8bit):4.975428048518589
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx096yXHAIg20961yHRL/kRwx/h4IAcGE967:SlSNJB9vsM3y796SHAIgp9616N/kyxpQ
                                                                                                                                                                                    MD5:D85CCC5EFAA1ED549D02F09A38A53C68
                                                                                                                                                                                    SHA1:642ED571E4C6F60A953D42DA4F756F2262E4E709
                                                                                                                                                                                    SHA-256:44BEF7D4660A9A873EB762E3FDC651D31D97893545DE643FA1B2D05991C090A1
                                                                                                                                                                                    SHA-512:3CC6A14A17EA4833958A7D444073D6C2709FD61BF54387E5C362151E9143F795B2432B621080DD53E0FC9BDD7C58F406E046E3D0A2BBA4132D99E7C705E6D645
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Chicago)]} {.. LoadTimeZoneFile America/Chicago..}..set TZData(:SystemV/CST6CDT) $TZData(:America/Chicago)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):4.928128138328689
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSNJB9vsM3y73G7JHAIgp3GZRN/kkp4903G8:JByMY3G7Kp3GntVp4903G8
                                                                                                                                                                                    MD5:506D15E2F37F501F5A592154142A5296
                                                                                                                                                                                    SHA1:5ACA12E0BA0FFF9734ED978A9C60AAA9D1E05A59
                                                                                                                                                                                    SHA-256:798F92E5DDA65818C887750016D19E6EE9445ADFE0FCB7ACB11281293A09C2C7
                                                                                                                                                                                    SHA-512:2EE08D39461CAD3492BE88B421BA463B4CEB8497F036518794BCF605F477057FEA218A9DFBB6335A28A5120750EA06AED9D2EA84CD0007D34CDE562DCD79CC0C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indianapolis)]} {.. LoadTimeZoneFile America/Indianapolis..}..set TZData(:SystemV/EST5) $TZData(:America/Indianapolis)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):195
                                                                                                                                                                                    Entropy (8bit):5.113680059406992
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSNJB9vsM3y71RHAIgp1aAN/krp4901Yn:JByMY4pltw+90q
                                                                                                                                                                                    MD5:AAD8EF3067E97785D4052B80F5C4ACE1
                                                                                                                                                                                    SHA1:3EF0A06FCC41119F4A60A32CED0E5A1E0E8B4300
                                                                                                                                                                                    SHA-256:D159140114A13C69F073CFE9AD0B67D713E8811CBFF773A3D1681FC38EA0E699
                                                                                                                                                                                    SHA-512:A8774ADF6818D85476A6C147A45E55B338F413CD9B61BF9FDB0CB7A335C0CE8F8C6D1970783FEFECC2CE18388DF91304CB295BD4DFD29FB538D74F6A414A441D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/New_York)]} {.. LoadTimeZoneFile America/New_York..}..set TZData(:SystemV/EST5EDT) $TZData(:America/New_York)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):193
                                                                                                                                                                                    Entropy (8bit):4.9733028894475195
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSNJB9vsM3yc6e8SHAIgOb6eKAN/kQmrheo:JByMdniinbtRTo
                                                                                                                                                                                    MD5:458061B3F3C8F06C61B5726393A26BA2
                                                                                                                                                                                    SHA1:E894F5615654D1110C9964B8F6A54C048442D8EB
                                                                                                                                                                                    SHA-256:BF62C8650BBA258000F62F16B0C7CBB66F4FD63F8CFDAF54273BB88A02A6C8D6
                                                                                                                                                                                    SHA-512:6A161A7AE44CBF8CE4C704C94456A5B714AAF2A3FAF30731254C9FE056F9DDF207119D516CC6A4C44AE76EC078F5C59F5EC6DD6701FAA3A36F061AF3953B7C7D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:SystemV/HST10) $TZData(:Pacific/Honolulu)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.999038624718282
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/kRgFfh4IAcGEuto:SlSNJB9vsM3y7OBHAIgpONYyHN/kch4y
                                                                                                                                                                                    MD5:B06AB4998A57446FC4D5A5B986BCA0A9
                                                                                                                                                                                    SHA1:5E4A28466383CBAB2067B9B6D22882CF6D83C3FB
                                                                                                                                                                                    SHA-256:FEBE49FAE260E5595B6F1B21A0A3458D8A50ACA72F4551BF10C1EDB2758E0304
                                                                                                                                                                                    SHA-512:9E44174C4E348E1B768039585BA6393FD001B606E111092EEC57C75210A1E87BF3C72728321945D584CA60D4C848D88EB8B2F82CB88F38F90224A43FDCFEA9AA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:SystemV/MST7) $TZData(:America/Phoenix)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.956231227702093
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/kRMMFfh4IAcGE6RB:SlSNJB9vsM3y7+SPHAIgp+ON/kD490+B
                                                                                                                                                                                    MD5:5D3C1ADB8AC4EAC9E9A31734CD6884BD
                                                                                                                                                                                    SHA1:535B024EA088B9B192BE4206CBDD56BC5B163762
                                                                                                                                                                                    SHA-256:64556A7B20E425C79375C2A7CCF72B2B5223A7DE4FF4C99A5C039DB3456C63F6
                                                                                                                                                                                    SHA-512:FB799A42880613752AD6010D7B4E97ACCF7F6AE281D9A37057F6423AEF2607B608DB2AC52176F1653D8B2D086223C9658B101E73125F0FF7D6D9E8CD876EEC53
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:SystemV/MST7MDT) $TZData(:America/Denver)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):192
                                                                                                                                                                                    Entropy (8bit):4.831981174214766
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqTQGuQTWLM4YkovXHAIgObTuQTWLovFvHRL/kRQB5nv:SlSNJB9vsM3yciQyLM4YJHAIgObiQyLQ
                                                                                                                                                                                    MD5:B568B46A0207800D9C022BAB1E48709B
                                                                                                                                                                                    SHA1:71CE3F0E75E440D5BBA219BCBB92AF9C1F5A7466
                                                                                                                                                                                    SHA-256:0B8227AFC94082C985E8E125DF83E5EFADE7CD9CA399800D7B8E8B2BEAE22C7D
                                                                                                                                                                                    SHA-512:5067AAD0CD02EBDECA6980F9C7CCC80D076C34D6463C5B6B19B678D76B5E69C1C3639D046F56FE9D6255CBEA49189EDD735F66AD9EE2CB0389BE020E7ED3AD50
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pitcairn)]} {.. LoadTimeZoneFile Pacific/Pitcairn..}..set TZData(:SystemV/PST8) $TZData(:Pacific/Pitcairn)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):204
                                                                                                                                                                                    Entropy (8bit):5.003766957083974
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSNJB9vsM3y7DvPHAIgp5N/kQ1p490Dy:JByMY8p5th090W
                                                                                                                                                                                    MD5:7E587175CA0F938C47FA920D787C57BD
                                                                                                                                                                                    SHA1:C3F7D8576C0AC74D6B70F4363EE2C174FADC70B0
                                                                                                                                                                                    SHA-256:D51D9549835E9C058F836C8952932CB53C10F7F194CD87452E9B13494D1C54C9
                                                                                                                                                                                    SHA-512:4460686AAA470F07A6DB1F8957FA4DB600E116273497F46E8A2D3FDECF622122DF753556B78C39FA2ADFDB2AF3C3ABB3C330ADA79B35C6A3CD8C498A0319CEE6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:SystemV/PST8PDT) $TZData(:America/Los_Angeles)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.9524733332469095
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFLLJJT8QFtFb+MuUyqTQG5hB5WXHAIgObT5hByY6RL/kRKlUDH5hBpvn:SlSNJB9vsM3ycT2HAIgOboN/kNv
                                                                                                                                                                                    MD5:5970A466367825D72D9672293FCD4656
                                                                                                                                                                                    SHA1:1A736D61A6797295EEC8C094AED432171E98578E
                                                                                                                                                                                    SHA-256:55710EFDED5B5830B2F3A2A072037C5251E1766F318707ED7CD5EB03037FED43
                                                                                                                                                                                    SHA-512:1F2A1B2A7D0A3E410652546C174D9EC18C91C9327F11C384A0AA1EB12D7EFE85C4D53CA3C2A6C347C0068A4CE92A3138EB17232B0DEC88D52465C5DEDEEE6827
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Gambier)]} {.. LoadTimeZoneFile Pacific/Gambier..}..set TZData(:SystemV/YST9) $TZData(:Pacific/Gambier)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):198
                                                                                                                                                                                    Entropy (8bit):4.994125896811442
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSNJB9vsM3y7/9EtDSHAIgp/9Ef6N/kB490/9E9v:JByMY/947p/9XtN90/9s
                                                                                                                                                                                    MD5:560B18DFB138DAF821CFDAE017B94473
                                                                                                                                                                                    SHA1:0BB0312C742CC0097DF033656AE3D10723035C30
                                                                                                                                                                                    SHA-256:DA20018DE301F879E4F026405C69FA0370EB10184FE1C84A4F1504079D5DAFA1
                                                                                                                                                                                    SHA-512:B1D4EAD5F549E319DAD55EE67DAFD732E755164748C08633AA8F07C280B2CF617380D6F886304142D0E4D50026E63678DACFBE2DC809F780BA4CFF35A90DE906
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Anchorage)]} {.. LoadTimeZoneFile America/Anchorage..}..set TZData(:SystemV/YST9YDT) $TZData(:America/Anchorage)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):180
                                                                                                                                                                                    Entropy (8bit):4.9295990493611495
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/jCl1yQaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/SymKv
                                                                                                                                                                                    MD5:1FABF2DFD4BFD0184AE22ED76F7569E5
                                                                                                                                                                                    SHA1:5859266B26357B4FCADD7EC65847667631E303EB
                                                                                                                                                                                    SHA-256:8471A5575B9D9E47412D851A18A26C4405480540AABC8DAED5F81BE0C714C07C
                                                                                                                                                                                    SHA-512:1DCBECEF6D1F923E6C9CEA70CB10F1FF4E453265966AA88FBC8739E93EF40F8A16AAD85AF4ECC5CC1E52F22F49E5D3F4EE01A97DE2302FC4FBC063FE814F3851
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Turkey) $TZData(:Europe/Istanbul)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                    Entropy (8bit):4.844017562912325
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iGMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/iP8RX
                                                                                                                                                                                    MD5:DA060D2F397C978E0842631B4EC73376
                                                                                                                                                                                    SHA1:649BC85430B04662BE079C0AAD43DF5D5D499D28
                                                                                                                                                                                    SHA-256:356A9BB6F831971C295CF4DCE0F0CDC9EDF94FD686CA3D3195E5F031A0B67CBA
                                                                                                                                                                                    SHA-512:3359BFC6F0837D2DA9D72DA8053773CE0C1A1B1A47C33163BF38965E2104F57BC147F9EEC228A3591B75BF1BA93285AB83E8427E8E2E697AB18501DC017B6E6A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:UCT) $TZData(:Etc/UTC)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):189
                                                                                                                                                                                    Entropy (8bit):4.911775112130145
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/VXEtDovXHAIg20/VXEfovRL/iOGl0IAcGE/VXEN:SlSWB9vsM3y7/9EtDSHAIgp/9Ef6N/i4
                                                                                                                                                                                    MD5:4379C0BF618649AA07CC4BDAC75F62EF
                                                                                                                                                                                    SHA1:7813B54BF2BD0C40A39CA9A29CC50C6D034880A3
                                                                                                                                                                                    SHA-256:CED56F09D68BE00555219594C7B2F3E7EFE8323201FB3E2AA0E1FA9A6467D5AF
                                                                                                                                                                                    SHA-512:AC822061F5C9743120A66E11C02B199253A40460A87F78DC154B0BDD91E410EDDA581E889F5D2A74670939034F39A7F6C7E814E038A1371DAB71EF79A8911AE7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Anchorage)]} {.. LoadTimeZoneFile America/Anchorage..}..set TZData(:US/Alaska) $TZData(:America/Anchorage)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):176
                                                                                                                                                                                    Entropy (8bit):4.8886795125313585
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0/yO5WXHAIg20/yOoNvWARL/iObMEIB/4IAcGE/y2:SlSWB9vsM3y7/yrHAIgp/yH0AN/itE8h
                                                                                                                                                                                    MD5:AB14CF1840CBDA2B326660DBD51273B4
                                                                                                                                                                                    SHA1:78144B3A2C75568307E4E86AE3B01EA7F541B011
                                                                                                                                                                                    SHA-256:A4F1398CF84D0AE09BF19288770756622D1710CCBFBFE79E0D3239497731287D
                                                                                                                                                                                    SHA-512:557A3ED9D1401E76291DC41524A1FD04AFF0829CEF66E103CEF9D10CD751F04FDEB6B7C0490302C71297F53AA8DC42930649AD274215D5DF068BCDE837E73756
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Adak)]} {.. LoadTimeZoneFile America/Adak..}..set TZData(:US/Aleutian) $TZData(:America/Adak)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):184
                                                                                                                                                                                    Entropy (8bit):4.9334626069754455
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/iQMfQfBx+IAcGEB:SlSWB9vsM3y7OBHAIgpONYyHN/iZfQfl
                                                                                                                                                                                    MD5:30ED80335BE37C7CBA672C33FDE23490
                                                                                                                                                                                    SHA1:B627E86F023FE02A5590FE8D55FF41946BE6D24B
                                                                                                                                                                                    SHA-256:9503403F231BA33415A5F2F0FDD3771CE7FF78534CE83C16A8DB5BC333B4AD8A
                                                                                                                                                                                    SHA-512:C1352612EC0B4FF2F6F279CDB6008D7E9DA7F94F0009EFD959AD3092393150ECA83A09E72C724E1A4BFC3A057B9218D54A87FFA1102E2D9BF058B78AC0A0B1AB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:US/Arizona) $TZData(:America/Phoenix)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):184
                                                                                                                                                                                    Entropy (8bit):4.90255068822036
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx096yXHAIg20961yHRL/ibXgox/h4IAcGE967:SlSWB9vsM3y796SHAIgp9616N/iB490+
                                                                                                                                                                                    MD5:7770A6B85B2FE73BCCE9D803E0200F23
                                                                                                                                                                                    SHA1:784AD1082FF1569961C2AC44F6D6F7605FBBE766
                                                                                                                                                                                    SHA-256:B6AC9FAE0AB69D58ECFD6B9A84F3C6D3E1A594E40CEEC94E2A0A7855781E173A
                                                                                                                                                                                    SHA-512:EEE79D37D77E6B80B91E8F30CE48B107371F6A58F0C91785E3C74EF210AE1011D0EB913113F1873BE6099B0BE1260410F0C74650446CB377F8FDB5505A44F266
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Chicago)]} {.. LoadTimeZoneFile America/Chicago..}..set TZData(:US/Central) $TZData(:America/Chicago)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):228
                                                                                                                                                                                    Entropy (8bit):4.7645631776966715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/i3E0903GK8:MByMY3GK7Kp3GKnti3t903GK8
                                                                                                                                                                                    MD5:96828B6BA17CA96723794F4B3744B494
                                                                                                                                                                                    SHA1:C3A824A925AEFE2A13A0E65548078D9842C2C7D7
                                                                                                                                                                                    SHA-256:5D86F8D36598516FB2342A18A87DB2701BABD265B0671CC9321C48DB22C7ECA5
                                                                                                                                                                                    SHA-512:2A27A455787DEAC3EC78A2784FB989DAB178E9D6DD7721CD3F5D3337231A3C651994B964D6CE040B7858E0127D7F70C0C48CB0D553D5B725B649C828288224B5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:US/East-Indiana) $TZData(:America/Indiana/Indianapolis)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):187
                                                                                                                                                                                    Entropy (8bit):5.0345860115708785
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0wAy0vfXHAIg20wAyGWARL/i37oxp4IAcGEwAy0yn:SlSWB9vsM3y71RHAIgp1aAN/i37oxp4P
                                                                                                                                                                                    MD5:375DB249106C5D351CA0E84848835EDB
                                                                                                                                                                                    SHA1:ECC5C0C9DA68773B94C9013F4F1A8800D511CC4C
                                                                                                                                                                                    SHA-256:2FFCAD8CBEF5ECDC74DB3EE773E4B18ABC8EFA9C09C4EA8F3A45A08BADAF91A9
                                                                                                                                                                                    SHA-512:21550743BF4E1A79754F76AB201F0EB6BA6B265F43855901640054316A4A32A5D01D266B2441E4A6415720715A2ABD367D82E3D40949A7A66BE9F8366E47A8DD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/New_York)]} {.. LoadTimeZoneFile America/New_York..}..set TZData(:US/Eastern) $TZData(:America/New_York)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):186
                                                                                                                                                                                    Entropy (8bit):4.88075715646936
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQG2fWGYFeyXHAIgObT2fWKARL/ioMN75nUDH2fWWv:SlSWB9vsM3yc6e8SHAIgOb6eKAN/ioER
                                                                                                                                                                                    MD5:C0475756CFEC302F737967468804846E
                                                                                                                                                                                    SHA1:85C13CA0A908C69B8BBB6040FC502AFF96B8F8C7
                                                                                                                                                                                    SHA-256:529BB43EFDA6C1584FEAEA789B590CEF1397E33457AB3845F3101B1FC126E0FB
                                                                                                                                                                                    SHA-512:D3FF374443344E8438D50803872E8A8EA077B2299B38C1BD155386B4D2C6008BBD0C0B0B26DE9680812D4AFC9A187B644BDCCB04C23880337228BCEC06D5D61B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:US/Hawaii) $TZData(:Pacific/Honolulu)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):206
                                                                                                                                                                                    Entropy (8bit):4.87340978435866
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:SlSWB9vsM3y73GKaHAIgp3GKIN/iGIfh4903GKT:MByMY3GKDp3GKItiBfh4903GKT
                                                                                                                                                                                    MD5:00AAFD60A0B1146274981FAB6336AFD9
                                                                                                                                                                                    SHA1:20AD47ED52874202585C90FE362663F060E064D3
                                                                                                                                                                                    SHA-256:5827B6A6D50CF0FB75D6BA6E36282591AD25E1F0BE636DCFC5D09BDA29A107FD
                                                                                                                                                                                    SHA-512:61113AB72B7D671D7B429106709E73DB57D5B8A382680BA37A54126C7F54BC2D6B47A2584177CE6B434793546DA7EB9B8B7DF9163816DBFC67C83D9930D6A158
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Knox)]} {.. LoadTimeZoneFile America/Indiana/Knox..}..set TZData(:US/Indiana-Starke) $TZData(:America/Indiana/Knox)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):185
                                                                                                                                                                                    Entropy (8bit):4.83459089067994
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06FQGFfXHAIg206FQJARL/iHaMCELMr4IAcGE6FQB:SlSWB9vsM3y74PFPHAIgp4KAN/iHaMHs
                                                                                                                                                                                    MD5:D955A5A943B203DC4B87A91ED196B82A
                                                                                                                                                                                    SHA1:C7ACC48AB2033C372C60C741F68B12FFAEA147DE
                                                                                                                                                                                    SHA-256:B4E4269C4FEBFEFF26750B297A590226C0A6872519A6BFDE36F6DC3F6F756349
                                                                                                                                                                                    SHA-512:445DC9A50487A4BA0A7F79078441696DCAA31F9988E5B515B5A827AC9275776B22DE303040900C1726EB99CABA8AD09E57AA674F798EA3FDEBC580E4B87D9439
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Detroit)]} {.. LoadTimeZoneFile America/Detroit..}..set TZData(:US/Michigan) $TZData(:America/Detroit)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):182
                                                                                                                                                                                    Entropy (8bit):4.892777905787396
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/iBOlLo/4IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/iBY8/49Z
                                                                                                                                                                                    MD5:E53EDD55E6448C624DD03A8A100EF5AF
                                                                                                                                                                                    SHA1:1D266553CAFA23A3375CFAF7AFE6636553CC7B70
                                                                                                                                                                                    SHA-256:3763BF520D3C97148C34DCFBDF70DEC2636D4E38241555900C058EFEE3BD1256
                                                                                                                                                                                    SHA-512:B7FCF01DBB4231F30FEFA77C339B2CD7D984D6E6182F3BD15D6B64AC9525994E7CBF90C3F1F520FD22B54E19831B3CBAE1C22F04F60244C0C60A1809942422A4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:US/Mountain) $TZData(:America/Denver)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):196
                                                                                                                                                                                    Entropy (8bit):4.932311644026309
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0ydJg4o3vXHAIg20ydJPyHRL/iP+e2IAcGEydJgov:SlSWB9vsM3y7DvPHAIgp5N/ip290Dy
                                                                                                                                                                                    MD5:37AF94FAB52D80AF32C766644892E36D
                                                                                                                                                                                    SHA1:03CE96A3B3EBFC16C9ED192DD2127FB265A7ED49
                                                                                                                                                                                    SHA-256:54E5F126D4E7CC13555841A61FF66C0350621C089F475638A393930B3FB4918C
                                                                                                                                                                                    SHA-512:405A7F414FA0864111E5E9F06FCA675BF4EF11FE0F82F5438416273BEF820A030A50E4D43E4E522ED79C08C0C243E9DD3692971DC912C9ADFB1BEABEB935CDDC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:US/Pacific) $TZData(:America/Los_Angeles)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):200
                                                                                                                                                                                    Entropy (8bit):4.977247045064076
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqx0ydJg4o3vXHAIg20ydJPyHRL/iP+yoQIAcGEydJgy:SlSWB9vsM3y7DvPHAIgp5N/i0Q90Dy
                                                                                                                                                                                    MD5:870946B6C9C7C48EDDFDC7FEA5A303F5
                                                                                                                                                                                    SHA1:F4E86423BD0EDFFD07B69B6D8834E28890A433BF
                                                                                                                                                                                    SHA-256:B14C515D5823E7F6E4C67892FA376D54DB748FAB139C4D40DB50F22D113BAE4F
                                                                                                                                                                                    SHA-512:36071FA97BD1052FB0425FDA7239F55728B3A6ACDF78A7A8F92D080DA25C0DF432F6C2B0CE9BD296B0C814451C5D7922E1318B004D9089E934B9C81B5E6077D6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:US/Pacific-New) $TZData(:America/Los_Angeles)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):188
                                                                                                                                                                                    Entropy (8bit):4.838968615416201
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/i6A5nUDHurKeTyn:SlSWB9vsM3yciemHAIgObiecN/idXevn
                                                                                                                                                                                    MD5:509CF35F5F7C9567FD19CC5C137DC070
                                                                                                                                                                                    SHA1:AA5F27D36BC617A6A4107E3CA0CB0C10A71A1D9E
                                                                                                                                                                                    SHA-256:E51FC51C65FFEAB514D7636271157EE8941BDACF602CBC380F5D60B5FA674E87
                                                                                                                                                                                    SHA-512:E23633A16F11015F3FE2F4E675B5A60B4FDC61F8CF152FDB9BA7ED4C213B8897117721A78C5470296DAFB0FD4F0DDC019DD0DB8C28C1F1B2BE0D3A289F53D5B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:US/Samoa) $TZData(:Pacific/Pago_Pago)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):153
                                                                                                                                                                                    Entropy (8bit):4.844017562912325
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iLB5h8RFB:SlSWB9vsM3yzTHAIgm6N/iLfh8RX
                                                                                                                                                                                    MD5:3402C8784654C24F7E956731866B833F
                                                                                                                                                                                    SHA1:C34F3CCA074A50E6564B8C78683C8763B37A3002
                                                                                                                                                                                    SHA-256:DEE28FF84E3FC495ED3547D5E5E9FAFDACC36A67329E747D434248ED45BF1755
                                                                                                                                                                                    SHA-512:FBA2840B0FA0F084EE9840BCF56E497F8A7ABF509FA10FA66FB26BA3D80079C4F9A363577A453CD68557080EAF9DD7F1F7B5AF957B64BDA2A897B1E08C85DD19
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:UTC) $TZData(:Etc/UTC)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):159
                                                                                                                                                                                    Entropy (8bit):4.879221007428352
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iL7DJMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/iL7VMr8RX
                                                                                                                                                                                    MD5:5F24A249884C241D1E03D758C2641675
                                                                                                                                                                                    SHA1:63AAC15A68659006F8A14FEC3F2A66B55A8AC398
                                                                                                                                                                                    SHA-256:B7B0B82F471D64704E1D6F84646E6B7B2BD9CAB793FAD00F9C9B0595143C0AB7
                                                                                                                                                                                    SHA-512:A7AB5E26A2C23BA296942D7C524C6EE6708A9A38CDD88022EA92E2180BC3CCFE930758FC20A24A0D271AD70733EB924B0E530FBF83CC0FC49EAD411B28503CC0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Universal) $TZData(:Etc/UTC)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):172
                                                                                                                                                                                    Entropy (8bit):4.999171213761279
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqxVwTwWXHAIgoqzTbNOARL/gIuyQauTgvn:SlSWB9vsM3ymSHAIgoXAN/gXy5n
                                                                                                                                                                                    MD5:5444E85070CA2E7A52D38D6D53216B88
                                                                                                                                                                                    SHA1:0F9A4FB1156312EBD0B9C81DA2164E89D21878E1
                                                                                                                                                                                    SHA-256:F7DA75B585F45AB501B2889E272FF47B1C4A1D668E40AED7463EB0E8054028C2
                                                                                                                                                                                    SHA-512:BBC94F98C84641392D3A4B67C152E92EDB3011DA329319ADB2485DBEAFD44DED328D80FBCA89E58687E1F0EB6BED8580BBB0075CA42284B6206A8641D76F2DE5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Moscow)]} {.. LoadTimeZoneFile Europe/Moscow..}..set TZData(:W-SU) $TZData(:Europe/Moscow)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6945
                                                                                                                                                                                    Entropy (8bit):3.7806395604065135
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:v6PgDGfXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:rQbkIaFF1w0us4qE3+sSGjT
                                                                                                                                                                                    MD5:1EC38B05B53ECF2DD3A90164C4693934
                                                                                                                                                                                    SHA1:00900F0ADDB7526C63C67CA1662C038E95A79245
                                                                                                                                                                                    SHA-256:7E6E2369C19DD19A41BE27BB8AD8DF5BE8B0096ED045C8B2C2D2F0916D494079
                                                                                                                                                                                    SHA-512:47A8DAAB1B891FF09A94AF01B6673213392F70C6C1EE53D95A59D6E238FD06B0E80FA21C7279A9ADA891F5CA5B86E4D6B696EE8CFE14BFEF0ACCC9759AF1419A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit....set TZData(:WET) {.. {-9223372036854775808 0 0 WET}.. {228877200 3600 1 WEST}.. {243997200 0 0 WET}.. {260326800 3600 1 WEST}.. {276051600 0 0 WET}.. {291776400 3600 1 WEST}.. {307501200 0 0 WET}.. {323830800 3600 1 WEST}.. {338950800 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):154
                                                                                                                                                                                    Entropy (8bit):4.8800842076244715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/taFBURFB:SlSWB9vsM3yzTHAIgm6N/YFaRX
                                                                                                                                                                                    MD5:DDB6F69CA4F0EF6A708481F53F95EAB9
                                                                                                                                                                                    SHA1:A63E900A9257E9D73B4BB4BACBA8133C3D1DC41B
                                                                                                                                                                                    SHA-256:A06E8CCCF97CC8FB545DFDB4C89B5E5C8EDF0360547BDC1823B4AC47B1556C31
                                                                                                                                                                                    SHA-512:C8EA1039BE001F5EF52662B28DBF46D02E4848F08F05923850DEA1994732037B4C8D6030B742D97FA4276AF5FEE3F17C47C7DDA4F44DD23244F9976A076D5CC4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Zulu) $TZData(:Etc/UTC)..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5030
                                                                                                                                                                                    Entropy (8bit):4.838527643033185
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:HgTQWiZuhdFQJmuldFQofsGP3R1hF9Dl19arB0E9Dl1YoaEhHe2Gu/q1ZFyJRpqk:8iZUroxvR197ABr971h5GIqrmbqIc+b/
                                                                                                                                                                                    MD5:70450A0CF04EF273EFF2B070053FCFA6
                                                                                                                                                                                    SHA1:47974D6C0FC986EE1273C4E13DDB9E1288CEF0FF
                                                                                                                                                                                    SHA-256:678F891615E2209A8ECBA17857922A9723E78709ADB983032E89CA706000C44D
                                                                                                                                                                                    SHA-512:AFD3E47324D1497CC46AC6141191FCEB843977D0B0285C807FF8985DCC56FDE10977F57D503D986CD2C1EDC6C62F01E405A0EB483340B247B129FC8D6D9FE689
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# word.tcl --..#..# This file defines various procedures for computing word boundaries in..# strings. This file is primarily needed so Tk text and entry widgets behave..# properly for different platforms...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998 Scritpics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# The following variables are used to determine which characters are..# interpreted as white space.....if {$::tcl_platform(platform) eq "windows"} {.. # Windows style - any but a unicode space char.. if {![info exists ::tcl_wordchars]} {...set ::tcl_wordchars {\S}.. }.. if {![info exists ::tcl_nonwordchars]} {...set ::tcl_nonwordchars {\s}.. }..} else {.. # Motif style - any unicode word char (number, letter, or underscore).. if {![info exists ::tcl_wordchars]} {...set ::tcl_wordchars {\w}.. }.. if {![info exists ::tcl_nonwordchar
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8806
                                                                                                                                                                                    Entropy (8bit):4.863085192885279
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:RpwYLapGk1BlM4UBIHpJFVUXUziMJ5Kxyk55qxUr7Vdk5vNR:RuYfvMdOXyj+01f
                                                                                                                                                                                    MD5:C5E9A2E32AE83A79DF422D1145B692DF
                                                                                                                                                                                    SHA1:08350F930FB97A95970122920C91FB9CED8329E9
                                                                                                                                                                                    SHA-256:8822365EE279BEBF7A36CFDEDBA1114762F894781F4635170CC5D85FF5B17923
                                                                                                                                                                                    SHA-512:71420E15A3D63329560074F6FFAD42CB464401284BC29D0DC8E34D83F8F77079F26BB4C5703E656A48E6931C3DBF6B873756FB212D0860483E0301B29EDE1212
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# bgerror.tcl --..#..#.Implementation of the bgerror procedure. It posts a dialog box with..#.the error message and gives the user a chance to see a more detailed..#.stack trace, and possible do something more interesting with that..#.trace (like save it to a log). This is adapted from work done by..#.Donal K. Fellows...#..# Copyright (c) 1998-2000 by Ajuba Solutions...# Copyright (c) 2007 by ActiveState Software Inc...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>....namespace eval ::tk::dialog::error {.. namespace import -force ::tk::msgcat::*.. namespace export bgerror.. option add *ErrorDialog.function.text [mc "Save To Log"] \...widgetDefault.. option add *ErrorDialog.function.command [namespace code SaveToLog].. option add *ErrorDialog*Label.font TkCaptionFont widgetDefault.. if {[tk windowingsystem] eq "aqua"} {...option add *ErrorDialog*background systemAlertBackgroundActi
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):21612
                                                                                                                                                                                    Entropy (8bit):4.947590677310969
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:Tv7cBCAsj9oqlFFSsB3VfRt+lMpWaNwJgzCHarc6gAsj9oqlFFSsB3VlRtYlMpBz:TvweHBBTfIZxHBnZWqbJPBFIaVlCj26+
                                                                                                                                                                                    MD5:AEB53F7F1506CDFDFE557F54A76060CE
                                                                                                                                                                                    SHA1:EBB3666EE444B91A0D335DA19C8333F73B71933B
                                                                                                                                                                                    SHA-256:1F5DD8D81B26F16E772E92FD2A22ACCB785004D0ED3447E54F87005D9C6A07A5
                                                                                                                                                                                    SHA-512:ACDAD4DF988DF6B2290FC9622E8EACCC31787FECDC98DCCA38519CB762339D4D3FB344AE504B8C7918D6F414F4AD05D15E828DF7F7F68F363BEC54B11C9B7C43
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# button.tcl --..#..# This file defines the default bindings for Tk label, button,..# checkbutton, and radiobutton widgets and provides procedures..# that help in implementing those bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 2002 ActiveState Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for buttons...#-------------------------------------------------------------------------....if {[tk windowingsystem] eq "aqua"} {.... bind Radiobutton <Enter> {...tk::ButtonEnter %W.. }.. bind Radiobutton <1> {...tk::ButtonDown %W.. }.. bind Radiobutton <ButtonRelease-1> {...tk::ButtonUp %W.. }.. bind Checkbutton <Enter> {...tk::ButtonEnter %W
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):329
                                                                                                                                                                                    Entropy (8bit):4.3973643486226655
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:nVxpJFBmHdeA1xNZgk0dIf3Ju4dFi6/XWrWhr3W7FxmVFraazmVAJFKyVQR7icr8:nj5Bqf1fZgp6A4FDG6dm7FUGAJVVMRmn
                                                                                                                                                                                    MD5:921245A21F7E783997DC7B859AF1B65B
                                                                                                                                                                                    SHA1:2EFE3C8F70CF18621006890BF21CC097770D140D
                                                                                                                                                                                    SHA-256:C6DB098EBD8A622164D37D4AB0A8C205DB1A83AC3065D5CDE3CB5FB61925D283
                                                                                                                                                                                    SHA-512:CAD823FF3D13A64C00825961E75B5133690556FB1F622834F8B1DF316A9E75BABB63B9F5148DAE7B1391123B4C8D55B4B8B2EB6F8E6E1DA9DE02A5BD7AC0FD6F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:README - images directory....This directory includes images for the Tcl Logo and the Tcl Powered..Logo. Please feel free to use the Tcl Powered Logo on any of your..products that employ the use of Tcl or Tk. The Tcl logo may also be..used to promote Tcl in your product documentation, web site or other..places you so desire...
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PostScript document text conforming DSC level 3.0, type EPS
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):34991
                                                                                                                                                                                    Entropy (8bit):5.248845410801251
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:0YrY6a0v4uIqYMEKjodQKOfRXMLcSqDGpfTKFVm3AsanMEDzzBHWzaw7XUbTJjoB:0YrY6aeIqYMEKjouzfRXMLcSqDGpfTKo
                                                                                                                                                                                    MD5:23C4EDED40DEC065F99E6653AEE1BB31
                                                                                                                                                                                    SHA1:3175E261BE198731DEDB07264CCB84C8DEDF7967
                                                                                                                                                                                    SHA-256:76207D8DFDE189A29DC0E76ADB7EAAA606B96BC6C1C831F34D1C85B1C5B51DD3
                                                                                                                                                                                    SHA-512:BA139A64BE72BB681040924C4294E2726BA5AB243E805E60A854D2D23E154705E2431D1AB2DE732BFA393747FD30D8A5C913895CBE1463DBF50CC23CAE5B0454
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL/TK LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:58 PM)..%%BoundingBox: 251 331 371 512..%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%DocumentCustomColors: (TCL RED)..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe Illustrator
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 68 x 100
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2341
                                                                                                                                                                                    Entropy (8bit):6.9734417899888665
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
                                                                                                                                                                                    MD5:FF04B357B7AB0A8B573C10C6DA945D6A
                                                                                                                                                                                    SHA1:BCB73D8AF2628463A1B955581999C77F09F805B8
                                                                                                                                                                                    SHA-256:72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
                                                                                                                                                                                    SHA-512:10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......*\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~*].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 43 x 64
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1670
                                                                                                                                                                                    Entropy (8bit):6.326462043862671
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
                                                                                                                                                                                    MD5:B226CC3DA70AAB2EBB8DFFD0C953933D
                                                                                                                                                                                    SHA1:EA52219A37A140FD98AEA66EA54685DD8158D9B1
                                                                                                                                                                                    SHA-256:138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
                                                                                                                                                                                    SHA-512:3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 354 x 520
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11000
                                                                                                                                                                                    Entropy (8bit):7.88559092427108
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
                                                                                                                                                                                    MD5:45D9B00C4CF82CC53723B00D876B5E7E
                                                                                                                                                                                    SHA1:DDD10E798AF209EFCE022E97448E5EE11CEB5621
                                                                                                                                                                                    SHA-256:0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
                                                                                                                                                                                    SHA-512:6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......*\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.*^.x.....J.L.!.'........=+eZ..i..ynF.8...].y|..m.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 87a, 120 x 181
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3889
                                                                                                                                                                                    Entropy (8bit):7.425138719078912
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
                                                                                                                                                                                    MD5:BD12B645A9B0036A9C24298CD7A81E5A
                                                                                                                                                                                    SHA1:13488E4F28676F1E0CE383F80D13510F07198B99
                                                                                                                                                                                    SHA-256:4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
                                                                                                                                                                                    SHA-512:F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.*&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..*K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:PostScript document text conforming DSC level 3.0, type EPS
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):29706
                                                                                                                                                                                    Entropy (8bit):5.33387357427899
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:0warY6a0v4uIqYMEKjodQKOfRtMLcSqDGpf88KFVmlhEtOI/eE7U0a1:03rY6aeIqYMEKjouzfRtMLcSqDGpfbKc
                                                                                                                                                                                    MD5:4AE11820D4D592D02CDE458E6F8CE518
                                                                                                                                                                                    SHA1:A2E8D3D6191B336D43E48A65C3AE6485B07D93C6
                                                                                                                                                                                    SHA-256:87FD9E46DBB5F2BF1529AFB411182C9FB9C58E23D830C66A233AF0C256BB8EFF
                                                                                                                                                                                    SHA-512:E0AD4ED570D414BF00931B0F5BBB61FEF981ABDB22ECC42F8E9841905D38874CDFE38F22EDB17ACD0F7539B2932F9C4A865FA73A49BB1458CE05EE10A78BE357
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL PWRD LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:59 PM)..%%BoundingBox: 242 302 377 513..%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe I
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 64 x 100
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1615
                                                                                                                                                                                    Entropy (8bit):7.461273815456419
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
                                                                                                                                                                                    MD5:DBFAE61191B9FADD4041F4637963D84F
                                                                                                                                                                                    SHA1:BD971E71AE805C2C2E51DD544D006E92363B6C0C
                                                                                                                                                                                    SHA-256:BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
                                                                                                                                                                                    SHA-512:ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8O*Z.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.|..pf!..&.......8.#.8.....*..J>. .t..h6(........#..0.A...*!..)...x..u.Z....*%..H.....*.......`......|.....1.......&.....T*...f.l...
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 97 x 150
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2489
                                                                                                                                                                                    Entropy (8bit):7.708754027741608
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
                                                                                                                                                                                    MD5:711F4E22670FC5798E4F84250C0D0EAA
                                                                                                                                                                                    SHA1:1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
                                                                                                                                                                                    SHA-256:5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
                                                                                                                                                                                    SHA-512:220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 113 x 175
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2981
                                                                                                                                                                                    Entropy (8bit):7.758793907956808
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
                                                                                                                                                                                    MD5:DA5FB10F4215E9A1F4B162257972F9F3
                                                                                                                                                                                    SHA1:8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
                                                                                                                                                                                    SHA-256:62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
                                                                                                                                                                                    SHA-512:990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....*0p}..KP?c.\@KW.S(..M..B.....-q...S2...*.,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.*4..(........*..F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 130 x 200
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3491
                                                                                                                                                                                    Entropy (8bit):7.790611381196208
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
                                                                                                                                                                                    MD5:A5E4284D75C457F7A33587E7CE0D1D99
                                                                                                                                                                                    SHA1:FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
                                                                                                                                                                                    SHA-256:BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
                                                                                                                                                                                    SHA-512:4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R...*...J.p.A.t.*..$A*...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y1*35.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. ...*..Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'|..M9..."...,*.......
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 48 x 75
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1171
                                                                                                                                                                                    Entropy (8bit):7.289201491091023
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
                                                                                                                                                                                    MD5:7013CFC23ED23BFF3BDA4952266FA7F4
                                                                                                                                                                                    SHA1:E5B1DED49095332236439538ECD9DD0B1FD4934B
                                                                                                                                                                                    SHA-256:462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
                                                                                                                                                                                    SHA-512:A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N|...f..J.x... P&.|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 100 x 100
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5473
                                                                                                                                                                                    Entropy (8bit):7.754239979431754
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
                                                                                                                                                                                    MD5:048AFE69735F6974D2CA7384B879820C
                                                                                                                                                                                    SHA1:267A9520C4390221DCE50177E789A4EBD590F484
                                                                                                                                                                                    SHA-256:E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
                                                                                                                                                                                    SHA-512:201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa....*.p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......Ef*Y3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2307
                                                                                                                                                                                    Entropy (8bit):5.135743409565932
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:XU/zAcKT6yOCaDBfsHLk32s3J5w83KDyP1BXy3JQz7yuC:XNc+92sg3A8uyDXy3JQnDC
                                                                                                                                                                                    MD5:F090D9B312C16489289FD39813412164
                                                                                                                                                                                    SHA1:1BEC6668F6549771DADC67D153B89B8F77DCD4B9
                                                                                                                                                                                    SHA-256:0D1E4405F6273F091732764ED89B57066BE63CE64869BE6C71EA337DC4F2F9B5
                                                                                                                                                                                    SHA-512:57B323589C5A8D9CBB224416731D8CE65C4B94146DF15CE30885DF63B1D0B3F709093B65390A911F84F20B7C5DE3C0AF9B4D7D531742BE046EDA6E8C3432EF6E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:This software is copyrighted by the Regents of the University of..California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState..Corporation, Apple Inc. and other parties. The following terms apply to..all files associated with the software unless explicitly disclaimed in..individual files.....The authors hereby grant permission to use, copy, modify, distribute,..and license this software and its documentation for any purpose, provided..that existing copyright notices are retained in all copies and that this..notice is included verbatim in any distributions. No written agreement,..license, or royalty fee is required for any of the authorized uses...Modifications to this software may be copyrighted by their authors..and need not follow the licensing terms described here, provided that..the new terms are clearly indicated on the first page of each file where..they apply.....IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY..FOR DIRECT, INDIRECT, SPECIAL, INCI
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15255
                                                                                                                                                                                    Entropy (8bit):4.9510475386072095
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
                                                                                                                                                                                    MD5:804E6DCE549B2E541986C0CE9E75E2D1
                                                                                                                                                                                    SHA1:C44EE09421F127CF7F4070A9508F22709D06D043
                                                                                                                                                                                    SHA-256:47C75F9F8348BF8F2C086C57B97B73741218100CA38D10B8ABDF2051C95B9801
                                                                                                                                                                                    SHA-512:029426C4F659848772E6BB1D8182EB03D2B43ADF68FCFCC1EA1C2CC7C883685DEDA3FFFDA7E071912B9BDA616AD7AF2E1CB48CE359700C1A22E1E53E81CAE34B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# listbox.tcl --..#..# This file defines the default bindings for Tk listbox widgets..# and provides procedures that help in implementing those bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....#--------------------------------------------------------------------------..# tk::Priv elements used in this file:..#..# afterId -..Token returned by "after" for autoscanning...# listboxPrev -.The last element to be selected or deselected..#...during a selection operation...# listboxSelection -.All of the items that were selected before the..#...current selection operation (such as a mouse..#...drag) started; used to cancel an operation...#--------------------------------------------------------------------------....#--------------
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9862
                                                                                                                                                                                    Entropy (8bit):4.786615174847384
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
                                                                                                                                                                                    MD5:D83ED6AC2912900040530528A0237AB3
                                                                                                                                                                                    SHA1:2D18E42A8B96C3D71C1C6701010FDF75C1E6D5D8
                                                                                                                                                                                    SHA-256:848258B946C002E2696CA3815A1589C8120AF5CC41FBC11BBD9A3F5754CC21AF
                                                                                                                                                                                    SHA-512:00B4CD0D58029FC37820C163A4AE1DEAD22FB5C767BDC118659EACE26D449C362189611DFB3FAB1AC129FABFEC2CE853EA2C10D418FAE5AEB91DDC9330FF782D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# megawidget.tcl..#..#.Basic megawidget support classes. Experimental for any use other than..#.the ::tk::IconList megawdget, which is itself only designed for use in..#.the Unix file dialogs...#..# Copyright (c) 2009-2010 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#....package require Tk.....::oo::class create ::tk::Megawidget {.. superclass ::oo::class.. method unknown {w args} {...if {[string match .* $w]} {... [self] create $w {*}$args... return $w...}...next $w {*}$args.. }.. unexport new unknown.. self method create {name superclasses body} {...next $name [list \....superclass ::tk::MegawidgetClass {*}$superclasses]\;$body.. }..}....::oo::class create ::tk::MegawidgetClass {.. variable w hull options IdleCallbacks.. constructor args {...# Extract the "widget name" from the object name...set w [namespace tail [self]].....# Configure things...
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39499
                                                                                                                                                                                    Entropy (8bit):4.928671503514817
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:NKJsO5OhIzOQjJwxzire5pKVjriecYyq4Cp5Zn2:NKJsO5LOQizire54lriecYf4V
                                                                                                                                                                                    MD5:078782CD05209012A84817AC6EF11450
                                                                                                                                                                                    SHA1:DBA04F7A6CF34C54A961F25E024B6A772C2B751D
                                                                                                                                                                                    SHA-256:D1283F67E435AAB0BDBE9FDAA540A162043F8D652C02FE79F3843A451F123D89
                                                                                                                                                                                    SHA-512:79A031F7732AEE6E284CD41991049F1BB715233E011562061CD3405E5988197F6A7FB5C2BBDDD1FB9B7024047F6003A2BF161FC0EC04876EFF5335C3710D9562
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# menu.tcl --..#..# This file defines the default bindings for Tk menus and menubuttons...# It also implements keyboard traversal of menus and implements a few..# other utility procedures related to menus...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# cursor -..Saves the -cursor option for the posted menubutton...# focus -..Saves the focus during a menu selection operation...#...Focus gets restored here when the menu is unposted...# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if..#...tk::Priv(oldGrab) is non
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):30840
                                                                                                                                                                                    Entropy (8bit):5.142909056222569
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
                                                                                                                                                                                    MD5:983C7B78F1A0EBACAB8006D391A01FCD
                                                                                                                                                                                    SHA1:7EA37474EA039ED7A37BFDD7D76EAE673E666283
                                                                                                                                                                                    SHA-256:C5BDCA3ABA671F03DC4624AB5FD260490F5002491D6C619142CCF5A1A744528A
                                                                                                                                                                                    SHA-512:A006EF9B7213E572F6FC540D1512A52C52FEC44E3A07846DE09662AE32B7191C5CF639798531847B39E4076BF9DD6314B6F5373065C04F4FEF221185B39C3117
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# mkpsenc.tcl --..#..# This file generates the postscript prolog used by Tk.....namespace eval ::tk {.. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically.. # handle any 8-bit encoding, but Tk never generates characters outside.. # ASCII)... #.. proc CreatePostscriptEncoding {} {...variable psglyphs...# Now check for known. Even if it is known, it can be other than we...# need. GhostScript seems to be happy with such approach...set result "\[\n"...for {set i 0} {$i<256} {incr i 8} {... for {set j 0} {$j<8} {incr j} {....set enc [encoding convertfrom "iso8859-1" \.....[format %c [expr {$i+$j}]]]....catch {.... set hexcode {}.... set hexcode [format %04X [scan $enc %c]]....}....if {[info exists psglyphs($hexcode)]} {.... append result "/$psglyphs($hexcode)"....} else {.... append result "/space"....}... }... append result "\n"...}...append result "\]"...return $result.. }.... # List of adobe glyph names. Converted from glyph
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:xbm image (32x, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):16786
                                                                                                                                                                                    Entropy (8bit):4.717927930017041
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:+haZOxBpK8uxGe4V88/wxY3Fxqipz4zz4zxxFzxT4OcErDxqdRRZeuC/Vj2CoopC:+hRWRG3FFjvsfCoopwITHzLHFHHAABs
                                                                                                                                                                                    MD5:217087AB6B2A8F9D7252E311D69C3769
                                                                                                                                                                                    SHA1:09AEB2BC5B7C7F4AB3DE4211D786C519AE0970F6
                                                                                                                                                                                    SHA-256:A07E3A3809CED3C6C9C1E171DCA5AD1F28357734CD41B2B9DD9F58085B3D2842
                                                                                                                                                                                    SHA-512:6E57633C924BFC16D380C014C20DD24D5727E70D4843FCEC4D7995B4DB21941EA8F2A5FD6E5386DF3364B6905D4D66B2B9595DC8FC70CFF40A2D49A92A1B6FBA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# msgbox.tcl --..#..#.Implements messageboxes for platforms that do not have native..#.messagebox support...#..# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# Ensure existence of ::tk::dialog namespace..#..namespace eval ::tk::dialog {}....image create bitmap ::tk::dialog::b1 -foreground black \..-data "#define b1_width 32\n#define b1_height 32..static unsigned char q1_bits[] = {.. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,.. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,.. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x04, 0x00,
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4235
                                                                                                                                                                                    Entropy (8bit):4.789130604359491
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nlw9Twd+j3gLhokqwX+hTnJgNanPNcgRhgP+5QPwJJENL:nlw9TjjwI3hTnJgNaRhgP75L
                                                                                                                                                                                    MD5:5A8B46B85DCCBF74E2B5B820E1A7B9D1
                                                                                                                                                                                    SHA1:980F4FC5BABA82BA0FE02F9BD03A23DF6D565BB1
                                                                                                                                                                                    SHA-256:4DFFBEEDBF0D66D84B13088016D1A782CEAAD4DED27BE1E38842F8969C0E533F
                                                                                                                                                                                    SHA-512:2D81FC06CF3C20E4F6314BD13AF81FDE38A9B06510584C84C6A0C8C36314F980F77D02BD8056E7EE5DE599A0620E0C0349124147334B9C141145270046B19D90
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it".. ::msgcat::mcset cs "&About..." "&O programu...".. ::msgcat::mcset cs "All Files" "V\u0161echny soubory".. ::msgcat::mcset cs "Application Error" "Chyba programu".. ::msgcat::mcset cs "Bold Italic".. ::msgcat::mcset cs "&Blue" "&Modr\341".. ::msgcat::mcset cs "Cancel" "Zru\u0161it".. ::msgcat::mcset cs "&Cancel" "&Zru\u0161it".. ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.".. ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e".. ::msgcat::mcset cs "Cl&ear" "Sma&zat".. ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu".. ::msgcat::mcset cs "Color" "Barva".. ::msgcat::mcset cs "Console" "Konzole".. ::msgcat::mcset cs "&Copy" "&Kop\355rovat".. ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout".. ::msgcat::mcset cs "&
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3987
                                                                                                                                                                                    Entropy (8bit):4.651948695787255
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nRZ2uDMr05sIEzs2KkrT+XuTKN0FjDDP9:nRZzDy4kBKkrT+QpP9
                                                                                                                                                                                    MD5:227B0F255F854460E8E5146ED7A17B85
                                                                                                                                                                                    SHA1:99A080CAD631F21963C51A5B254BDAD3724DC866
                                                                                                                                                                                    SHA-256:FEEF8F8AD33BB3362C845A25D6ED273C398051047D899B31790474614C7AFD2D
                                                                                                                                                                                    SHA-512:36A4B48831316CC29686CC76DA00110EB078EC56F55A960D11AE427AA3D913C340C1E3805BF2AD40C1A8A92FC6587DA5D2C245E7501289FC3E228BE14FE49598
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset da "&Abort" "&Afbryd".. ::msgcat::mcset da "&About..." "&Om...".. ::msgcat::mcset da "All Files" "Alle filer".. ::msgcat::mcset da "Application Error" "Programfejl".. ::msgcat::mcset da "&Blue" "&Bl\u00E5".. ::msgcat::mcset da "Cancel" "Annuller".. ::msgcat::mcset da "&Cancel" "&Annuller".. ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.".. ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog".. ::msgcat::mcset da "Cl&ear" "&Ryd".. ::msgcat::mcset da "&Clear Console" "&Ryd konsolen".. ::msgcat::mcset da "Color" "Farve".. ::msgcat::mcset da "Console" "Konsol".. ::msgcat::mcset da "&Copy" "&Kopier".. ::msgcat::mcset da "Cu&t" "Kli&p".. ::msgcat::mcset da "&Delete" "&Slet".. ::msgcat::mcset da "Details >>" "Detailer".. ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" finde
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4914
                                                                                                                                                                                    Entropy (8bit):4.6221938909259475
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:nxLEpatioUqGBLbz4ME/XKKVN9R7S/0oYr9:epY3MkXKKxRu2r9
                                                                                                                                                                                    MD5:2203F65BCDA61BC15AEAC4F868C6D94A
                                                                                                                                                                                    SHA1:C4CC3975679D23892406E4E8971359A0775B1B86
                                                                                                                                                                                    SHA-256:C0F574B14068A049E93421C73873D750C98DE28B7B77AA42FE72CBE0270A4186
                                                                                                                                                                                    SHA-512:79F134FDAD3B12524D43BF9F59D3C04CAE30A95F591A51B82C8DF7CC8563BEA5D464AEECC457D9F60C04365E30459C447ED537AFC832BA25E1815DE06C2B81E5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset de "&Abort" "&Abbruch".. ::msgcat::mcset de "&About..." "&\u00dcber...".. ::msgcat::mcset de "All Files" "Alle Dateien".. ::msgcat::mcset de "Application Error" "Applikationsfehler".. ::msgcat::mcset de "&Apply" "&Anwenden".. ::msgcat::mcset de "Bold" "Fett".. ::msgcat::mcset de "Bold Italic" "Fett kursiv".. ::msgcat::mcset de "&Blue" "&Blau".. ::msgcat::mcset de "Cancel" "Abbruch".. ::msgcat::mcset de "&Cancel" "&Abbruch".. ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.".. ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis".. ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen".. ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen".. ::msgcat::mcset de "Color" "Farbe".. ::msgcat::mcset de "Console" "Konsole".. ::msgcat::mcset de "&Copy" "&Kopieren".. ::msgcat::mcset de "
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (355), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8784
                                                                                                                                                                                    Entropy (8bit):4.334043617395095
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:tVj/F+oxBHbkI8+xTqFt2zPJ0k63fRGIUvPXrfBNnzc+zIF7meUOT7GC8MO07S0g:fj9+AHlLoozHn7fBFrMVmehCAGb
                                                                                                                                                                                    MD5:780F863903BBDAA6C371EC0D3C7E6D59
                                                                                                                                                                                    SHA1:DF5D435E132BEE4C076A7FC577C8C275A8B68CD5
                                                                                                                                                                                    SHA-256:3F6F155864FE59A341BFD869735E54DD21CEE21BBD038433D9B271AD77BA3F7E
                                                                                                                                                                                    SHA-512:091965EE912513AE1943BE840A2E757188FBA6F760F7C47BE80D06313D59B051F183E3A29D4B1CEDE1F9E54CA3CA23D75FF2C3A3672A4E71FB56F0FA76F7FA0D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:## Messages for the Greek (Hellenic - "el") language...## Please report any changes/suggestions to:..## petasis@iit.demokritos.gr....namespace eval ::tk {.. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2".. ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...".. ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1".. ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2".. ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5".. ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7".. ::msgcat::mcset el \.."Cannot change to the directory \"%1\$s\".\nPermission denied." \.."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3377
                                                                                                                                                                                    Entropy (8bit):4.279601088621442
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:sQ7dw5bO0V3gqmCNyoKJ6iwp/uvENv4SKEcET2hsHFjr:n7dwNOc3RmOKJQcvEl4SK1ET2hYFjr
                                                                                                                                                                                    MD5:D48CFC9EC779085E8F6AAA7B1C40C89A
                                                                                                                                                                                    SHA1:0CF6253BFF39F40CA0991F9B06D3394BFEA21ED2
                                                                                                                                                                                    SHA-256:4A33B44B2E220E28EAAE7FAC407CAFE43D97C270DA58FA5F3B699A1760BFB2A4
                                                                                                                                                                                    SHA-512:C00EC0CFB48ABE621EF625C51952BCF177CE3BC7F0DEC5276EF84C9A97C7E014806B106EA8DEE202C43F8DD54ED7261A8D899E3EE12E3F37A90C387D864463AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset en "&Abort".. ::msgcat::mcset en "&About...".. ::msgcat::mcset en "All Files".. ::msgcat::mcset en "Application Error".. ::msgcat::mcset en "&Apply".. ::msgcat::mcset en "Bold".. ::msgcat::mcset en "Bold Italic".. ::msgcat::mcset en "&Blue".. ::msgcat::mcset en "Cancel".. ::msgcat::mcset en "&Cancel".. ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.".. ::msgcat::mcset en "Choose Directory".. ::msgcat::mcset en "Cl&ear".. ::msgcat::mcset en "&Clear Console".. ::msgcat::mcset en "Color".. ::msgcat::mcset en "Console".. ::msgcat::mcset en "&Copy".. ::msgcat::mcset en "Cu&t".. ::msgcat::mcset en "&Delete".. ::msgcat::mcset en "Details >>".. ::msgcat::mcset en "Directory \"%1\$s\" does not exist.".. ::msgcat::mcset en "&Directory:".. ::msgcat::mcset en "&Edit".. ::msgcat::mcset en "Effects".. ::msgcat::mcset en "Error: %1\$s".. ::msgcat::mcs
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):66
                                                                                                                                                                                    Entropy (8bit):4.262228832346611
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:fEGp6fRyv//mGoW8vMKEQXyVn:sooyv//xoQOOn
                                                                                                                                                                                    MD5:3D41FC47CD9936F817EF9645D73A77ED
                                                                                                                                                                                    SHA1:E62BBE094B71CAF4A389DE3ECD84D2EEFBA33827
                                                                                                                                                                                    SHA-256:01238293356E82F1D298896491F8B299BB7DC9C34F299C9E756254C736DA612B
                                                                                                                                                                                    SHA-512:B92582C32C4D7CD9DE6571CBB6B93DD693A8B5A80645468E2D02B80C339BE2B95D5B4878A0DA9AFFE9E2F98A6C38AAE9CC1FF2440146D0ED128FE8C9A92EECDB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset en_gb Color Colour..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3991
                                                                                                                                                                                    Entropy (8bit):4.605712650627941
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:n680lhrzes/QEkFH+nl0WXqQ+pISIKU/ujHMytuXcFSpxvy:n680XeqfkFelPXqVpISIKUWgRTy
                                                                                                                                                                                    MD5:E44F82EAF651D065CA1A2D5FA3C91C25
                                                                                                                                                                                    SHA1:F0EA1C39DED47232B21D0DCDD5179071C5717C55
                                                                                                                                                                                    SHA-256:37FC66686349A955935CB24B0BD524E91823D2A631E63D54FDF17733C7502CBE
                                                                                                                                                                                    SHA-512:A2ECA0A1C06406158CA8D2066639C0C6B582969D5F01C0559838E93A3AEFFFC50EB54B26328DAA81742016650FC790B1F81841E40EFE4F885626902D82989DD7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset eo "&Abort" "&\u0108esigo".. ::msgcat::mcset eo "&About..." "Pri...".. ::msgcat::mcset eo "All Files" "\u0108ioj dosieroj".. ::msgcat::mcset eo "Application Error" "Aplikoerraro".. ::msgcat::mcset eo "&Blue" "&Blua".. ::msgcat::mcset eo "Cancel" "Rezignu".. ::msgcat::mcset eo "&Cancel" "&Rezignu".. ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u0109angi al dosierulon \"%1\$s\".\nVi ne rajtas tion.".. ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujo".. ::msgcat::mcset eo "Cl&ear" "&Klaru".. ::msgcat::mcset eo "&Clear Console" "&Klaru konzolon".. ::msgcat::mcset eo "Color" "Farbo".. ::msgcat::mcset eo "Console" "Konzolo".. ::msgcat::mcset eo "&Copy" "&Kopiu".. ::msgcat::mcset eo "Cu&t" "&Enpo\u015digu".. ::msgcat::mcset eo "&Delete" "&Forprenu".. ::msgcat::mcset eo "Details >>" "Detaloj >>".. ::msgcat::mcset eo "Directory \"%1\$s\" does not ex
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4024
                                                                                                                                                                                    Entropy (8bit):4.536517819515934
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nN0T1Lt8ZYSih/aiik148aFscyTzoixccUTqjcg60Dx/H5:nN0BLSQUXy/o8re055
                                                                                                                                                                                    MD5:4765F3C055742530E4644771EBC6C69F
                                                                                                                                                                                    SHA1:8BEA722AC00522DEAA5B380AEEF4CA57D7A271BD
                                                                                                                                                                                    SHA-256:D2842B80F1B521EFF2D2656A69274B5F2A8F4F5831AF2E8EE73E3C37389F981F
                                                                                                                                                                                    SHA-512:9CA247F22797A1A1FCA42B5CDABF58262ED95EECDDD321CEB1440A60A4375923E0F511238F360D159EB5EED6F82CBBE0B8907A07CC77DB831BF97082932CD0FD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset es "&Abort" "&Abortar".. ::msgcat::mcset es "&About..." "&Acerca de ...".. ::msgcat::mcset es "All Files" "Todos los archivos".. ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n".. ::msgcat::mcset es "&Blue" "&Azul".. ::msgcat::mcset es "Cancel" "Cancelar".. ::msgcat::mcset es "&Cancel" "&Cancelar".. ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.".. ::msgcat::mcset es "Choose Directory" "Elegir directorio".. ::msgcat::mcset es "Cl&ear" "&Borrar".. ::msgcat::mcset es "&Clear Console" "&Borrar consola".. ::msgcat::mcset es "Color".. ::msgcat::mcset es "Console" "Consola".. ::msgcat::mcset es "&Copy" "&Copiar".. ::msgcat::mcset es "Cu&t" "Cor&tar".. ::msgcat::mcset es "&Delete" "&Borrar".. ::msgcat::mcset es "Details >>" "Detalles >>".. ::msgcat::mcset es "Directory \"%1\$s\"
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3877
                                                                                                                                                                                    Entropy (8bit):4.630737553723335
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nByEWs/3lHFB9FamsIfSAzZ2eaISAxh0BRc3jC:nByEWaRNzsSSWonMAv
                                                                                                                                                                                    MD5:E279E5FFF03E1B8E9063ABC8A499A6BD
                                                                                                                                                                                    SHA1:80910911F6B4830BA4DCBA9A9EAD12C9F802DDC9
                                                                                                                                                                                    SHA-256:3F2CEB4A33695AB6B56E27F61A4C60C029935BB026497D99CB2C246BCB4A63C4
                                                                                                                                                                                    SHA-512:8333388E421AC3F342317BEBE352809B0B190EF8B044A0BAE2FE4051974D86008BAFDCB7098E9DC39A8D9E1E08FB87F54B9D3388AF2D0185FF913DB6788C5AB5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset fr "&Abort" "&Annuler".. ::msgcat::mcset fr "About..." "\u00c0 propos...".. ::msgcat::mcset fr "All Files" "Tous les fichiers".. ::msgcat::mcset fr "Application Error" "Erreur d'application".. ::msgcat::mcset fr "&Blue" "&Bleu".. ::msgcat::mcset fr "Cancel" "Annuler".. ::msgcat::mcset fr "&Cancel" "&Annuler".. ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.".. ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire".. ::msgcat::mcset fr "Cl&ear" "Effacer".. ::msgcat::mcset fr "Color" "Couleur".. ::msgcat::mcset fr "Console".. ::msgcat::mcset fr "Copy" "Copier".. ::msgcat::mcset fr "Cu&t" "Couper".. ::msgcat::mcset fr "Delete" "Effacer".. ::msgcat::mcset fr "Details >>" "D\u00e9tails >>".. ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\"
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4678
                                                                                                                                                                                    Entropy (8bit):4.7955991577265245
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:nkCEz2TTrKmA17fzq/Hj+pUva+fQR/a5a/Thn5kU:kTqM17u/8NiMrhb
                                                                                                                                                                                    MD5:4F1610E0C73DAE668E3F9D9235631152
                                                                                                                                                                                    SHA1:63EE54A6C1A69B798C65C999D5F80A7AB252B6D8
                                                                                                                                                                                    SHA-256:E063AD7CA93F37728A65E4CD7C0433950F22607D307949F6CB056446AFEAA4FE
                                                                                                                                                                                    SHA-512:37F4B8A9CD020A77591C09AF40FBC2FA82107B2596D31B5F30CE6ECAA225417CF7A5C62FB7A93539B0D7E930D0A44F9BF2EE6BE113F831B0A72B229444672AFD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s".. ::msgcat::mcset hu "&About..." "N\u00e9vjegy...".. ::msgcat::mcset hu "All Files" "Minden f\u00e1jl".. ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba".. ::msgcat::mcset hu "&Blue" "&K\u00e9k".. ::msgcat::mcset hu "Cancel" "M\u00e9gsem".. ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem".. ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.".. ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa".. ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s".. ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol".. ::msgcat::mcset hu "Color" "Sz\u00edn".. ::msgcat::mcset hu "Console" "Konzol".. ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s".. ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s".. ::ms
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3765
                                                                                                                                                                                    Entropy (8bit):4.49679862548805
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nmU4xnonTjwUE5Xs6ZrT8BpXAg+Wr+u92C8t7mU9nUSs:nZ4FonFE58HBpXjr+fBJs
                                                                                                                                                                                    MD5:B74C54666A5A431A782DB691B4CA3315
                                                                                                                                                                                    SHA1:2BC63982C14BBA8A4C451CE31540181F40CE2216
                                                                                                                                                                                    SHA-256:806930F283FD097195C7850E3486B3815D1564529B4F8E5FA6D26F3175183BC1
                                                                                                                                                                                    SHA-512:8120E2FFD14E0A992E254796ADDC0DC995C921BE31688C0995D7A36FE82609D78791FEF73EAF5B14E2F0D40AD256AB8DAAA07C18E6950362B28E40B71E47C0B6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset it "&Abort" "&Interrompi".. ::msgcat::mcset it "&About..." "Informazioni...".. ::msgcat::mcset it "All Files" "Tutti i file".. ::msgcat::mcset it "Application Error" "Errore dell' applicazione".. ::msgcat::mcset it "&Blue" "&Blu".. ::msgcat::mcset it "Cancel" "Annulla".. ::msgcat::mcset it "&Cancel" "&Annulla".. ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.".. ::msgcat::mcset it "Choose Directory" "Scegli una directory".. ::msgcat::mcset it "Cl&ear" "Azzera".. ::msgcat::mcset it "&Clear Console" "Azzera Console".. ::msgcat::mcset it "Color" "Colore".. ::msgcat::mcset it "Console".. ::msgcat::mcset it "&Copy" "Copia".. ::msgcat::mcset it "Cu&t" "Taglia".. ::msgcat::mcset it "Delete" "Cancella".. ::msgcat::mcset it "Details >>" "Dettagli >>".. ::msgcat::mcset it "Directory \"%1\$s\" does not ex
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4557
                                                                                                                                                                                    Entropy (8bit):4.524344068436489
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nucQswBju0x0M4U2z9KSSOzZL5KhWTqGGIrlxXvhYbL/ZO5NT+T4kiLzzdDf1SDM:nLGa0x0Mp2KSHKSv2bL/ZO5u6nRfAXU9
                                                                                                                                                                                    MD5:E56229BAC5A8ABB90C4DD8EE3F9FF9F8
                                                                                                                                                                                    SHA1:7527D6C3C6C84BFF0E683FFA86A21C58458EB55D
                                                                                                                                                                                    SHA-256:0914FBA42361227D14FA281E8A9CBF57C16200B4DA1E61CC3402EF0113A512C7
                                                                                                                                                                                    SHA-512:13649DDB06DB4BA9E39BEAF828211086A519444DA9AB5CBDD1B88B29208388189A5141F75AD94B56A348EDDE534FFADE8B19B557CB988EA4ECC9A84B135D36C1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset nl "&Abort" "&Afbreken".. ::msgcat::mcset nl "&About..." "Over...".. ::msgcat::mcset nl "All Files" "Alle Bestanden".. ::msgcat::mcset nl "Application Error" "Toepassingsfout".. ::msgcat::mcset nl "&Apply" "Toepassen".. ::msgcat::mcset nl "Bold" "Vet".. ::msgcat::mcset nl "Bold Italic" "Vet Cursief".. ::msgcat::mcset nl "&Blue" "&Blauw".. ::msgcat::mcset nl "Cancel" "Annuleren".. ::msgcat::mcset nl "&Cancel" "&Annuleren".. ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.".. ::msgcat::mcset nl "Choose Directory" "Kies map".. ::msgcat::mcset nl "Cl&ear" "Wissen".. ::msgcat::mcset nl "&Clear Console" "&Wis Console".. ::msgcat::mcset nl "Color" "Kleur".. ::msgcat::mcset nl "Console".. ::msgcat::mcset nl "&Copy" "Kopi\u00ebren".. ::msgcat::mcset nl "Cu&t" "Knippen".. ::msgcat::mcset nl "&Dele
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4932
                                                                                                                                                                                    Entropy (8bit):4.799369674927008
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nXra9E310fwNCeVsvSmy6MZv8lWBTDGdZ3tojTyrEQmAUCIx4wBxZ:n7a9Q0fyw5MQWgP3uoZChB3
                                                                                                                                                                                    MD5:8CFA2E38822303FDCB55AE3277F0B81B
                                                                                                                                                                                    SHA1:447F28A5064FCEA019C60B3F9B6D50CD43C2D0E3
                                                                                                                                                                                    SHA-256:EACEB1F08DE0863CCF726881E07FE5B135EA09646C5253E0CBF7DDB987EB0D92
                                                                                                                                                                                    SHA-512:E38BA9059AFF55C2B22A4AE24D6A76149C76DBA8BF8646AE81D6E07D7ED490D0605034B29D9AC848E6685C8EC26A3DBE5B2EAF462B14D96376E80076FBE7082A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset pl "&Abort" "&Przerwij".. ::msgcat::mcset pl "&About..." "O programie...".. ::msgcat::mcset pl "All Files" "Wszystkie pliki".. ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie".. ::msgcat::mcset pl "&Apply" "Zastosuj".. ::msgcat::mcset pl "Bold" "Pogrubienie".. ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa".. ::msgcat::mcset pl "&Blue" "&Niebieski".. ::msgcat::mcset pl "Cancel" "Anuluj".. ::msgcat::mcset pl "&Cancel" "&Anuluj".. ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.".. ::msgcat::mcset pl "Choose Directory" "Wybierz katalog".. ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107".. ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119".. ::msgcat::mcset pl "Color" "Kolor".. ::msgcat::mcset pl "Console" "Konsola".. ::msgcat::mcset pl "&Copy" "&Kopiu
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3987
                                                                                                                                                                                    Entropy (8bit):4.63232183429232
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nHOT1mM5qHHxiBHb3joTjtcp2UqMxweo6VvilCMKKXx9vjM:nHOT1mMQnwB/otcUUpGX6VPVoLjM
                                                                                                                                                                                    MD5:4018686F2A8E299D86BDB1478BC97896
                                                                                                                                                                                    SHA1:0EECE3D57F2EA5EECE8157B06F3AFB97E1F2551A
                                                                                                                                                                                    SHA-256:D687F71F0432BB0D02EFDF576E526D2C19D4136F76C41A3224A2F034168F3F34
                                                                                                                                                                                    SHA-512:4D730068B2A21E1D6004205B10A9D0D5EE9683FEB03B6FB673E8B9B94ED6BE468086A52DFE97C4DBF35A07CBB2C5E276DF0952A06C78E029D53D796CB6FCC8DF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset pt "&Abort" "&Abortar".. ::msgcat::mcset pt "About..." "Sobre ...".. ::msgcat::mcset pt "All Files" "Todos os arquivos".. ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o".. ::msgcat::mcset pt "&Blue" "&Azul".. ::msgcat::mcset pt "Cancel" "Cancelar".. ::msgcat::mcset pt "&Cancel" "&Cancelar".. ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.".. ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio".. ::msgcat::mcset pt "Cl&ear" "Apagar".. ::msgcat::mcset pt "&Clear Console" "Apagar Console".. ::msgcat::mcset pt "Color" "Cor".. ::msgcat::mcset pt "Console".. ::msgcat::mcset pt "&Copy" "Copiar".. ::msgcat::mcset pt "Cu&t" "Recortar".. ::msgcat::mcset pt "&Delete" "Excluir".. ::msgcat::mcset pt "Details >>" "Detalhes >>".. ::msgcat::mcset pt "D
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7289
                                                                                                                                                                                    Entropy (8bit):4.396417984959623
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:n9MEBG2T4YHCIxqEMk0Y2xX6wKl9zFAWS2yuV9cDcPRjnHQuNFNfz5hVV9aWTRcD:dreFqN1T+oRR/F1RHR6
                                                                                                                                                                                    MD5:803E0F9930828B103B03B55EDA173CB8
                                                                                                                                                                                    SHA1:429A30A7546123B1895C4317C65A97EBCBD16F35
                                                                                                                                                                                    SHA-256:8715E9927BA925AE8099EDF71A3D701FE396FC0E4DF039CEA7DC84120E101F47
                                                                                                                                                                                    SHA-512:379739A2C84E35C1AC70EFA9F704D3D1455741FEB60F4A1D9B0E0FD6CC3279F66A0C63C0FADFD861498D3FE13AB9E633F2C1BB05E76B3206DECEA253FFB8E33C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c".. ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...".. ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b".. ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435".. ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439".. ::msgcat::mcset ru "Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \....."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \"%1\$s\".\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3908
                                                                                                                                                                                    Entropy (8bit):4.658068191079967
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:nT8A5cbwKmtI1sE9xt6BDyepTr2iiK/yGqXZlBp9:nD5cb2extDepTCnVpJ9
                                                                                                                                                                                    MD5:1D085A672A6FCDECEF5D7D876E4C74A3
                                                                                                                                                                                    SHA1:1A40C03F15A6926359CA3E5C0A809485CAD28AEE
                                                                                                                                                                                    SHA-256:A6821A13D34FB31F1827294B82C4BF9586BB255CA14F78C3ACE11181F42EF211
                                                                                                                                                                                    SHA-512:981EDEEF5E4C915BB8F10044096B412D1855CAD08F98A448C6C0A49A54222945EBD102DDCB9525535E0FB19313C319155FA59384605B2C36CC8B4A58693D57E7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:namespace eval ::tk {.. ::msgcat::mcset sv "&Abort" "&Avsluta".. ::msgcat::mcset sv "&About..." "&Om...".. ::msgcat::mcset sv "All Files" "Samtliga filer".. ::msgcat::mcset sv "Application Error" "Programfel".. ::msgcat::mcset sv "&Blue" "&Bl\u00e5".. ::msgcat::mcset sv "Cancel" "Avbryt".. ::msgcat::mcset sv "&Cancel" "&Avbryt".. ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.".. ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp".. ::msgcat::mcset sv "Cl&ear" "&Radera".. ::msgcat::mcset sv "&Clear Console" "&Radera konsollen".. ::msgcat::mcset sv "Color" "F\u00e4rg".. ::msgcat::mcset sv "Console" "Konsoll".. ::msgcat::mcset sv "&Copy" "&Kopiera".. ::msgcat::mcset sv "Cu&t" "Klipp u&t".. ::msgcat::mcset sv "&Delete" "&Radera".. ::msgcat::mcset sv "Details >>" "Detaljer >>".. ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mapp
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5772
                                                                                                                                                                                    Entropy (8bit):5.038729016734604
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:onzxtm7EMgdMjwPqeuAmz9LD1kFIQETZqoIK/RLf7w:ozxtm7qUwi79l0sZqoBJLDw
                                                                                                                                                                                    MD5:FC9E03823BEB08DAF7681C09D106DF7D
                                                                                                                                                                                    SHA1:7D06FC8F98140E0FFAA2571BD522FC772E58DE54
                                                                                                                                                                                    SHA-256:540EEECBA17207A56290BAFFDAE882BBD4F88364791204AD5D14C7BEDD022CCC
                                                                                                                                                                                    SHA-512:2B5BAD311A703A0FE2ED67ACE311BAD4C767BCD23DFC3D9ABDF5C3604146A6A15D6BD13A14BDEFCDB2B602C708AACFAB404E96FCBA7C546AD0DAECD4BE2EB34A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# obsolete.tcl --..#..# This file contains obsolete procedures that people really shouldn't..# be using anymore, but which are kept around for backward compatibility...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# The procedures below are here strictly for backward compatibility with..# Tk version 3.6 and earlier. The procedures are no longer needed, so..# they are no-ops. You should not use these procedures anymore, since..# they may be removed in some future release.....proc tk_menuBar args {}..proc tk_bindForTraversal args {}....# ::tk::classic::restore --..#..# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic..# Tk widgets...#..# The value following an 'option add' call is the new 8.5 value...#..namespace eval ::tk::classic {.. # This may need t
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1629
                                                                                                                                                                                    Entropy (8bit):4.784780799273752
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:g2hBuOrlkBytcqYXRE5fvvXq1EhJPqOj6Wf0cVlN:gQ6q4E5HCqhBqOhcaD
                                                                                                                                                                                    MD5:9B7A8FD2C6B538FF31BDC380452C6DE3
                                                                                                                                                                                    SHA1:3F915BFE85CED9F6C7E9A352718770E9F14F098E
                                                                                                                                                                                    SHA-256:40CA505C9784B0767D4854485C5C311829594A4FCBDFD7251E60E6BB7EA74FD1
                                                                                                                                                                                    SHA-512:43937152B844BE1E597E99DA1270E54AB1D572AE89CB759E6D41C18C9C8044CCC15A6925F9C5AF617AE9EC1404E78C2733231F4D5C6CFE4D23C546387B1FC328
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# optMenu.tcl --..#..# This file defines the procedure tk_optionMenu, which creates..# an option button and its associated menu...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_optionMenu --..# This procedure creates an option button named $w and an associated..# menu. Together they provide the functionality of Motif option menus:..# they can be used to select one of many values, and the current value..# appears in the global variable varName, as well as in the text of..# the option menubutton. The name of the menu is returned as the..# procedure's result, so that the caller can use it to change configuration..# options on the menu or otherwise manipulate it...#..# Arguments:..# w -...The name to use for the menubutton...# varName -..Global variable to hold the currently
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8418
                                                                                                                                                                                    Entropy (8bit):4.964814946573677
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
                                                                                                                                                                                    MD5:4CE08A10CD9AE941654B8C679DF669F3
                                                                                                                                                                                    SHA1:F1288BABCA698FD18C3BD221E6AE6C02F2975AAE
                                                                                                                                                                                    SHA-256:849B4C57E4644E51BEAEAEB3AE59B7FF067E582ECD10F1B2CAF6B6E72F11F506
                                                                                                                                                                                    SHA-512:0F37539DA3540E9B1DA7B0377E3BBB359B71DB4271D63BC9501E95931B4E609E8CB91DC2F7B08A6452598D4A0D58C6A2034049A215000EEF0F93A9963D003632
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# palette.tcl --..#..# This file contains procedures that change the color palette used..# by Tk...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_setPalette --..# Changes the default color scheme for a Tk application by setting..# default colors in the option database and by modifying all of the..# color options for existing widgets that have the default value...#..# Arguments:..# The arguments consist of either a single color name, which..# will be used as the new background color (all other colors will..# be computed from this) or an even number of values consisting of..# option names and values. The name for an option is the one used..# for the option database, such as activeForeground, not -activeforeground.....proc ::tk_setPalette {args} {.. if {[winfo depth .] == 1} {...# Just return on monochrome displays, otherwise errors
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5370
                                                                                                                                                                                    Entropy (8bit):4.979530133775421
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ssAXzkTQ9w5fLQYkJLZkRXKUXfwyZTq2sz8j2Em3YKhrYK:jAXgE0DQpJLGR6UXfpqnzG3m3YKhrYK
                                                                                                                                                                                    MD5:286C01A1B12261BC47F5659FD1627ABD
                                                                                                                                                                                    SHA1:4CA36795CAB6DFE0BBBA30BB88A2AB71A0896642
                                                                                                                                                                                    SHA-256:AA4F87E41AC8297F51150F2A9F787607690D01793456B93F0939C54D394731F9
                                                                                                                                                                                    SHA-512:D54D5A89B7408A9724A1CA1387F6473BDAD33885194B2EC5A524C7853A297FD65CE2A57F571C51DB718F6A00DCE845DE8CF5F51698F926E54ED72CDC81BCFE54
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# panedwindow.tcl --..#..# This file defines the default bindings for Tk panedwindow widgets and..# provides procedures that help in implementing those bindings.....bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }..bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }....bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }..bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }....bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}..bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}....bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }....bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }....# Initialize namespace..namespace eval ::tk::panedwindow {}....# ::tk::panedwindow::MarkSash --..#..# Handle marking the correct sash for possible dragging..#..# Arguments:..# w..the widget..# x..widget local x coord..# y..widget local y coord..# proxy.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):376
                                                                                                                                                                                    Entropy (8bit):5.040809246948068
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:CsUgabAOgjDnzJNBc6ynID/cL4RpncleXN17MQ9PQqBIQ08hof7MQ9PQqBIQei:lGbyntNO6LYZliPBIUhkPBIFi
                                                                                                                                                                                    MD5:3367CE12A4BA9BAAF7C5127D7412AA6A
                                                                                                                                                                                    SHA1:865C775BB8F56C3C5DFC8C71BFAF9EF58386161D
                                                                                                                                                                                    SHA-256:3F2539E85E2A9017913E61FE2600B499315E1A6F249A4FF90E0B530A1EEB8898
                                                                                                                                                                                    SHA-512:F5D858F17FE358762E8FDBBF3D78108DBA49BE5C5ED84B964143C0ADCE76C140D904CD353646EC0831FF57CD0A0AF864D1833F3946A235725FFF7A45C96872EB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:if {![package vsatisfies [package provide Tcl] 8.6.0]} return..if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]...|| ([info exists ::argv] && ("-display" in $::argv)))} {.. package ifneeded Tk 8.6.12 [list load [file join $dir .. .. bin libtk8.6.dll]]..} else {.. package ifneeded Tk 8.6.12 [list load [file join $dir .. .. bin tk86t.dll]]..}..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):7632
                                                                                                                                                                                    Entropy (8bit):4.891666209090638
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
                                                                                                                                                                                    MD5:21A3AC11146EC26784C0E729D8D644D0
                                                                                                                                                                                    SHA1:C7E0918E8692C42C1D1DD1BBCBFFF22A85979B69
                                                                                                                                                                                    SHA-256:579701605669AADFFBCDB7E3545C68442495428EE6E93C2D3A3133583BCD3D33
                                                                                                                                                                                    SHA-512:724ED83B989AD9033BEC4211EE50E4C9E85B51054C518CDF7E02D0ED0416F636B9F38C0B0D29F8F4F7F465B77C7D2E01D0918D2C2C3FEC4C7739EA982302FA2E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# safetk.tcl --..#..# Support procs to use Tk in safe interpreters...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# see safetk.n for documentation....#..#..# Note: It is now ok to let untrusted code being executed..# between the creation of the interp and the actual loading..# of Tk in that interp because the C side Tk_Init will..# now look up the parent interp and ask its safe::TkInit..# for the actual parameters to use for it's initialization (if allowed),..# not relying on the child state...#....# We use opt (optional arguments parsing)..package require opt 0.4.1;....namespace eval ::safe {.... # counter for safe toplevels.. variable tkSafeId 0..}....#..# tkInterpInit : prepare the child interpreter for tk loading..# most of the real job is done by loadTk..# returns the child name (tkInterpInit
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8056
                                                                                                                                                                                    Entropy (8bit):4.979589163397994
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:GSusE8YOdpO4aDtao+QYa6t2jooB6ajpaqa5xQz9MUKOC9dLrVx:KsbYQO48t+QYa+NkFjpaQz5KX9dLrVx
                                                                                                                                                                                    MD5:857ADD6060A986063B0ED594F6B0CD26
                                                                                                                                                                                    SHA1:B1981D33DDEA81CFFFA838E5AC80E592D9062E43
                                                                                                                                                                                    SHA-256:0DA2DC955FFD71062A21C3B747D9D59D66A5B09A907B9ED220BE1B2342205A05
                                                                                                                                                                                    SHA-512:7D9829565EFC8CDBF9249913DA95B02D8DADFDB3F455FD3C10C5952B5454FE6E54D95C07C94C1E0D7568C9742CAA56182B3656E234452AEC555F0FCB76A59FB1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# scale.tcl --..#..# This file defines the default bindings for Tk scale widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for entries...#-------------------------------------------------------------------------....# Standard Motif bindings:....bind Scale <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. tk::ScaleActivate %W %x %y..}..bind Scale <Motion> {.. tk::ScaleActivate %W %x %y..}..bind Scale <Leave> {.. if {$tk_strictMotif} {...%W configure -activebackground
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):13188
                                                                                                                                                                                    Entropy (8bit):5.063842571848725
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Gf7RV8ei32PHKT8H2wwucyRlXn+kl1nBKp4nu5FCyK:2mei3qHKT8WPurnXn+I1nBg4nu5MyK
                                                                                                                                                                                    MD5:5249CD1E97E48E3D6DEC15E70B9D7792
                                                                                                                                                                                    SHA1:612E021BA25B5E512A0DFD48B6E77FC72894A6B9
                                                                                                                                                                                    SHA-256:EEC90404F702D3CFBFAEC0F13BF5ED1EBEB736BEE12D7E69770181A25401C61F
                                                                                                                                                                                    SHA-512:E4E0AB15EB9B3118C30CD2FF8E5AF87C549EAA9B640FFD809A928D96B4ADDEFB9D25EFDD1090FBD0019129CDF355BB2F277BC7194001BA1D2ED4A581110CEAFC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# scrlbar.tcl --..#..# This file defines the default bindings for Tk scrollbar widgets...# It also provides procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for scrollbars...#-------------------------------------------------------------------------....# Standard Motif bindings:..if {[tk windowingsystem] eq "x11" || [tk windowingsystem] eq "aqua"} {....bind Scrollbar <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. %W activate [%W identify %x %y]..}..bind Scrollbar <Motion> {.. %W activate [%
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):16526
                                                                                                                                                                                    Entropy (8bit):5.033807343600737
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:IMpfy/Ku9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfy/Ku9Tx8WODTp2zPP
                                                                                                                                                                                    MD5:77DFE1BACCD165A0C7B35CDEAA2D1A8C
                                                                                                                                                                                    SHA1:426BA77FC568D4D3A6E928532E5BEB95388F36A0
                                                                                                                                                                                    SHA-256:2FF791A44406DC8339C7DA6116E6EC92289BEE5FC1367D378F48094F4ABEA277
                                                                                                                                                                                    SHA-512:E56DB85296C8661AB2EA0A56D9810F1A4631A9F9B41337560CBE38CCDF7DD590A3E65C22B435CE315EFF55EE5B8E49317D4E1B7577E25FC3619558015DD758EB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# spinbox.tcl --..#..# This file defines the default bindings for Tk spinbox widgets and provides..# procedures that help in implementing those bindings. The spinbox builds..# off the entry widget, so it can reuse Entry bindings and procedures...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1999-2000 Jeffrey Hobbs..# Copyright (c) 2000 Ajuba Solutions..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#.
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20523
                                                                                                                                                                                    Entropy (8bit):4.786929402401609
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:eeVL0UI9Ms++J7VT/hc+ISyNsATbOan/uW/UFQ1gs1gxtKZufe2SvdJcmq/YbhEB:eeF0UI9Ms++J7VT/hc+ISyCATbOan2W+
                                                                                                                                                                                    MD5:9378397DD3DCA9DFB181F6F512B15631
                                                                                                                                                                                    SHA1:4F95DD6B658B6A912725DC7D6226F8414020D6C7
                                                                                                                                                                                    SHA-256:B04B1A675572E6FCD12C5FE82C4FD0930395548436FF93D848BF340AE202E7E3
                                                                                                                                                                                    SHA-512:D28CC3C8F3D0B1B2371CBD9EE29AC6881BABD8A07C762FF8F3284449998EE44FA44752CC8AB0DE47A3492776CE1D13BC8EA18CFDBDF710639D2D62D02CB917A9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# Tcl autoload index file, version 2.0..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]]..set auto_index(::tk::ButtonAutoInvoke) [list sou
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5309
                                                                                                                                                                                    Entropy (8bit):4.74935501162253
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:wfQXIqAv6iEwYtKVlPBnXWASbvMsDjXKpQQkK2tTsSZQ7Fowqm2K5r:wf+IqI6iU43PJYbvMsDjXKpsK2tISyZV
                                                                                                                                                                                    MD5:5F042DE8AD8941C7B9EF6D7BE06C86E4
                                                                                                                                                                                    SHA1:A4DFCEA2ACCAC2E85EAAA186DC765086D1E3AA3C
                                                                                                                                                                                    SHA-256:A4A8568633F827B54326640E6D1C3FDE4978EDC9E9FA1FB1D7B58F189DF1B1DC
                                                                                                                                                                                    SHA-512:E92A00028696A1557666CAB1C25AE6B63F25D75A9811BFAC56DFC069ECC769CC751B71CC81FA85C9CDE8F7FB6D7121EB64B58548CEE8AFE3F6C4A5C243507216
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# tearoff.tcl --..#..# This file contains procedures that implement tear-off menus...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk::TearoffMenu --..# Given the name of a menu, this procedure creates a torn-off menu..# that is identical to the given menu (including nested submenus)...# The new torn-off menu exists as a toplevel window managed by the..# window manager. The return value is the name of the new menu...# The window is created at the point specified by x and y..#..# Arguments:..# w -...The menu to be torn-off (duplicated)...# x -...x coordinate where window is created..# y -...y coordinate where window is created....proc ::tk::TearOffMenu {w {x 0} {y 0}} {.. # Find a unique name to use for the torn-off menu. Find the first.. # ancestor of w that is a
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):34961
                                                                                                                                                                                    Entropy (8bit):4.958000555615616
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:Rp4LaQDlJrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:R/K8aymTGs1b0xncn6KR
                                                                                                                                                                                    MD5:7C2AC370DE0B941AE13572152419C642
                                                                                                                                                                                    SHA1:7598CC20952FA590E32DA063BF5C0F46B0E89B15
                                                                                                                                                                                    SHA-256:4A42AD370E0CD93D4133B49788C0B0E1C7CD78383E88BACB51CB751E8BFDA15E
                                                                                                                                                                                    SHA-512:8325A33BFD99F0FCE4F14ED5DC6E03302F6FFABCE9D1ABFEFC24D16A09AB3439A4B753CBF06B28D8C95E4DDABFB9082C9B030619E8955A7E656BD6C61B9256C3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# text.tcl --..#..# This file defines the default bindings for Tk text widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of ::tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# char -..Character position on the line; kept in order..#...to allow moving up or down past short lines while..#...still remembering the desired position...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button we
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:Tcl script, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24266
                                                                                                                                                                                    Entropy (8bit):5.1375522500072925
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
                                                                                                                                                                                    MD5:338184E46BD23E508DAEDBB11A4F0950
                                                                                                                                                                                    SHA1:437DB31D487C352472212E8791C8252A1412CB0E
                                                                                                                                                                                    SHA-256:0F617D96CBF213296D7A5F7FCFFBB4AE1149840D7D045211EF932E8DD66683E9
                                                                                                                                                                                    SHA-512:8FB8A353EECD0D19638943F0A9068DCCEBF3FB66D495EA845A99A89229D61A77C85B530F597FD214411202055C1FAA9229B6571C591C9F4630490E1EB30B9CD3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# tk.tcl --..#..# Initialization script normally executed in the interpreter for each Tk-based..# application. Arranges class bindings for widgets...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....# Verify that we have Tk binary and script components from the same release..package require -exact Tk 8.6.12.....# Create a ::tk namespace..namespace eval ::tk {.. # Set up the msgcat commands.. namespace eval msgcat {...namespace export mc mcmax.. if {[interp issafe] || [catch {package require msgcat}]} {.. # The msgcat package is not available. Supply our own.. # minimal replacement... proc mc {src args} {.. return [format $src {*}$args].. }.. proc mc
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39613
                                                                                                                                                                                    Entropy (8bit):5.1830399016984146
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:+oj+AqE9cn9eJNgDN0/vsKulXgx65Eh6pSb:+6+ZM/gAEdix65Ehpb
                                                                                                                                                                                    MD5:47635811AAA1CEB26EDA3930D91C8855
                                                                                                                                                                                    SHA1:F071757BED525AF8CA21BFA0FCA89EC3F95AA278
                                                                                                                                                                                    SHA-256:595A0B05EB2CBD4CF489E57624B509FC3B4885E6410CA6416E7521D23694373D
                                                                                                                                                                                    SHA-512:A374126EC28E70C89EE247A591C2168DF55E110F260664F46F470C53CDA3A2411C3775391FC8FD575CEE69CD1768512E68CDDCB335204D00B9EB81906AC79344
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# tkfbox.tcl --..#..#.Implements the "TK" standard file selection dialog box. This dialog..#.box is used on the Unix platforms whenever the tk_strictMotif flag is..#.not set...#..#.The "TK" standard file selection dialog box is similar to the file..#.selection dialog box on Win95(TM). The user can navigate the..#.directories by clicking on the folder icons or by selecting the..#."Directory" option menu. The user can select files by clicking on the..#.file icons or by entering a filename in the "Filename:" entry...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {.. namespace import -force ::tk::msgcat::*.. variable showHiddenBtn 0.. variable showHiddenVar 1.... # Create the images if they did not already exist... if {![info exists ::tk::Priv(updirImage)]} {...s
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3713
                                                                                                                                                                                    Entropy (8bit):4.915055696129498
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:InrWdo3L7Fe5qusQGdrMNnQbfIxEOxE0kFgG0FgGouox9FrGVuwg3kNcT+z5UlEr:UWdsOBn/1i+pqxwNjKs
                                                                                                                                                                                    MD5:01F28512E10ACBDDF93AE2BB29E343BC
                                                                                                                                                                                    SHA1:C9CF23D6315218B464061F011E4A9DC8516C8F1F
                                                                                                                                                                                    SHA-256:AE0437FB4E0EBD31322E4EACA626C12ABDE602DA483BB39D0C5EE1BC00AB0AF4
                                                                                                                                                                                    SHA-512:FE3BAE36DDB67F6D7A90B7A91B6EC1A009CF26C0167C46635E5A9CEAEC9083E59DDF74447BF6F60399657EE9604A2314B170F78A921CF948B2985DDF02A89DA6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Ttk widget set: Alternate theme..#....namespace eval ttk::theme::alt {.... variable colors.. array set colors {...-frame .."#d9d9d9"...-window.."#ffffff"...-darker ."#c3c3c3"...-border.."#414141"...-activebg ."#ececec"...-disabledfg."#a3a3a3"...-selectbg."#4a6984"...-selectfg."#ffffff"...-altindicator."#aaaaaa".. }.... ttk::style theme settings alt {.....ttk::style configure "." \... -background .$colors(-frame) \... -foreground .black \... -troughcolor.$colors(-darker) \... -bordercolor.$colors(-border) \... -selectbackground .$colors(-selectbg) \... -selectforeground .$colors(-selectfg) \... -font ..TkDefaultFont \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)] ;...ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -padding "1 1" \... -reli
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3838
                                                                                                                                                                                    Entropy (8bit):4.940737732832436
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:WdbclJFvlyLi+8OWXgQahpvAdNutdHrFBlCFBK2tdHkFBlhKgY1geAWUWeFVvtdp:C8EQPNeWgFeqdXj
                                                                                                                                                                                    MD5:F07A3A86362E9E253BE91F59714FE134
                                                                                                                                                                                    SHA1:84DE1AB2EAE62E4B114F0E613BD94955AFA9E6C7
                                                                                                                                                                                    SHA-256:E199CC9C429B35A09721D0A22543C3729E2B8462E68DFA158C0CEC9C70A0D79D
                                                                                                                                                                                    SHA-512:324EAF9F857076CA4FECB26D8DF76F8BB1D3F15EAE55D6B6C9689BF1682B306AC7A3592B6A518D23F9FE4DC21EFB6ACF1ECA948F889FA1ADFFA0E12C0BEAB57F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Aqua theme (OSX native look and feel)..#....namespace eval ttk::theme::aqua {.. ttk::style theme settings aqua {.....ttk::style configure . \... -font TkDefaultFont \... -background systemWindowBackgroundColor \... -foreground systemLabelColor \... -selectbackground systemSelectedTextBackgroundColor \... -selectforeground systemSelectedTextColor \... -selectborderwidth 0 \... -insertwidth 1.....ttk::style map . \... -foreground {....disabled systemDisabledControlTextColor....background systemLabelColor} \... -selectbackground {....background systemSelectedTextBackgroundColor....!focus systemSelectedTextBackgroundColor} \... -selectforeground {....background systemSelectedTextColor....!focus systemSelectedTextColor}.....# Button...ttk::style configure TButton -anchor center -width -6 \... -foreground systemControlTextColor...ttk::style map TButton \... -foreground {....pressed white... {alternate !pressed !background} white}...ttk::styl
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3014
                                                                                                                                                                                    Entropy (8bit):4.917794267131833
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:A5N+EqJWR1eTC01cG61ELLgrDgk1JgQ6TQGvhV5giT6TUP+3JWMHTeJ:kN+RQfccG61ooDgQ6dNT6TUP+PHO
                                                                                                                                                                                    MD5:D4BF1AF5DCDD85E3BD11DBF52EB2C146
                                                                                                                                                                                    SHA1:B1691578041319E671D31473A1DD404855D2038B
                                                                                                                                                                                    SHA-256:E38A9D1F437981AA6BF0BDD074D57B769A4140C0F7D9AFF51743FE4ECC6DFDDF
                                                                                                                                                                                    SHA-512:25834B4B231F4FF1A88EEF67E1A102D1D0546EC3B0D46856258A6BE6BBC4B381389C28E2EB60A01FF895DF24D6450CD16CA449C71F82BA53BA438A4867A47DCD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Bindings for Buttons, Checkbuttons, and Radiobuttons...#..# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed"..# state; widgets remain "active" if the pointer is dragged out...# This doesn't seem to be conventional, but it's a nice way..# to provide extra feedback while the grab is active...# (If the button is released off the widget, the grab deactivates and..# we get a <Leave> event then, which turns off the "active" state)..#..# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are..# delivered to the widget which received the initial <Button>..# event. However, Tk [grab]s (#1223103) and menu interactions..# (#1222605) can interfere with this. To guard against spurious..# <Button1-Enter> events, the <Button1-Enter> binding only sets..# the pressed state if the button is currently active...#....namespace eval ttk::button {}....bind TButton <Enter> ..{ %W instate !disabled {%W state active} }..bind TButton <Leave>..{ %W state !active }..bind TButton <s
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4809
                                                                                                                                                                                    Entropy (8bit):4.905115353394083
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:KrS4se/XhW03cC7TxPp/uo1ZUb0WZvSoetCgV+tMWG3xT3xgNB4x76FAuoxVYuIJ:oS4sSjWwFAGkhiP3xT3xL6B2bbe
                                                                                                                                                                                    MD5:2B20E7B2E6BDDBEB14F5F63BF38DBF24
                                                                                                                                                                                    SHA1:43DB48094C4BD7DE3B76AFBC051D887FEFE9887E
                                                                                                                                                                                    SHA-256:CFFC59931FDD1683AD23895E92522CF49B099128753FCDFF34374024E42CF995
                                                                                                                                                                                    SHA-512:1EB5EA78D26D18EAD6563AFBF1798F71723001DCC945E7DB3E4368564D0563029BE3565876AD8CB97331CFE34B2A0A313FA1BF252B87049160FE5DCD65434775
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# "Clam" theme...#..# Inspired by the XFCE family of Gnome themes...#....namespace eval ttk::theme::clam {.. variable colors.. array set colors {...-disabledfg.."#999999"...-frame .."#dcdad5"...-window .."#ffffff"...-dark..."#cfcdc8"...-darker .."#bab5ab"...-darkest.."#9e9a91"...-lighter.."#eeebe7"...-lightest .."#ffffff"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-altindicator.."#5895bc"...-disabledaltindicator."#a0a0a0".. }.... ttk::style theme settings clam {.....ttk::style configure "." \... -background $colors(-frame) \... -foreground black \... -bordercolor $colors(-darkest) \... -darkcolor $colors(-dark) \... -lightcolor $colors(-lighter) \... -troughcolor $colors(-darker) \... -selectbackground $colors(-selectbg) \... -selectforeground $colors(-selectfg) \... -selectborderwidth 0 \... -font TkDefaultFont \... ;.....ttk::style map "." \... -background [list disabled $colors(-frame) \..... active $colors(-lighter)] \..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3864
                                                                                                                                                                                    Entropy (8bit):4.935603001745302
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:zcJZjdWs+WVB4ULsMF7tnvnuSuqo5DKxiFgG0FgGHx9FrGTtu/3Kt+iW2PbuAk38:zcJZEstB4UoituSm+VtYErY
                                                                                                                                                                                    MD5:0205663142775F4EF2EB104661D30979
                                                                                                                                                                                    SHA1:452A0D613288A1CC8A1181C3CC1167E02AA69A73
                                                                                                                                                                                    SHA-256:424BBA4FB6836FEEBE34F6C176ED666DCE51D2FBA9A8D7AA756ABCBBAD3FC1E3
                                                                                                                                                                                    SHA-512:FB4D212A73A6F5A8D2774F43D310328B029B52B35BEE133584D8326363B385AB7AA4AE25E98126324CC716962888321E0006E5F6EF8563919A1D719019B2D117
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# "classic" Tk theme...#..# Implements Tk's traditional Motif-like look and feel...#....namespace eval ttk::theme::classic {.... variable colors; array set colors {...-frame.."#d9d9d9"...-window.."#ffffff"...-activebg."#ececec"...-troughbg."#c3c3c3"...-selectbg."#c3c3c3"...-selectfg."#000000"...-disabledfg."#a3a3a3"...-indicator."#b03060"...-altindicator."#b05e5e".. }.... ttk::style theme settings classic {...ttk::style configure "." \... -font..TkDefaultFont \... -background..$colors(-frame) \... -foreground..black \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -troughcolor.$colors(-troughbg) \... -indicatorcolor.$colors(-frame) \... -highlightcolor.$colors(-frame) \... -highlightthickness.1 \... -selectborderwidth.1 \... -insertwidth.2 \... ;.....# To match pre-Xft X11 appearance, use:...#.ttk::style configure . -font {Helvetica 12 bold}.....ttk::style map "." -background \... [list disabled
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12718
                                                                                                                                                                                    Entropy (8bit):5.063548300335668
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:otLzBJ9SfinaXUBLPYXlk7fKiLH+AzIoJdJwGknmyLsxoVEQGITse8g5sarkT32e:wB5aXmLPYXmrKxLL7A
                                                                                                                                                                                    MD5:F7065D345A4BFB3127C3689BF1947C30
                                                                                                                                                                                    SHA1:9631C05365B0F5A36E4CA5CBA83628CCD7FCBDE1
                                                                                                                                                                                    SHA-256:68EED4AF6D2EC5B3EA24B1122A704B040366CBE2F458103137479352FFA1475A
                                                                                                                                                                                    SHA-512:74B99B9E326680150DD5EC7263192691BCD8A71B2A4EE7F3177DEDDD43E924A7925085C6D372731A70570F96B3924450255B2F54CA3B9C44D1160CA37E715B00
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Combobox bindings...#..# <<NOTE-WM-TRANSIENT>>:..#..#.Need to set [wm transient] just before mapping the popdown..#.instead of when it's created, in case a containing frame..#.has been reparented [#1818441]...#..#.On Windows: setting [wm transient] prevents the parent..#.toplevel from becoming inactive when the popdown is posted..#.(Tk 8.4.8+)..#..#.On X11: WM_TRANSIENT_FOR on override-redirect windows..#.may be used by compositing managers and by EWMH-aware..#.window managers (even though the older ICCCM spec says..#.it's meaningless)...#..#.On OSX: [wm transient] does utterly the wrong thing...#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]...#.The "noActivates" attribute prevents the parent toplevel..#.from deactivating when the popdown is posted, and is also..#.necessary for "help" windows to receive mouse events...#."hideOnSuspend" makes the popdown disappear (resp. reappear)..#.when the parent toplevel is deactivated (resp. reactivated)...#.(see [#18147
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4827
                                                                                                                                                                                    Entropy (8bit):4.843146795750702
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:DRYEqfLDxGmxGUz4GUtaPT6t6brv0q3O4Uu0:DWEqTDbxdWaPqe5PUr
                                                                                                                                                                                    MD5:18EC3E60B8DD199697A41887BE6CE8C2
                                                                                                                                                                                    SHA1:13FF8CE95289B802A5247B1FD9DEA90D2875CB5D
                                                                                                                                                                                    SHA-256:7A2ED9D78FABCAFFF16694F2F4A2E36FF5AA313F912D6E93484F3BCD0466AD91
                                                                                                                                                                                    SHA-512:4848044442EFE75BCF1F89D8450C8ECBD441F38A83949A3CD2A56D9000CACAA2EA440CA1B32C856AB79358ACE9C7E3F70DDF0EC54AA93866223D8FEF76930B19
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Map symbolic cursor names to platform-appropriate cursors...#..# The following cursors are defined:..#..#.standard.-- default cursor for most controls..#.""..-- inherit cursor from parent window..#.none..-- no cursor..#..#.text..-- editable widgets (entry, text)..#.link..-- hyperlinks within text..#.crosshair.-- graphic selection, fine control..#.busy..-- operation in progress..#.forbidden.-- action not allowed..#..#.hresize..-- horizontal resizing..#.vresize..-- vertical resizing..#..# Also resize cursors for each of the compass points,..# {nw,n,ne,w,e,sw,s,se}resize...#..# Platform notes:..#..# Windows doesn't distinguish resizing at the 8 compass points,..# only horizontal, vertical, and the two diagonals...#..# OSX doesn't have resize cursors for nw, ne, sw, or se corners...# We use the Tk-defined X11 fallbacks for these...#..# X11 doesn't have a "forbidden" cursor (usually a slashed circle);..# "pirate" seems to be the conventional cursor for this purpose...#..# Windows has a
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4553
                                                                                                                                                                                    Entropy (8bit):4.933885986949396
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:lNl3u3lCFUeuMGN3xbVJU+N3xbVJh3IwxkxlBqatUrtY:zl3ZUe9GN3NVC+N3NVjqntUZY
                                                                                                                                                                                    MD5:FC79F42761D63172163C08F0F5C94436
                                                                                                                                                                                    SHA1:AABAB4061597D0D6DC371F46D14AAA1A859096DF
                                                                                                                                                                                    SHA-256:49AE8FAF169165BDDAF01D50B52943EBAB3656E9468292B7890BE143D0FCBC91
                                                                                                                                                                                    SHA-512:F619834A95C9DEB93F8184BCC437D701A961C77E24A831ADBD5C145556D26986BFDA2A6ACB9E8784F8B2380E122D12AC893EB1B6ACF03098922889497E1FF9EA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Settings for default theme...#....namespace eval ttk::theme::default {.. variable colors.. array set colors {...-frame..."#d9d9d9"...-foreground.."#000000"...-window..."#ffffff"...-text .."#000000"...-activebg.."#ececec"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-darker .."#c3c3c3"...-disabledfg.."#a3a3a3"...-indicator.."#4a6984"...-disabledindicator."#a3a3a3"...-altindicator.."#9fbdd8"...-disabledaltindicator."#c0c0c0".. }.... ttk::style theme settings default {.....ttk::style configure "." \... -borderwidth .1 \... -background .$colors(-frame) \... -foreground .$colors(-foreground) \... -troughcolor .$colors(-darker) \... -font ..TkDefaultFont \... -selectborderwidth.1 \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -insertwidth .1 \... -indicatordiameter.10 \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)]...ttk::style map "."
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):17617
                                                                                                                                                                                    Entropy (8bit):5.025882547402842
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:sca9JzOyzf6yzwO+v+iPT3vKof8q3YIuR13a:sT9JzOy76wiV3YNa
                                                                                                                                                                                    MD5:89089172393C551CD1668B9C19B88290
                                                                                                                                                                                    SHA1:0B8667217A4A14289E9F6C1B384DEF5479BCA089
                                                                                                                                                                                    SHA-256:830CC3009A735E92DB70D53210C4928DD35CAAB5051ED14DEC67E06AE25CBE28
                                                                                                                                                                                    SHA-512:ABBBE6AA937AAB392BC7DCB8BBFBBEC9EE5ED2C9F10ED982D77258BD98F27EE95AC47FD7CB6761B814885EF0878E1F1557D034C9F4163D9D85B388F2B837683F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# DERIVED FROM: tk/library/entry.tcl r1.22..#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 2004, Joe English..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ttk {.. namespace eval entry {...variable State.....set State(x) 0...set State(selectMode) none...set State(anchor) 0...set State(scanX) 0...set State(scanIndex) 0...set State(scanMoved) 0.....# Button-2 scan speed is (scanNum/scanDen) characters...# per pixel of mouse movement....# The standard Tk entry widget uses the equivalent of...# scanNum = 10, scanDen = average character width....# I don't know why that was chosen....#...set State(scanNum) 1...set State(scanDen) 1...set State(deadband) 3.;# #pixels for mouse-moved deadband... }..}....### Option database settings...#..option add *TEntry.cursor [ttk::cursor text] widg
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5732
                                                                                                                                                                                    Entropy (8bit):5.001928619185109
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:NzEh94ntnVU8Z/1LkAKgW22SeLMQR8hzcksejmOF4ytZm:Sh9ahV3ZWAKgWDfktm
                                                                                                                                                                                    MD5:80331FCBE4C049FF1A0D0B879CB208DE
                                                                                                                                                                                    SHA1:4EB3EFDFE3731BD1AE9FD52CE32B1359241F13CF
                                                                                                                                                                                    SHA-256:B94C319E5A557A5665B1676D602B6495C0887C5BACF7FA5B776200112978BB7B
                                                                                                                                                                                    SHA-512:A4BD2D91801C121A880225F1F3D0C4E30BF127190CF375F6F7A49EB4239A35C49C44F453D6D3610DF0D6A7B3CB15F4E79BD9C129025CC496CEB856FCC4B6DE87
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Font specifications...#..# This file, [source]d at initialization time, sets up the following..# symbolic fonts based on the current platform:..#..# TkDefaultFont.-- default for GUI items not otherwise specified..# TkTextFont.-- font for user text (entry, listbox, others)..# TkFixedFont.-- standard fixed width font..# TkHeadingFont.-- headings (column headings, etc)..# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.)..# TkTooltipFont.-- font to use for tooltip windows..# TkIconFont.-- font to use for icon captions..# TkMenuFont.-- used to use for menu items..#..# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation..# (On Windows and Mac OS X as of Oct 2007)...#..# +++ Platform notes:..#..# Windows:..#.The default system font changed from "MS Sans Serif" to "Tahoma"..# .in Windows XP/Windows 2000...#..#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,..#.although many MS programs still use "MS Sans Serif 8"..#..#.Should use
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6641
                                                                                                                                                                                    Entropy (8bit):4.923865616450888
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:toMcJQkmcE6fNuLyiCpYSmFSRwgppdT3kXdpK3dpKkNf2tOTjvAG:tRc6kFbcz2pyXz+zZ2y
                                                                                                                                                                                    MD5:4C8D90257D073F263B258F00B2A518C2
                                                                                                                                                                                    SHA1:7B58859E9B70FB37F53809CD3FFD7CF69AB310D8
                                                                                                                                                                                    SHA-256:972B13854D0E9B84DE338D6753F0F11F3A8534E7D0E51838796DAE5A1E2E3085
                                                                                                                                                                                    SHA-512:ED67F41578EE834EE8DB1FDED8AA069C0045E7058E338C451FA8E1ADE52907BED0C95631C21B8E88461571903B3DA2698A29E47F990B7A0F0DD3073E7A1BCADC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Bindings for Menubuttons...#..# Menubuttons have three interaction modes:..#..# Pulldown: Press menubutton, drag over menu, release to activate menu entry..# Popdown: Click menubutton to post menu..# Keyboard: <space> or accelerator key to post menu..#..# (In addition, when menu system is active, "dropdown" -- menu posts..# on mouse-over. Ttk menubuttons don't implement this)...#..# For keyboard and popdown mode, we hand off to tk_popup and let..# the built-in Tk bindings handle the rest of the interaction...#..# ON X11:..#..# Standard Tk menubuttons use a global grab on the menubutton...# This won't work for Ttk menubuttons in pulldown mode,..# since we need to process the final <ButtonRelease> event,..# and this might be delivered to the menu. So instead we..# rely on the passive grab that occurs on <Button> events,..# and transition to popdown mode when the mouse is released..# or dragged outside the menubutton...#..# ON WINDOWS:..#..# I'm not sure what the hell is going on h
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5825
                                                                                                                                                                                    Entropy (8bit):4.96378772387536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:RErUhyi5JeUQBWdz6eP8ClR6/u6AsBmPNNiREUkheLY1EVL23sN2JJjQdD:6uyiyDQBP8q6/u6AUREUsNEVq3y2jkdD
                                                                                                                                                                                    MD5:F811F3E46A4EFA73292F40D1CDDD265D
                                                                                                                                                                                    SHA1:7FC70A1984555672653A0840499954B854F27920
                                                                                                                                                                                    SHA-256:22264D8D138E2C0E9A950305B4F08557C5A73F054F8215C0D8CE03854042BE76
                                                                                                                                                                                    SHA-512:4424B7C687EB9B1804ED3B1C685F19D4D349753B374D9046240F937785C9713E8A760ADA46CB628C15F9C7983CE4A7987691C968330478C9C1A9B74E953E40AC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Bindings for TNotebook widget..#....namespace eval ttk::notebook {.. variable TLNotebooks ;# See enableTraversal..}....bind TNotebook <Button-1>..{ ttk::notebook::Press %W %x %y }..bind TNotebook <Right>...{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Left>...{ ttk::notebook::CycleTab %W -1; break }..bind TNotebook <Control-Tab>..{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Control-Shift-Tab>.{ ttk::notebook::CycleTab %W -1; break }..catch {..bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }..}..bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }....# ActivateTab $nb $tab --..#.Select the specified tab and set focus...#..# Desired behavior:..#.+ take focus when reselecting the currently-selected tab;..#.+ keep focus if the notebook already has it;..#.+ otherwise set focus to the first traversable widget..#. in the newly-selected tab;..#.+ do not leave the focus in a deselected tab...#..proc ttk::notebook::ActivateTab {
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2290
                                                                                                                                                                                    Entropy (8bit):4.948496148661722
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:zVAqE3ZF8b4rXzsqALAXsmCLFeNqkFeNXLz:zLeU4bzNs1h
                                                                                                                                                                                    MD5:619D8F54EE73AD8A373AB272FBDB94A6
                                                                                                                                                                                    SHA1:973626B5396B7E786DEDD8159D10E66B4465F9E0
                                                                                                                                                                                    SHA-256:4D08A7E29EEF731876951EF01DFA51654B6275FA3DAADB1F48FF4BBEAC238EB5
                                                                                                                                                                                    SHA-512:0D913C7DC9DAEE2B4A2A46663A07B3139D6B8F30D2F942642817504535E85616835EAA7D468851A83723A3DD711B65761376F3DF96A59A933A74EF096E13ACE9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Bindings for ttk::panedwindow widget...#....namespace eval ttk::panedwindow {.. variable State.. array set State {...pressed 0.. .pressX.-...pressY.-...sash .-...sashPos -.. }..}....## Bindings:..#..bind TPanedwindow <Button-1> ..{ ttk::panedwindow::Press %W %x %y }..bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }..bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }....bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }..# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>..bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }....## Sash movement:..#..proc ttk::panedwindow::Press {w x y} {.. variable State.... set sash [$w identify $x $y].. if {$sash eq ""} {.. .set State(pressed) 0...return.. }.. set State(pressed) .1.. set State(pressX) .$x.. set
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1138
                                                                                                                                                                                    Entropy (8bit):4.763501917862434
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:nJ8v3O0NSiio0pNFVkIks0ImxlnINgDImSgGINSyWghT:JFqS/o03fkxs0Rn+gD4v+S2F
                                                                                                                                                                                    MD5:DBF3BF0E8F04E9435E9561F740DFC700
                                                                                                                                                                                    SHA1:C7619A05A834EFB901C57DCFEC2C9E625F42428F
                                                                                                                                                                                    SHA-256:697CC0A75AE31FE9C2D85FB25DCA0AFA5D0DF9C523A2DFAD2E4A36893BE75FBA
                                                                                                                                                                                    SHA-512:D3B323DFB3EAC4A78DA2381405925C131A99C6806AF6FD8041102162A44E48BF166982A4AE4AA142A14601736716F1A628D9587E292FA8E4842BE984374CC192
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Ttk widget set: progress bar utilities...#....namespace eval ttk::progressbar {.. variable Timers.;# Map: widget name -> after ID..}....# Autoincrement --..#.Periodic callback procedure for autoincrement mode..#..proc ttk::progressbar::Autoincrement {pb steptime stepsize} {.. variable Timers.... if {![winfo exists $pb]} {.. .# widget has been destroyed -- cancel timer...unset -nocomplain Timers($pb)...return.. }.... set Timers($pb) [after $steptime \.. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].... $pb step $stepsize..}....# ttk::progressbar::start --..#.Start autoincrement mode. Invoked by [$pb start] widget code...#..proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {.. variable Timers.. if {![info exists Timers($pb)]} {...Autoincrement $pb $steptime $stepsize.. }..}....# ttk::progressbar::stop --..#.Cancel autoincrement mode. Invoked by [$pb stop] widget code...#..proc ttk::progressbar::stop {pb} {.. variabl
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2787
                                                                                                                                                                                    Entropy (8bit):4.795451191784129
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:IKADAzizZIcAlRqucObmn4AzyVN2AJyhAzukPNP:IHIBRqupmLSZkklP
                                                                                                                                                                                    MD5:F1C33CC2D47115BBECD2E7C2FCB631A7
                                                                                                                                                                                    SHA1:0123A961242ED8049B37C77C726DB8DBD94C1023
                                                                                                                                                                                    SHA-256:B909ADD0B87FA8EE08FD731041907212A8A0939D37D2FF9B2F600CD67DABD4BB
                                                                                                                                                                                    SHA-512:96587A8C3555DA1D810010C10C516CE5CCAB071557A3C8D9BD65C647C7D4AD0E35CBED0788F1D72BAFAC8C84C7E2703FC747F70D9C95F720745A1FC4A701C544
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# Bindings for the TScale widget....namespace eval ttk::scale {.. variable State.. array set State {...dragging 0.. }..}....bind TScale <Button-1> { ttk::scale::Press %W %x %y }..bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }....bind TScale <Button-2> { ttk::scale::Jump %W %x %y }..bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }....bind TScale <Button-3> { ttk::scale::Jump %W %x %y }..bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }....## Keyboard navigation bindings:..#..bind TScale <<LineStart>> { %W set [%W cget -from] }..bind TScale <<LineEnd>> { %W set [%W cget -to] }....bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }..bin
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3285
                                                                                                                                                                                    Entropy (8bit):4.979174619784594
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:tyASEji8RYQ8FGD7BDos9Q1TBfvq/HKTh9lkHv8T/mAezeLEAAFULxZh4x:eIi8qFu2d11XlhfkPcczeLS4Zm
                                                                                                                                                                                    MD5:3FB31A225CEC64B720B8E579582F2749
                                                                                                                                                                                    SHA1:9C0151D9E2543C217CF8699FF5D4299A72E8F13C
                                                                                                                                                                                    SHA-256:6EAA336B13815A7FC18BCD6B9ADF722E794DA2888D053C229044784C8C8E9DE8
                                                                                                                                                                                    SHA-512:E6865655585E3D2D6839B56811F3FD86B454E8CD44E258BB1AC576AD245FF8A4D49FBB7F43458BA8A6C9DAAC8DFA923A176F0DD8A9976A11BEA09E6E2D17BF45
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Bindings for TScrollbar widget..#....namespace eval ttk::scrollbar {.. variable State.. # State(xPress).--.. # State(yPress).-- initial position of mouse at start of drag... # State(first).-- value of -first at start of drag...}....bind TScrollbar <Button-1> ..{ ttk::scrollbar::Press %W %x %y }..bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }....bind TScrollbar <Button-2> ..{ ttk::scrollbar::Jump %W %x %y }..bind TScrollbar <B2-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-2>.{ ttk::scrollbar::Release %W %x %y }....# Redirect scrollwheel bindings to the scrollbar widget..#..# The shift-bindings scroll left/right (not up/down)..# if a widget has both possibilities..set eventList [list <MouseWheel> <Shift-MouseWheel>]..switch [tk windowingsystem] {.. aqua {.. lappend eventList <Option-MouseWheel> <Shift-Option-MouseWheel>.. }.. x11 {..
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2503
                                                                                                                                                                                    Entropy (8bit):4.830288003879418
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:naLvMnAqeYQWYh7FvBrrbnMCfY/aVAbAigWAuFM0PfWAX20:nWQapprPnJY/8A8iRFdPtj
                                                                                                                                                                                    MD5:DD6A1737B14D3F7B2A0B4F8BE99C30AF
                                                                                                                                                                                    SHA1:E6B06895317E73CD3DC78234DD74C74F3DB8C105
                                                                                                                                                                                    SHA-256:E92D77B5CDCA2206376DB2129E87E3D744B3D5E31FDE6C0BBD44A494A6845CE1
                                                                                                                                                                                    SHA-512:B74AE92EDD53652F8A3DB0D84C18F9CE9069805BCAB0D3C2DBB537D7C241AA2681DA69B699D88A10029798D7B5BC015682F64699BA475AE6A379EEF23B48DAAF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Sizegrip widget bindings...#..# Dragging a sizegrip widget resizes the containing toplevel...#..# NOTE: the sizegrip widget must be in the lower right hand corner...#....switch -- [tk windowingsystem] {.. x11 -.. win32 {...option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault.. }.. aqua {.. .# Aqua sizegrips use default Arrow cursor... }..}....namespace eval ttk::sizegrip {.. variable State.. array set State {...pressed .0...pressX ..0...pressY ..0...width ..0...height ..0...widthInc.1...heightInc.1.. resizeX 1.. resizeY 1...toplevel .{}.. }..}....bind TSizegrip <Button-1> ..{ ttk::sizegrip::Press.%W %X %Y }..bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }..bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }....proc ttk::sizegrip::Press {W X Y} {.. variable State.... if {[$W instate disabled]} { return }.... set top [winfo toplevel $W].... # If the toplevel is not resi
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5003
                                                                                                                                                                                    Entropy (8bit):5.055050310142795
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:1qg/+yrjqA/K5ytxm1J1Ve6J1yQLUAzz/S76hrwxGGe2F:N/+yr2Gk1J1Ve6fxUAzDS76hrwxs2F
                                                                                                                                                                                    MD5:9C2833FAA9248F09BC2E6AB1BA326D59
                                                                                                                                                                                    SHA1:F13CF048FD706BBB1581DC80E33D1AAD910D93E8
                                                                                                                                                                                    SHA-256:DF286BB59F471AA1E19DF39AF0EF7AA84DF9F04DC4A439A747DD8BA43C300150
                                                                                                                                                                                    SHA-512:5FF3BE1E3D651C145950C3FC5B8C2E842211C937D1042173964383D4D59ECF5DD0EC39FF7771D029716F2D895F0B1A72591EF3BF7947FE64D4D6DB5F0B8ABFFB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# ttk::spinbox bindings..#....namespace eval ttk::spinbox { }....### Spinbox bindings...#..# Duplicate the Entry bindings, override if needed:..#....ttk::copyBindings TEntry TSpinbox....bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }..bind TSpinbox <Button-1> ..{ ttk::spinbox::Press %W %x %y }..bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }..bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }..bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click....bind TSpinbox <Up>...{ event generate %W <<Increment>> }..bind TSpinbox <Down> ...{ event generate %W <<Decrement>> }....bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }..bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }....ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]....## Motion --..#.Sets cursor...#..proc ttk::spinbox::Motion {w x y} {.. variable State.. ttk::saveCursor $w State(userConfCursor) [ttk::cursor text].. if { [$w ide
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10180
                                                                                                                                                                                    Entropy (8bit):4.886259798213254
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
                                                                                                                                                                                    MD5:F705B3A292D02061DA0ABB4A8DD24077
                                                                                                                                                                                    SHA1:FD75C2250F6F66435444F7DEEF383C6397ED2368
                                                                                                                                                                                    SHA-256:C88B60FFB0F72E095F6FC9786930ADD7F9ED049EABC713F889F9A7DA516E188C
                                                                                                                                                                                    SHA-512:09817638DD3D3D5C57FA630C7EDF2F19C3956C9BD264DBF07627FA14A03AECD22D5A5319806E49EF1030204FADEF17C57CE8EAE4378A319AD2093321D9151C8F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# ttk::treeview widget bindings and utilities...#....namespace eval ttk::treeview {.. variable State.... # Enter/Leave/Motion.. #.. set State(activeWidget) .{}.. set State(activeHeading) .{}.... # Press/drag/release:.. #.. set State(pressMode) .none.. set State(pressX)..0.... # For pressMode == "resize".. set State(resizeColumn).#0.... # For pressmode == "heading".. set State(heading) .{}..}....### Widget bindings...#....bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }..bind Treeview.<B1-Leave>..{ #nothing }..bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}..bind Treeview.<Button-1> ..{ ttk::treeview::Press %W %x %y }..bind Treeview.<Double-Button-1> .{ ttk::treeview::DoubleClick %W %x %y }..bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }..bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }..bind Treeview .<Up> ..{ ttk::treeview::Keynav %W up }..bind Treeview .<Down> ..{ ttk::treeview
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4993
                                                                                                                                                                                    Entropy (8bit):4.954034141173847
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:lfxukTy5jPTq8LIgF2diyNTNR6nkrn4ijSSvNigyJ5612HtZG835MSvWOTRsHWU:BM+y5jrq8G/2nkEijSSvNigyJ5612Htw
                                                                                                                                                                                    MD5:AF45B2C8B43596D1BDECA5233126BD14
                                                                                                                                                                                    SHA1:A99E75D299C4579E10FCDD59389B98C662281A26
                                                                                                                                                                                    SHA-256:2C48343B1A47F472D1A6B9EE8D670CE7FB428DB0DB7244DC323FF4C7A8B4F64B
                                                                                                                                                                                    SHA-512:C8A8D01C61774321778AB149F6CA8DDA68DB69133CB5BA7C91938E4FD564160ECDCEC473222AFFB241304A9ACC73A36B134B3A602FD3587C711F2ADBB64AFA80
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Ttk widget set initialization script...#....### Source library scripts...#....namespace eval ::ttk {.. variable library.. if {![info exists library]} {...set library [file dirname [info script]].. }..}....source -encoding utf-8 [file join $::ttk::library fonts.tcl]..source -encoding utf-8 [file join $::ttk::library cursors.tcl]..source -encoding utf-8 [file join $::ttk::library utils.tcl]....## ttk::deprecated $old $new --..#.Define $old command as a deprecated alias for $new command..#.$old and $new must be fully namespace-qualified...#..proc ttk::deprecated {old new} {.. interp alias {} $old {} ttk::do'deprecate $old $new..}..## do'deprecate --..#.Implementation procedure for deprecated commands --..#.issue a warning (once), then re-alias old to new...#..proc ttk::do'deprecate {old new args} {.. deprecated'warning $old $new.. interp alias {} $old {} $new.. uplevel 1 [linsert $args 0 $new]..}....## deprecated'warning --..#.Gripe about use of deprecated comman
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8624
                                                                                                                                                                                    Entropy (8bit):5.001791071900077
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:e0ebpSp+IZwnmTmpx8xzaHfw8K7LVJWQl8p7M+R5:rw0+WmpWxa/w9nVJHu
                                                                                                                                                                                    MD5:D98EDC491DA631510F124CD3934F535F
                                                                                                                                                                                    SHA1:33037A966067C9F5C9074AE5532FF3B51B4082D4
                                                                                                                                                                                    SHA-256:D58610A34301BB6E61A60BEC69A7CECF4C45C6A034A9FC123977174B586278BE
                                                                                                                                                                                    SHA-512:23FAED8298E561F490997FE44AB61CD8CCB9F1F63D48BB4CF51FC9E591E463FF9297973622180D6A599CABB541C82B8FE33BF38A82C5D5905BBFA52CA0341399
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Utilities for widget implementations...#....### Focus management...#..# See also: #1516479..#....## ttk::takefocus --..#.This is the default value of the "-takefocus" option..#.for ttk::* widgets that participate in keyboard navigation...#..# NOTES:..#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable]..#.if -takefocus is 1, empty, or missing; but not if it's a..#.script prefix, so we have to check that here as well...#..#..proc ttk::takefocus {w} {.. expr {[$w instate !disabled] && [winfo viewable $w]}..}....## ttk::GuessTakeFocus --..#.This routine is called as a fallback for widgets..#.with a missing or empty -takefocus option...#..#.It implements the same heuristics as tk::FocusOK...#..proc ttk::GuessTakeFocus {w} {.. # Don't traverse to widgets with '-state disabled':.. #.. if {![catch {$w cget -state} state] && $state eq "disabled"} {...return 0.. }.... # Allow traversal to widgets with explicit key or focus bindings:.. #.. if {[regexp {Key|F
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9710
                                                                                                                                                                                    Entropy (8bit):4.6639701588183895
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:BktY1F+qXd95WSZaHFHRE3GRKFh2oaoT/ezKpqvYMHab:V1F+cd95WSZuhRE34KbPmKmY2ab
                                                                                                                                                                                    MD5:0AA7F8B43C3E07F3A4DA07FC6DF9A1B0
                                                                                                                                                                                    SHA1:153AFB735B10BBA16CFBE161777232F983845D90
                                                                                                                                                                                    SHA-256:EC5F203C69DF390E9B99944CF3526D6E77DC6F68E9B1A029F326A41AFED1EF81
                                                                                                                                                                                    SHA-512:5406553211CD6714C98EF7765ABD46424CCB013343EFF693FDD3AE6E0AAE9B5983446E0E1CC706D6B2C285084BF83D397306D3D52028CBBCFB8F369857C5B69C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Settings for Microsoft Windows Vista and Server 2008..#....# The Vista theme can only be defined on Windows Vista and above. The theme..# is created in C due to the need to assign a theme-enabled function for..# detecting when themeing is disabled. On systems that cannot support the..# Vista theme, there will be no such theme created and we must not..# evaluate this script.....if {"vista" ni [ttk::style theme names]} {.. return..}....namespace eval ttk::theme::vista {.... ttk::style theme settings vista {.... .ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2865
                                                                                                                                                                                    Entropy (8bit):4.917847108902527
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:b69VhW2gL5FPVWRzQsVqrEuF3yYrf7rfJF8xUqBgLt6g3ktO5jo4+iZ6O2htYtCW:bbXl+CEqZNNSxU0Ht2MR7W
                                                                                                                                                                                    MD5:769C0719A4044F91E7D132A25291E473
                                                                                                                                                                                    SHA1:6FB07B0C887D443A43FB15D5728920B578171219
                                                                                                                                                                                    SHA-256:AE82BCCCE708FF9C303CBCB3D4CC3FF5577A60D5B23822EA79E3E07CCE3CBBD1
                                                                                                                                                                                    SHA-512:47FED061DDC6B4EB63EF77901D0094FF2EBB1BAFACB3F44FBF13FB59DEA1EC83985B2862086ECF1A7957819A88A0FAA144B35F16BEA9356BBD9775070D42E636
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Settings for 'winnative' theme...#....namespace eval ttk::theme::winnative {.. ttk::style theme settings winnative {.....ttk::style configure "." \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -fieldbackground SystemWindow \... -insertcolor SystemWindowText \... -troughcolor SystemScrollbar \... -font TkDefaultFont \... ;.....ttk::style map "." -foreground [list disabled SystemGrayText] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -relief raised -shiftrelief 1...ttk::style configure TCheckbutton -padding "2 4"...ttk::style configure TRadiobutton -padding "2 4"...ttk::style configure TMenubutton \... -padding "8 4" -arrowsize 3 -relief raised.....ttk::style map TButton -relief {{!disabled pressed} sunken}.....ttk::style configure TEntry \... -padding 2 -select
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2103
                                                                                                                                                                                    Entropy (8bit):4.9805308941424355
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aaiIu89VhW2gLRWJyO514rf+rfzxTrf/MW+iZ6O2htYtCp:XoXAk21nxQ7p
                                                                                                                                                                                    MD5:162F30D2716438C75EA16B57E6F63088
                                                                                                                                                                                    SHA1:3F626FF0496BB16B27106BED7E38D1C72D1E3E27
                                                                                                                                                                                    SHA-256:AEDB21C6B2909A4BB4686837D2126E521A8CC2B38414A4540387B801EBD75466
                                                                                                                                                                                    SHA-512:6EBF9648F1381D04F351BB469B6E3A38F3D002189C92EAF80A18D65632037FF37D34EC8814BBF7FAE34553645BFC13985212F24684EE8C4E205729B975C88C97
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..# Settings for 'xpnative' theme..#....namespace eval ttk::theme::xpnative {.... ttk::style theme settings xpnative {.....ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::style configure TCheckbutton -padding 2...ttk::style configure TMenubutton -padding {8 4}.....ttk::style configure TNotebook -tabmargins {2 2 2 0}...ttk::style map TNotebook.Tab \... -expand [list selected {2 2 2 2}].....ttk::style configure TLabelframe.Label -foreground "#0046d5".....# OR: -padding {3 3 3 6}, which some apps seem to use....ttk::style configure TEntry -padding {2 2 2 4}...ttk::
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10521
                                                                                                                                                                                    Entropy (8bit):5.0647027375963996
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:1Y3uWEXm/swEePmJhRAXd1hTHsHG2ML/9Lm2daM0Hu:8hodMiM0Hu
                                                                                                                                                                                    MD5:508F7E258C04970FAE526990168CB773
                                                                                                                                                                                    SHA1:33785204B18C0E0F5CDCB5B49399B5907351FDB8
                                                                                                                                                                                    SHA-256:B463B366F139DDF7FED31F34C6D2341F9F27845A1A358011DFC801E1333B1828
                                                                                                                                                                                    SHA-512:A12985B58DD1D46297119CED47B7F44EF4139CED6C36FD028E66DD657E5ED0663B744C679A5BF7A39B39D17A32E1280D2945F6B9AD59AEF20436F68040F6070C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# unsupported.tcl --..#..# Commands provided by Tk without official support. Use them at your..# own risk. They may change or go away without notice...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# ----------------------------------------------------------------------..# Unsupported compatibility interface for folks accessing Tk's private..# commands and variable against recommended usage...# ----------------------------------------------------------------------....namespace eval ::tk::unsupported {.... # Map from the old global names of Tk private commands to their.. # new namespace-encapsulated names..... variable PrivateCommands.. array set PrivateCommands {...tkButtonAutoInvoke..::tk::ButtonAutoInvoke...tkButtonDown...::tk::ButtonDown...tkButtonEnter...::tk::ButtonEnter...tkButtonInvoke...::tk::ButtonInvoke...tkButtonLeave...::tk::ButtonLeave...tkButtonUp...::tk::ButtonUp...tk
                                                                                                                                                                                    Process:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):27064
                                                                                                                                                                                    Entropy (8bit):4.967626999005091
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:0BLzjXhss64XP8FXm39QJ63nwFiHLgRIdNPCRE5phLtffsNP4XWdxWk+I5oy9jN7:0BvjXoivB3flLCRE5phLCP3xWV8veTod
                                                                                                                                                                                    MD5:6DFD12DB27069F13957BC963EF5ACAAF
                                                                                                                                                                                    SHA1:E492F0B60D73CE17C4FA7680BF0087DC5E0CC132
                                                                                                                                                                                    SHA-256:1ED57E32CE9C419BCE36B483A91410DDF4C997CAF62D20E42048FC350F8C3F60
                                                                                                                                                                                    SHA-512:32A3E205B4BC3B7D4D6F31E6FD26075EA3FAB7396F7392855D8BD4426CFEE9081482759EFF219038D64B074E2D3D864041E7C37DCA134F2A0C3140AA04D757C2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# xmfbox.tcl --..#..#.Implements the "Motif" style file selection dialog for the..#.Unix platform. This implementation is used only if the..#."::tk_strictMotif" flag is set...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Scriptics Corporation..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}......# ::tk::MotifFDialog --..#..#.Implements a file dialog similar to the standard Motif file..#.selection box...#..# Arguments:..#.type.."open" or "save"..#.args..Options parsed by the procedure...#..# Results:..#.When -multiple is set to 0, this returns the absolute pathname..#.of the selected file. (NOTE: This is not the same as a single..#.element list.)..#..#.When -multiple is set to > 0, this returns a Tcl list of absolute..# pathnames. The argument for -multiple is ignored, but for consistency..#
                                                                                                                                                                                    File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Entropy (8bit):7.994472520308763
                                                                                                                                                                                    TrID:
                                                                                                                                                                                    • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                    • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                    File name:AccountChanger.exe
                                                                                                                                                                                    File size:18'565'178 bytes
                                                                                                                                                                                    MD5:874d9918ac068743ff1d236347ffa120
                                                                                                                                                                                    SHA1:589821e6b92f03e1954ba9d13654e246627ebd73
                                                                                                                                                                                    SHA256:4e0e9d2d6101cb27fc1f17a2bba9bbf545f2bb25d8e7d8438662989a62ffbc19
                                                                                                                                                                                    SHA512:c225f3ba2d6bcd5454568c2e87f25651ec49bde8fa1b1952057795dbe4de7cce7a957f945b8b6e4c97af24ee4e8bdc9d60e10843428c97327f21222dc002a778
                                                                                                                                                                                    SSDEEP:393216:marszf490oxv89aq+ZkFMq3+d9ux01vUIT3J0bAW84vvNiyuW:marszfm0ohFCrOd9uo0kW84vv7uW
                                                                                                                                                                                    TLSH:C7173308922154E9E4C9433BD8E5D1B366953CE903F1E09B4BF46D932DAF1D1AF7AB20
                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../...W.../...W...+l..W...+...W...+...W...+...W.../...W...W..)W..e+...W..e+...W..Rich.W.................
                                                                                                                                                                                    Icon Hash:32332d585d2d33b2
                                                                                                                                                                                    Entrypoint:0x14000b310
                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                    Imagebase:0x140000000
                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                    DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                    Time Stamp:0x648F7399 [Sun Jun 18 21:14:01 2023 UTC]
                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                    OS Version Major:5
                                                                                                                                                                                    OS Version Minor:2
                                                                                                                                                                                    File Version Major:5
                                                                                                                                                                                    File Version Minor:2
                                                                                                                                                                                    Subsystem Version Major:5
                                                                                                                                                                                    Subsystem Version Minor:2
                                                                                                                                                                                    Import Hash:0b5552dccd9d0a834cea55c0c8fc05be
                                                                                                                                                                                    Instruction
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    sub esp, 28h
                                                                                                                                                                                    call 00007FD0D0B1622Ch
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    add esp, 28h
                                                                                                                                                                                    jmp 00007FD0D0B15E3Fh
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    sub esp, 28h
                                                                                                                                                                                    call 00007FD0D0B167A4h
                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                    je 00007FD0D0B15FE3h
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    mov eax, dword ptr [00000030h]
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                    jmp 00007FD0D0B15FC7h
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    cmp ecx, eax
                                                                                                                                                                                    je 00007FD0D0B15FD6h
                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    cmpxchg dword ptr [0004121Ch], ecx
                                                                                                                                                                                    jne 00007FD0D0B15FB0h
                                                                                                                                                                                    xor al, al
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    add esp, 28h
                                                                                                                                                                                    ret
                                                                                                                                                                                    mov al, 01h
                                                                                                                                                                                    jmp 00007FD0D0B15FB9h
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    inc eax
                                                                                                                                                                                    push ebx
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    sub esp, 20h
                                                                                                                                                                                    movzx eax, byte ptr [00041207h]
                                                                                                                                                                                    test ecx, ecx
                                                                                                                                                                                    mov ebx, 00000001h
                                                                                                                                                                                    cmove eax, ebx
                                                                                                                                                                                    mov byte ptr [000411F7h], al
                                                                                                                                                                                    call 00007FD0D0B165A3h
                                                                                                                                                                                    call 00007FD0D0B176D2h
                                                                                                                                                                                    test al, al
                                                                                                                                                                                    jne 00007FD0D0B15FC6h
                                                                                                                                                                                    xor al, al
                                                                                                                                                                                    jmp 00007FD0D0B15FD6h
                                                                                                                                                                                    call 00007FD0D0B23CB1h
                                                                                                                                                                                    test al, al
                                                                                                                                                                                    jne 00007FD0D0B15FCBh
                                                                                                                                                                                    xor ecx, ecx
                                                                                                                                                                                    call 00007FD0D0B176E2h
                                                                                                                                                                                    jmp 00007FD0D0B15FACh
                                                                                                                                                                                    mov al, bl
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    add esp, 20h
                                                                                                                                                                                    pop ebx
                                                                                                                                                                                    ret
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    int3
                                                                                                                                                                                    inc eax
                                                                                                                                                                                    push ebx
                                                                                                                                                                                    dec eax
                                                                                                                                                                                    sub esp, 20h
                                                                                                                                                                                    cmp byte ptr [000411BCh], 00000000h
                                                                                                                                                                                    mov ebx, ecx
                                                                                                                                                                                    jne 00007FD0D0B16029h
                                                                                                                                                                                    cmp ecx, 01h
                                                                                                                                                                                    jnbe 00007FD0D0B1602Ch
                                                                                                                                                                                    call 00007FD0D0B1670Ah
                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                    je 00007FD0D0B15FEAh
                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x3bd0c0x78.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x520000x9b38.rsrc
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x4e0000x20c4.pdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x5c0000x758.reloc
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x394800x1c.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x393400x140.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x2a0000x418.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                    .text0x10000x288000x28800443d51fb84559b563832949912f06b00False0.5583465952932098data6.488023200564254IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .rdata0x2a0000x12b160x12c0033c04d2d8bd993d315ed66bb900c8d5cFalse0.5154817708333334data5.824633151190408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .data0x3d0000x103f80xe00afabb66fdcd2825de5909f10c900fca7False0.13309151785714285DOS executable (block device driver \377\3)1.8096886543499544IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                    .pdata0x4e0000x20c40x22007b210ceebebc00c96d1c55c2b456bbb4False0.47794117647058826data5.274096406482418IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    _RDATA0x510000x15c0x200c059b775abce97446903f3597b027faeFalse0.384765625data2.808567494642619IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .rsrc0x520000x9b380x9c00fe278d1e83be878e36dcec7fa3d9c4e7False0.047200520833333336data1.037385890509944IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .reloc0x5c0000x7580x80011aaafc72361ec8886a740c3e209ceb3False0.544921875data5.2576643703968475IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                    RT_ICON0x520e80x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 2835 x 2835 px/m0.026907714946394788
                                                                                                                                                                                    RT_GROUP_ICON0x5b5900x14data1.15
                                                                                                                                                                                    RT_MANIFEST0x5b5a40x593XML 1.0 document, ASCII text, with CRLF line terminators0.4477925718290119
                                                                                                                                                                                    DLLImport
                                                                                                                                                                                    USER32.dllCreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                    COMCTL32.dll
                                                                                                                                                                                    KERNEL32.dllGetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, IsValidCodePage, GetACP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetOEMCP, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetEndOfFile, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                                                                                                                                                    ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                    GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW
                                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                    Apr 24, 2024 18:57:53.114501953 CEST1.1.1.1192.168.2.40x626No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                                    Apr 24, 2024 18:57:53.114501953 CEST1.1.1.1192.168.2.40x626No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                                    Apr 24, 2024 18:57:53.607021093 CEST1.1.1.1192.168.2.40x2e58No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                    Apr 24, 2024 18:57:53.607021093 CEST1.1.1.1192.168.2.40x2e58No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                    Start time:18:58:13
                                                                                                                                                                                    Start date:24/04/2024
                                                                                                                                                                                    Path:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\AccountChanger.exe"
                                                                                                                                                                                    Imagebase:0x7ff7e1040000
                                                                                                                                                                                    File size:18'565'178 bytes
                                                                                                                                                                                    MD5 hash:874D9918AC068743FF1D236347FFA120
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    Target ID:3
                                                                                                                                                                                    Start time:18:58:23
                                                                                                                                                                                    Start date:24/04/2024
                                                                                                                                                                                    Path:C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\AccountChanger.exe"
                                                                                                                                                                                    Imagebase:0x7ff7e1040000
                                                                                                                                                                                    File size:18'565'178 bytes
                                                                                                                                                                                    MD5 hash:874D9918AC068743FF1D236347FFA120
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    Target ID:4
                                                                                                                                                                                    Start time:18:58:24
                                                                                                                                                                                    Start date:24/04/2024
                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                    Imagebase:0x7ff69f910000
                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                    Start time:18:58:24
                                                                                                                                                                                    Start date:24/04/2024
                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    Imagebase:0x7ff7699e0000
                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                    Reset < >

                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                      Execution Coverage:10.1%
                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                      Signature Coverage:13.7%
                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                      Total number of Limit Nodes:28
                                                                                                                                                                                      execution_graph 18320 7ff7e104b0b0 18321 7ff7e104b0c0 18320->18321 18337 7ff7e105579c 18321->18337 18323 7ff7e104b0cc 18343 7ff7e104b3b8 18323->18343 18325 7ff7e104b69c 7 API calls 18327 7ff7e104b165 18325->18327 18326 7ff7e104b0e4 _RTC_Initialize 18335 7ff7e104b139 18326->18335 18348 7ff7e104b568 18326->18348 18329 7ff7e104b0f9 18351 7ff7e1057e6c 18329->18351 18335->18325 18336 7ff7e104b155 18335->18336 18338 7ff7e10557ad 18337->18338 18339 7ff7e1054444 _set_fmode 11 API calls 18338->18339 18342 7ff7e10557b5 18338->18342 18340 7ff7e10557c4 18339->18340 18341 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 18340->18341 18341->18342 18342->18323 18344 7ff7e104b3c9 18343->18344 18347 7ff7e104b3ce __scrt_release_startup_lock 18343->18347 18345 7ff7e104b69c 7 API calls 18344->18345 18344->18347 18346 7ff7e104b442 18345->18346 18347->18326 18376 7ff7e104b52c 18348->18376 18350 7ff7e104b571 18350->18329 18352 7ff7e1057e8c 18351->18352 18366 7ff7e104b105 18351->18366 18353 7ff7e1057eaa GetModuleFileNameW 18352->18353 18354 7ff7e1057e94 18352->18354 18358 7ff7e1057ed5 18353->18358 18355 7ff7e1054444 _set_fmode 11 API calls 18354->18355 18356 7ff7e1057e99 18355->18356 18357 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 18356->18357 18357->18366 18359 7ff7e1057e0c 11 API calls 18358->18359 18360 7ff7e1057f15 18359->18360 18361 7ff7e1057f1d 18360->18361 18365 7ff7e1057f35 18360->18365 18362 7ff7e1054444 _set_fmode 11 API calls 18361->18362 18363 7ff7e1057f22 18362->18363 18364 7ff7e1059e18 __free_lconv_mon 11 API calls 18363->18364 18364->18366 18368 7ff7e1057f9c 18365->18368 18369 7ff7e1057f83 18365->18369 18374 7ff7e1057f57 18365->18374 18366->18335 18375 7ff7e104b63c InitializeSListHead 18366->18375 18367 7ff7e1059e18 __free_lconv_mon 11 API calls 18367->18366 18372 7ff7e1059e18 __free_lconv_mon 11 API calls 18368->18372 18370 7ff7e1059e18 __free_lconv_mon 11 API calls 18369->18370 18371 7ff7e1057f8c 18370->18371 18373 7ff7e1059e18 __free_lconv_mon 11 API calls 18371->18373 18372->18374 18373->18366 18374->18367 18377 7ff7e104b546 18376->18377 18379 7ff7e104b53f 18376->18379 18380 7ff7e1058eec 18377->18380 18379->18350 18383 7ff7e1058b28 18380->18383 18390 7ff7e105f788 EnterCriticalSection 18383->18390 14885 7ff7e104b19c 14906 7ff7e104b36c 14885->14906 14888 7ff7e104b2e8 15008 7ff7e104b69c IsProcessorFeaturePresent 14888->15008 14889 7ff7e104b1b8 __scrt_acquire_startup_lock 14891 7ff7e104b2f2 14889->14891 14898 7ff7e104b1d6 __scrt_release_startup_lock 14889->14898 14892 7ff7e104b69c 7 API calls 14891->14892 14894 7ff7e104b2fd __FrameHandler3::FrameUnwindToEmptyState 14892->14894 14893 7ff7e104b1fb 14895 7ff7e104b281 14912 7ff7e104b7e8 14895->14912 14897 7ff7e104b286 14915 7ff7e1041000 14897->14915 14898->14893 14898->14895 14997 7ff7e1058984 14898->14997 14903 7ff7e104b2a9 14903->14894 15004 7ff7e104b500 14903->15004 15015 7ff7e104b96c 14906->15015 14909 7ff7e104b39b __scrt_initialize_crt 14911 7ff7e104b1b0 14909->14911 15017 7ff7e104cac8 14909->15017 14911->14888 14911->14889 15044 7ff7e104c210 14912->15044 14916 7ff7e104100b 14915->14916 15046 7ff7e1047600 14916->15046 14918 7ff7e104101d 15053 7ff7e1054f14 14918->15053 14920 7ff7e104367b 15060 7ff7e1041af0 14920->15060 14924 7ff7e104ad80 _wfindfirst32i64 8 API calls 14925 7ff7e10437ae 14924->14925 15002 7ff7e104b82c GetModuleHandleW 14925->15002 14926 7ff7e1043699 14989 7ff7e104379a 14926->14989 15076 7ff7e1043b20 14926->15076 14928 7ff7e10436cb 14928->14989 15079 7ff7e1046990 14928->15079 14930 7ff7e10436e7 14931 7ff7e1043733 14930->14931 14933 7ff7e1046990 61 API calls 14930->14933 15094 7ff7e1046f90 14931->15094 14938 7ff7e1043708 __std_exception_copy 14933->14938 14934 7ff7e1043748 15098 7ff7e10419d0 14934->15098 14937 7ff7e104383d 14940 7ff7e1043868 14937->14940 15189 7ff7e1043280 14937->15189 14938->14931 14943 7ff7e1046f90 58 API calls 14938->14943 14939 7ff7e10419d0 121 API calls 14942 7ff7e104377e 14939->14942 14948 7ff7e10438ab 14940->14948 15193 7ff7e1047a30 14940->15193 14946 7ff7e1043782 14942->14946 14947 7ff7e10437c0 14942->14947 14943->14931 14945 7ff7e1043888 14949 7ff7e104389e SetDllDirectoryW 14945->14949 14950 7ff7e104388d 14945->14950 15153 7ff7e1042770 14946->15153 14947->14937 15166 7ff7e1043cb0 14947->15166 15109 7ff7e1045e40 14948->15109 14949->14948 14953 7ff7e1042770 59 API calls 14950->14953 14953->14989 14957 7ff7e10437e2 14962 7ff7e1042770 59 API calls 14957->14962 14958 7ff7e1043906 14965 7ff7e10439c6 14958->14965 14971 7ff7e1043919 14958->14971 14961 7ff7e1043810 14961->14937 14964 7ff7e1043815 14961->14964 14962->14989 14963 7ff7e10438c8 14963->14958 15217 7ff7e1045640 14963->15217 15185 7ff7e104f2ac 14964->15185 15113 7ff7e1043110 14965->15113 14978 7ff7e1043965 14971->14978 15317 7ff7e1041b30 14971->15317 14972 7ff7e10438dd 15237 7ff7e10455d0 14972->15237 14973 7ff7e10438fc 15311 7ff7e1045890 14973->15311 14978->14989 15321 7ff7e10430b0 14978->15321 14979 7ff7e10438e7 14979->14973 14981 7ff7e10438eb 14979->14981 14980 7ff7e10439fb 14982 7ff7e1046990 61 API calls 14980->14982 15305 7ff7e1045c90 14981->15305 14987 7ff7e1043a07 14982->14987 14985 7ff7e10439a1 14988 7ff7e1045890 FreeLibrary 14985->14988 14987->14989 15130 7ff7e1046fd0 14987->15130 14988->14989 14989->14924 14998 7ff7e10589bc 14997->14998 14999 7ff7e105899b 14997->14999 17714 7ff7e10590d8 14998->17714 14999->14895 15003 7ff7e104b83d 15002->15003 15003->14903 15005 7ff7e104b511 15004->15005 15006 7ff7e104b2c0 15005->15006 15007 7ff7e104cac8 __scrt_initialize_crt 7 API calls 15005->15007 15006->14893 15007->15006 15009 7ff7e104b6c2 _wfindfirst32i64 __scrt_get_show_window_mode 15008->15009 15010 7ff7e104b6e1 RtlCaptureContext RtlLookupFunctionEntry 15009->15010 15011 7ff7e104b70a RtlVirtualUnwind 15010->15011 15012 7ff7e104b746 __scrt_get_show_window_mode 15010->15012 15011->15012 15013 7ff7e104b778 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15012->15013 15014 7ff7e104b7ca _wfindfirst32i64 15013->15014 15014->14891 15016 7ff7e104b38e __scrt_dllmain_crt_thread_attach 15015->15016 15016->14909 15016->14911 15018 7ff7e104cada 15017->15018 15019 7ff7e104cad0 15017->15019 15018->14911 15023 7ff7e104ce44 15019->15023 15024 7ff7e104ce53 15023->15024 15026 7ff7e104cad5 15023->15026 15031 7ff7e104d080 15024->15031 15027 7ff7e104ceb0 15026->15027 15028 7ff7e104cedb 15027->15028 15029 7ff7e104cebe DeleteCriticalSection 15028->15029 15030 7ff7e104cedf 15028->15030 15029->15028 15030->15018 15035 7ff7e104cee8 15031->15035 15036 7ff7e104d002 TlsFree 15035->15036 15042 7ff7e104cf2c __vcrt_FlsAlloc 15035->15042 15037 7ff7e104cf5a LoadLibraryExW 15039 7ff7e104cf7b GetLastError 15037->15039 15040 7ff7e104cfd1 15037->15040 15038 7ff7e104cff1 GetProcAddress 15038->15036 15039->15042 15040->15038 15041 7ff7e104cfe8 FreeLibrary 15040->15041 15041->15038 15042->15036 15042->15037 15042->15038 15043 7ff7e104cf9d LoadLibraryExW 15042->15043 15043->15040 15043->15042 15045 7ff7e104b7ff GetStartupInfoW 15044->15045 15045->14897 15048 7ff7e104761f 15046->15048 15047 7ff7e1047670 WideCharToMultiByte 15047->15048 15049 7ff7e1047718 15047->15049 15048->15047 15048->15049 15050 7ff7e10476c6 WideCharToMultiByte 15048->15050 15052 7ff7e1047627 __std_exception_copy 15048->15052 15376 7ff7e1042620 15049->15376 15050->15048 15050->15049 15052->14918 15055 7ff7e105ec40 15053->15055 15054 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15059 7ff7e105ecbc 15054->15059 15056 7ff7e105ece6 15055->15056 15057 7ff7e105ec93 15055->15057 15773 7ff7e105eb18 15056->15773 15057->15054 15059->14920 15061 7ff7e1041b05 15060->15061 15062 7ff7e1041b20 15061->15062 15781 7ff7e10424d0 15061->15781 15062->14989 15064 7ff7e1043ba0 15062->15064 15065 7ff7e104adb0 15064->15065 15066 7ff7e1043bac GetModuleFileNameW 15065->15066 15067 7ff7e1043bdb 15066->15067 15068 7ff7e1043bf2 15066->15068 15069 7ff7e1042620 57 API calls 15067->15069 15821 7ff7e1047b40 15068->15821 15071 7ff7e1043bee 15069->15071 15074 7ff7e104ad80 _wfindfirst32i64 8 API calls 15071->15074 15073 7ff7e1042770 59 API calls 15073->15071 15075 7ff7e1043c2f 15074->15075 15075->14926 15077 7ff7e1041b30 49 API calls 15076->15077 15078 7ff7e1043b3d 15077->15078 15078->14928 15080 7ff7e104699a 15079->15080 15081 7ff7e1047a30 57 API calls 15080->15081 15082 7ff7e10469bc GetEnvironmentVariableW 15081->15082 15083 7ff7e1046a26 15082->15083 15084 7ff7e10469d4 ExpandEnvironmentStringsW 15082->15084 15085 7ff7e104ad80 _wfindfirst32i64 8 API calls 15083->15085 15086 7ff7e1047b40 59 API calls 15084->15086 15087 7ff7e1046a38 15085->15087 15088 7ff7e10469fc 15086->15088 15087->14930 15088->15083 15089 7ff7e1046a06 15088->15089 15832 7ff7e105910c 15089->15832 15092 7ff7e104ad80 _wfindfirst32i64 8 API calls 15093 7ff7e1046a1e 15092->15093 15093->14930 15095 7ff7e1047a30 57 API calls 15094->15095 15096 7ff7e1046fa7 SetEnvironmentVariableW 15095->15096 15097 7ff7e1046fbf __std_exception_copy 15096->15097 15097->14934 15099 7ff7e1041b30 49 API calls 15098->15099 15100 7ff7e1041a00 15099->15100 15101 7ff7e1041b30 49 API calls 15100->15101 15107 7ff7e1041a7a 15100->15107 15102 7ff7e1041a22 15101->15102 15103 7ff7e1043b20 49 API calls 15102->15103 15102->15107 15104 7ff7e1041a3b 15103->15104 15839 7ff7e10417b0 15104->15839 15107->14937 15107->14939 15108 7ff7e104f2ac 74 API calls 15108->15107 15110 7ff7e1045e55 15109->15110 15111 7ff7e10438b0 15110->15111 15112 7ff7e10424d0 59 API calls 15110->15112 15111->14958 15207 7ff7e1045ae0 15111->15207 15112->15111 15114 7ff7e10431c4 15113->15114 15120 7ff7e1043183 15113->15120 15115 7ff7e1043203 15114->15115 15116 7ff7e1041ab0 74 API calls 15114->15116 15117 7ff7e104ad80 _wfindfirst32i64 8 API calls 15115->15117 15116->15114 15118 7ff7e1043215 15117->15118 15118->14989 15123 7ff7e1046f20 15118->15123 15120->15114 15912 7ff7e1041440 15120->15912 15946 7ff7e1042990 15120->15946 16001 7ff7e1041780 15120->16001 15124 7ff7e1047a30 57 API calls 15123->15124 15125 7ff7e1046f3f 15124->15125 15126 7ff7e1047a30 57 API calls 15125->15126 15127 7ff7e1046f4f 15126->15127 15128 7ff7e10566b4 38 API calls 15127->15128 15129 7ff7e1046f5d __std_exception_copy 15128->15129 15129->14980 15131 7ff7e1046fe0 15130->15131 15132 7ff7e1047a30 57 API calls 15131->15132 15133 7ff7e1047011 SetConsoleCtrlHandler GetStartupInfoW 15132->15133 15134 7ff7e1047072 15133->15134 16886 7ff7e1059184 15134->16886 15138 7ff7e1047081 15139 7ff7e1059184 _fread_nolock 37 API calls 15138->15139 15140 7ff7e10470a0 15139->15140 15141 7ff7e1056ef8 _fread_nolock 37 API calls 15140->15141 15142 7ff7e10470a7 15141->15142 15143 7ff7e1059184 _fread_nolock 37 API calls 15142->15143 15144 7ff7e10470c7 15143->15144 15154 7ff7e1042790 15153->15154 15155 7ff7e1053be4 49 API calls 15154->15155 15156 7ff7e10427dd __scrt_get_show_window_mode 15155->15156 15157 7ff7e1047a30 57 API calls 15156->15157 15158 7ff7e104280a 15157->15158 15159 7ff7e1042849 MessageBoxA 15158->15159 15160 7ff7e104280f 15158->15160 15162 7ff7e1042863 15159->15162 15161 7ff7e1047a30 57 API calls 15160->15161 15163 7ff7e1042829 MessageBoxW 15161->15163 15164 7ff7e104ad80 _wfindfirst32i64 8 API calls 15162->15164 15163->15162 15165 7ff7e1042873 15164->15165 15165->14989 15167 7ff7e1043cbc 15166->15167 15168 7ff7e1047a30 57 API calls 15167->15168 15169 7ff7e1043ce7 15168->15169 15170 7ff7e1047a30 57 API calls 15169->15170 15171 7ff7e1043cfa 15170->15171 16904 7ff7e10554c8 15171->16904 15174 7ff7e104ad80 _wfindfirst32i64 8 API calls 15175 7ff7e10437da 15174->15175 15175->14957 15176 7ff7e1047200 15175->15176 15177 7ff7e1047224 15176->15177 15178 7ff7e10472fb __std_exception_copy 15177->15178 15179 7ff7e104f934 73 API calls 15177->15179 15178->14961 15180 7ff7e104723e 15179->15180 15180->15178 17283 7ff7e1057938 15180->17283 15182 7ff7e1047253 15182->15178 15183 7ff7e104f934 73 API calls 15182->15183 15184 7ff7e104f5fc _fread_nolock 53 API calls 15182->15184 15183->15182 15184->15182 15186 7ff7e104f2dc 15185->15186 17298 7ff7e104f088 15186->17298 15188 7ff7e104f2f5 15188->14957 15190 7ff7e1043297 15189->15190 15191 7ff7e10432c0 15189->15191 15190->15191 15192 7ff7e1041780 59 API calls 15190->15192 15191->14940 15192->15190 15194 7ff7e1047ad7 MultiByteToWideChar 15193->15194 15195 7ff7e1047a51 MultiByteToWideChar 15193->15195 15196 7ff7e1047afa 15194->15196 15197 7ff7e1047b1f 15194->15197 15198 7ff7e1047a77 15195->15198 15201 7ff7e1047a9c 15195->15201 15199 7ff7e1042620 55 API calls 15196->15199 15197->14945 15200 7ff7e1042620 55 API calls 15198->15200 15202 7ff7e1047b0d 15199->15202 15203 7ff7e1047a8a 15200->15203 15201->15194 15204 7ff7e1047ab2 15201->15204 15202->14945 15203->14945 15205 7ff7e1042620 55 API calls 15204->15205 15206 7ff7e1047ac5 15205->15206 15206->14945 15208 7ff7e1045b04 15207->15208 15213 7ff7e1045b31 15207->15213 15209 7ff7e1045b27 __std_exception_copy memcpy_s 15208->15209 15210 7ff7e1045b2c 15208->15210 15211 7ff7e1041780 59 API calls 15208->15211 15208->15213 15209->14963 17309 7ff7e10412b0 15210->17309 15211->15208 15213->15209 17335 7ff7e1043d30 15213->17335 15215 7ff7e1045b97 15215->15209 15216 7ff7e1042770 59 API calls 15215->15216 15216->15209 15231 7ff7e104565a memcpy_s 15217->15231 15219 7ff7e104577f 15221 7ff7e1043d30 49 API calls 15219->15221 15220 7ff7e104579b 15223 7ff7e1042770 59 API calls 15220->15223 15222 7ff7e10457f8 15221->15222 15226 7ff7e1043d30 49 API calls 15222->15226 15227 7ff7e1045791 __std_exception_copy 15223->15227 15224 7ff7e1043d30 49 API calls 15224->15231 15225 7ff7e1045760 15225->15219 15228 7ff7e1043d30 49 API calls 15225->15228 15229 7ff7e1045828 15226->15229 15230 7ff7e104ad80 _wfindfirst32i64 8 API calls 15227->15230 15228->15219 15234 7ff7e1043d30 49 API calls 15229->15234 15232 7ff7e10438d9 15230->15232 15231->15219 15231->15220 15231->15224 15231->15225 15231->15231 15233 7ff7e1041440 161 API calls 15231->15233 15235 7ff7e1045781 15231->15235 17338 7ff7e1041650 15231->17338 15232->14972 15232->14973 15233->15231 15234->15227 15236 7ff7e1042770 59 API calls 15235->15236 15236->15227 17343 7ff7e10471b0 15237->17343 15239 7ff7e10455e2 15240 7ff7e10471b0 58 API calls 15239->15240 15241 7ff7e10455f5 15240->15241 15242 7ff7e104561a 15241->15242 15243 7ff7e104560d GetProcAddress 15241->15243 15244 7ff7e1042770 59 API calls 15242->15244 15247 7ff7e1045f79 15243->15247 15248 7ff7e1045f9c GetProcAddress 15243->15248 15246 7ff7e1045626 15244->15246 15246->14979 15250 7ff7e1042620 57 API calls 15247->15250 15248->15247 15249 7ff7e1045fc1 GetProcAddress 15248->15249 15249->15247 15251 7ff7e1045fe6 GetProcAddress 15249->15251 15252 7ff7e1045f8c 15250->15252 15251->15247 15253 7ff7e104600e GetProcAddress 15251->15253 15252->14979 15253->15247 15254 7ff7e1046036 GetProcAddress 15253->15254 15254->15247 15255 7ff7e104605e GetProcAddress 15254->15255 15256 7ff7e104607a 15255->15256 15257 7ff7e1046086 GetProcAddress 15255->15257 15256->15257 15258 7ff7e10460ae GetProcAddress 15257->15258 15259 7ff7e10460a2 15257->15259 15260 7ff7e10460ca 15258->15260 15261 7ff7e10460d6 GetProcAddress 15258->15261 15259->15258 15260->15261 15262 7ff7e10460fe GetProcAddress 15261->15262 15263 7ff7e10460f2 15261->15263 15264 7ff7e104611a 15262->15264 15265 7ff7e1046126 GetProcAddress 15262->15265 15263->15262 15264->15265 15266 7ff7e104614e GetProcAddress 15265->15266 15267 7ff7e1046142 15265->15267 15268 7ff7e104616a 15266->15268 15269 7ff7e1046176 GetProcAddress 15266->15269 15267->15266 15268->15269 15306 7ff7e1045cb4 15305->15306 15307 7ff7e10438fa 15306->15307 15308 7ff7e1042770 59 API calls 15306->15308 15307->14958 15309 7ff7e1045d0e 15308->15309 15310 7ff7e1045890 FreeLibrary 15309->15310 15310->15307 15312 7ff7e10458bd 15311->15312 15313 7ff7e10458a2 15311->15313 15312->14958 15313->15312 15315 7ff7e1045980 15313->15315 17347 7ff7e1047190 FreeLibrary 15313->17347 15315->15312 17348 7ff7e1047190 FreeLibrary 15315->17348 15318 7ff7e1041b55 15317->15318 15319 7ff7e1053be4 49 API calls 15318->15319 15320 7ff7e1041b78 15319->15320 15320->14978 17349 7ff7e1044960 15321->17349 15324 7ff7e10430fd 15324->14985 15326 7ff7e10430d4 15326->15324 17405 7ff7e10446e0 15326->17405 15328 7ff7e10430e0 15328->15324 17415 7ff7e1044840 15328->17415 15330 7ff7e10430ec 15330->15324 15331 7ff7e1043327 15330->15331 15332 7ff7e104333c 15330->15332 15333 7ff7e1042770 59 API calls 15331->15333 15334 7ff7e104335c 15332->15334 15346 7ff7e1043372 __std_exception_copy 15332->15346 15337 7ff7e1043333 __std_exception_copy 15333->15337 15335 7ff7e1042770 59 API calls 15334->15335 15335->15337 15346->15337 15395 7ff7e104adb0 15376->15395 15378 7ff7e104263c GetLastError 15379 7ff7e1042669 15378->15379 15397 7ff7e1053be4 15379->15397 15384 7ff7e1041b30 49 API calls 15385 7ff7e10426c8 __scrt_get_show_window_mode 15384->15385 15386 7ff7e1047a30 54 API calls 15385->15386 15387 7ff7e10426f5 15386->15387 15388 7ff7e10426fa 15387->15388 15389 7ff7e1042734 MessageBoxA 15387->15389 15390 7ff7e1047a30 54 API calls 15388->15390 15391 7ff7e104274e 15389->15391 15392 7ff7e1042714 MessageBoxW 15390->15392 15393 7ff7e104ad80 _wfindfirst32i64 8 API calls 15391->15393 15392->15391 15394 7ff7e104275e 15393->15394 15394->15052 15396 7ff7e104adda 15395->15396 15396->15378 15396->15396 15399 7ff7e1053c3e 15397->15399 15398 7ff7e1053c63 15400 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15398->15400 15399->15398 15401 7ff7e1053c9f 15399->15401 15403 7ff7e1053c8d 15400->15403 15427 7ff7e1051e70 15401->15427 15404 7ff7e104ad80 _wfindfirst32i64 8 API calls 15403->15404 15407 7ff7e1042699 15404->15407 15405 7ff7e1059e18 __free_lconv_mon 11 API calls 15405->15403 15406 7ff7e1053d48 15409 7ff7e1053d7c 15406->15409 15414 7ff7e1053d51 15406->15414 15415 7ff7e10474b0 15407->15415 15409->15405 15410 7ff7e1053da0 15410->15409 15412 7ff7e1053daa 15410->15412 15411 7ff7e1059e18 __free_lconv_mon 11 API calls 15411->15403 15413 7ff7e1059e18 __free_lconv_mon 11 API calls 15412->15413 15413->15403 15414->15411 15416 7ff7e10474bc 15415->15416 15417 7ff7e10474d7 GetLastError 15416->15417 15418 7ff7e10474dd FormatMessageW 15416->15418 15417->15418 15419 7ff7e104752c WideCharToMultiByte 15418->15419 15420 7ff7e1047510 15418->15420 15422 7ff7e1047566 15419->15422 15424 7ff7e1047523 15419->15424 15421 7ff7e1042620 54 API calls 15420->15421 15421->15424 15423 7ff7e1042620 54 API calls 15422->15423 15423->15424 15425 7ff7e104ad80 _wfindfirst32i64 8 API calls 15424->15425 15426 7ff7e10426a0 15425->15426 15426->15384 15428 7ff7e1051eae 15427->15428 15429 7ff7e1051e9e 15427->15429 15430 7ff7e1051eb7 15428->15430 15439 7ff7e1051ee5 15428->15439 15431 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15429->15431 15432 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15430->15432 15433 7ff7e1051edd 15431->15433 15432->15433 15433->15406 15433->15409 15433->15410 15433->15414 15436 7ff7e1052194 15438 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15436->15438 15438->15429 15439->15429 15439->15433 15439->15436 15441 7ff7e1052800 15439->15441 15467 7ff7e10524c8 15439->15467 15497 7ff7e1051d50 15439->15497 15500 7ff7e1053a20 15439->15500 15442 7ff7e10528b5 15441->15442 15443 7ff7e1052842 15441->15443 15444 7ff7e10528ba 15442->15444 15445 7ff7e105290f 15442->15445 15446 7ff7e1052848 15443->15446 15447 7ff7e10528df 15443->15447 15451 7ff7e10528ef 15444->15451 15454 7ff7e10528bc 15444->15454 15445->15447 15448 7ff7e105291e 15445->15448 15465 7ff7e1052878 15445->15465 15446->15448 15450 7ff7e105284d 15446->15450 15524 7ff7e1050db0 15447->15524 15466 7ff7e105294d 15448->15466 15538 7ff7e10511c0 15448->15538 15456 7ff7e1052890 15450->15456 15458 7ff7e105285d 15450->15458 15450->15465 15531 7ff7e10509a0 15451->15531 15455 7ff7e10528cb 15454->15455 15454->15458 15455->15447 15459 7ff7e10528d0 15455->15459 15456->15466 15516 7ff7e1053620 15456->15516 15458->15466 15506 7ff7e1053164 15458->15506 15459->15466 15520 7ff7e10537b8 15459->15520 15461 7ff7e104ad80 _wfindfirst32i64 8 API calls 15463 7ff7e1052be3 15461->15463 15463->15439 15465->15466 15545 7ff7e105da00 15465->15545 15466->15461 15468 7ff7e10524e9 15467->15468 15469 7ff7e10524d3 15467->15469 15470 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15468->15470 15471 7ff7e1052527 15468->15471 15469->15471 15472 7ff7e10528b5 15469->15472 15473 7ff7e1052842 15469->15473 15470->15471 15471->15439 15474 7ff7e10528ba 15472->15474 15475 7ff7e105290f 15472->15475 15476 7ff7e1052848 15473->15476 15477 7ff7e10528df 15473->15477 15478 7ff7e10528bc 15474->15478 15479 7ff7e10528ef 15474->15479 15475->15477 15485 7ff7e105291e 15475->15485 15495 7ff7e1052878 15475->15495 15484 7ff7e105284d 15476->15484 15476->15485 15481 7ff7e1050db0 38 API calls 15477->15481 15480 7ff7e105285d 15478->15480 15488 7ff7e10528cb 15478->15488 15482 7ff7e10509a0 38 API calls 15479->15482 15483 7ff7e1053164 47 API calls 15480->15483 15496 7ff7e105294d 15480->15496 15481->15495 15482->15495 15483->15495 15484->15480 15486 7ff7e1052890 15484->15486 15484->15495 15487 7ff7e10511c0 38 API calls 15485->15487 15485->15496 15489 7ff7e1053620 47 API calls 15486->15489 15486->15496 15487->15495 15488->15477 15490 7ff7e10528d0 15488->15490 15489->15495 15492 7ff7e10537b8 37 API calls 15490->15492 15490->15496 15491 7ff7e104ad80 _wfindfirst32i64 8 API calls 15493 7ff7e1052be3 15491->15493 15492->15495 15493->15439 15494 7ff7e105da00 47 API calls 15494->15495 15495->15494 15495->15496 15496->15491 15701 7ff7e104ff74 15497->15701 15501 7ff7e1053a37 15500->15501 15718 7ff7e105cb60 15501->15718 15507 7ff7e1053186 15506->15507 15555 7ff7e104fde0 15507->15555 15512 7ff7e1053a20 45 API calls 15515 7ff7e10532c3 15512->15515 15513 7ff7e105334c 15513->15465 15514 7ff7e1053a20 45 API calls 15514->15513 15515->15513 15515->15514 15515->15515 15517 7ff7e1053638 15516->15517 15519 7ff7e10536a0 15516->15519 15518 7ff7e105da00 47 API calls 15517->15518 15517->15519 15518->15519 15519->15465 15522 7ff7e10537d9 15520->15522 15521 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15523 7ff7e105380a 15521->15523 15522->15521 15522->15523 15523->15465 15525 7ff7e1050de3 15524->15525 15526 7ff7e1050e12 15525->15526 15528 7ff7e1050ecf 15525->15528 15527 7ff7e104fde0 12 API calls 15526->15527 15530 7ff7e1050e4f 15526->15530 15527->15530 15529 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15528->15529 15529->15530 15530->15465 15532 7ff7e10509d3 15531->15532 15533 7ff7e1050a02 15532->15533 15535 7ff7e1050abf 15532->15535 15534 7ff7e104fde0 12 API calls 15533->15534 15536 7ff7e1050a3f 15533->15536 15534->15536 15537 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15535->15537 15536->15465 15537->15536 15539 7ff7e10511f3 15538->15539 15540 7ff7e1051222 15539->15540 15542 7ff7e10512df 15539->15542 15541 7ff7e104fde0 12 API calls 15540->15541 15544 7ff7e105125f 15540->15544 15541->15544 15543 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15542->15543 15543->15544 15544->15465 15547 7ff7e105da28 15545->15547 15546 7ff7e105da6d 15551 7ff7e105da2d __scrt_get_show_window_mode 15546->15551 15554 7ff7e105da56 __scrt_get_show_window_mode 15546->15554 15698 7ff7e105f0b8 15546->15698 15547->15546 15548 7ff7e1053a20 45 API calls 15547->15548 15547->15551 15547->15554 15548->15546 15549 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15549->15551 15551->15465 15554->15549 15554->15551 15556 7ff7e104fe17 15555->15556 15557 7ff7e104fe06 15555->15557 15556->15557 15585 7ff7e105cacc 15556->15585 15563 7ff7e105d718 15557->15563 15560 7ff7e104fe58 15562 7ff7e1059e18 __free_lconv_mon 11 API calls 15560->15562 15561 7ff7e1059e18 __free_lconv_mon 11 API calls 15561->15560 15562->15557 15564 7ff7e105d768 15563->15564 15565 7ff7e105d735 15563->15565 15564->15565 15567 7ff7e105d79a 15564->15567 15566 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15565->15566 15576 7ff7e10532a1 15566->15576 15570 7ff7e105d8ad 15567->15570 15580 7ff7e105d7e2 15567->15580 15568 7ff7e105d99f 15625 7ff7e105cc04 15568->15625 15570->15568 15571 7ff7e105d965 15570->15571 15572 7ff7e105d934 15570->15572 15574 7ff7e105d8f7 15570->15574 15577 7ff7e105d8ed 15570->15577 15618 7ff7e105cf9c 15571->15618 15611 7ff7e105d27c 15572->15611 15601 7ff7e105d4ac 15574->15601 15576->15512 15576->15515 15577->15571 15579 7ff7e105d8f2 15577->15579 15579->15572 15579->15574 15580->15576 15592 7ff7e10591ac 15580->15592 15583 7ff7e1059dd0 _wfindfirst32i64 17 API calls 15584 7ff7e105d9fc 15583->15584 15586 7ff7e105cb17 15585->15586 15590 7ff7e105cadb _set_fmode 15585->15590 15587 7ff7e1054444 _set_fmode 11 API calls 15586->15587 15589 7ff7e104fe44 15587->15589 15588 7ff7e105cafe RtlAllocateHeap 15588->15589 15588->15590 15589->15560 15589->15561 15590->15586 15590->15588 15591 7ff7e10626b0 _set_fmode 2 API calls 15590->15591 15591->15590 15593 7ff7e10591b9 15592->15593 15594 7ff7e10591c3 15592->15594 15593->15594 15598 7ff7e10591de 15593->15598 15595 7ff7e1054444 _set_fmode 11 API calls 15594->15595 15596 7ff7e10591ca 15595->15596 15599 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 15596->15599 15597 7ff7e10591d6 15597->15576 15597->15583 15598->15597 15600 7ff7e1054444 _set_fmode 11 API calls 15598->15600 15599->15597 15600->15596 15634 7ff7e10631cc 15601->15634 15605 7ff7e105d554 15606 7ff7e105d558 15605->15606 15607 7ff7e105d5a9 15605->15607 15609 7ff7e105d574 15605->15609 15606->15576 15687 7ff7e105d098 15607->15687 15683 7ff7e105d354 15609->15683 15612 7ff7e10631cc 38 API calls 15611->15612 15613 7ff7e105d2c6 15612->15613 15614 7ff7e1062c14 37 API calls 15613->15614 15615 7ff7e105d316 15614->15615 15616 7ff7e105d31a 15615->15616 15617 7ff7e105d354 45 API calls 15615->15617 15616->15576 15617->15616 15619 7ff7e10631cc 38 API calls 15618->15619 15620 7ff7e105cfe7 15619->15620 15621 7ff7e1062c14 37 API calls 15620->15621 15622 7ff7e105d03f 15621->15622 15623 7ff7e105d043 15622->15623 15624 7ff7e105d098 45 API calls 15622->15624 15623->15576 15624->15623 15626 7ff7e105cc7c 15625->15626 15627 7ff7e105cc49 15625->15627 15629 7ff7e105cc94 15626->15629 15631 7ff7e105cd15 15626->15631 15628 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15627->15628 15633 7ff7e105cc75 __scrt_get_show_window_mode 15628->15633 15630 7ff7e105cf9c 46 API calls 15629->15630 15630->15633 15632 7ff7e1053a20 45 API calls 15631->15632 15631->15633 15632->15633 15633->15576 15635 7ff7e106321f fegetenv 15634->15635 15636 7ff7e106712c 37 API calls 15635->15636 15639 7ff7e1063272 15636->15639 15637 7ff7e1063362 15640 7ff7e106712c 37 API calls 15637->15640 15638 7ff7e106329f 15642 7ff7e10591ac __std_exception_copy 37 API calls 15638->15642 15639->15637 15643 7ff7e106333c 15639->15643 15644 7ff7e106328d 15639->15644 15641 7ff7e106338c 15640->15641 15645 7ff7e106712c 37 API calls 15641->15645 15646 7ff7e106331d 15642->15646 15648 7ff7e10591ac __std_exception_copy 37 API calls 15643->15648 15644->15637 15644->15638 15649 7ff7e106339d 15645->15649 15647 7ff7e1064444 15646->15647 15654 7ff7e1063325 15646->15654 15650 7ff7e1059dd0 _wfindfirst32i64 17 API calls 15647->15650 15648->15646 15651 7ff7e1067320 20 API calls 15649->15651 15652 7ff7e1064459 15650->15652 15661 7ff7e1063406 __scrt_get_show_window_mode 15651->15661 15653 7ff7e104ad80 _wfindfirst32i64 8 API calls 15655 7ff7e105d4f9 15653->15655 15654->15653 15679 7ff7e1062c14 15655->15679 15656 7ff7e10637af __scrt_get_show_window_mode 15657 7ff7e1063447 memcpy_s 15672 7ff7e1063d8b memcpy_s __scrt_get_show_window_mode 15657->15672 15676 7ff7e10638a3 memcpy_s __scrt_get_show_window_mode 15657->15676 15658 7ff7e1063aef 15659 7ff7e1062d30 37 API calls 15658->15659 15665 7ff7e1064207 15659->15665 15660 7ff7e1063a9b 15660->15658 15662 7ff7e106445c memcpy_s 37 API calls 15660->15662 15661->15656 15661->15657 15663 7ff7e1054444 _set_fmode 11 API calls 15661->15663 15662->15658 15664 7ff7e1063880 15663->15664 15666 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 15664->15666 15667 7ff7e106445c memcpy_s 37 API calls 15665->15667 15678 7ff7e1064262 15665->15678 15666->15657 15667->15678 15668 7ff7e10643e8 15669 7ff7e106712c 37 API calls 15668->15669 15669->15654 15670 7ff7e1054444 11 API calls _set_fmode 15670->15676 15671 7ff7e1054444 11 API calls _set_fmode 15671->15672 15672->15658 15672->15660 15672->15671 15674 7ff7e1059db0 37 API calls _invalid_parameter_noinfo 15672->15674 15673 7ff7e1062d30 37 API calls 15673->15678 15674->15672 15675 7ff7e1059db0 37 API calls _invalid_parameter_noinfo 15675->15676 15676->15660 15676->15670 15676->15675 15677 7ff7e106445c memcpy_s 37 API calls 15677->15678 15678->15668 15678->15673 15678->15677 15680 7ff7e1062c33 15679->15680 15681 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15680->15681 15682 7ff7e1062c5e memcpy_s 15680->15682 15681->15682 15682->15605 15684 7ff7e105d380 memcpy_s 15683->15684 15684->15684 15685 7ff7e1053a20 45 API calls 15684->15685 15686 7ff7e105d43a memcpy_s __scrt_get_show_window_mode 15684->15686 15685->15686 15686->15606 15688 7ff7e105d0d3 15687->15688 15692 7ff7e105d120 memcpy_s 15687->15692 15689 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15688->15689 15690 7ff7e105d0ff 15689->15690 15690->15606 15691 7ff7e105d18b 15693 7ff7e10591ac __std_exception_copy 37 API calls 15691->15693 15692->15691 15695 7ff7e1053a20 45 API calls 15692->15695 15694 7ff7e105d1cd memcpy_s 15693->15694 15696 7ff7e1059dd0 _wfindfirst32i64 17 API calls 15694->15696 15695->15691 15697 7ff7e105d278 15696->15697 15700 7ff7e105f0dc WideCharToMultiByte 15698->15700 15702 7ff7e104ffb3 15701->15702 15703 7ff7e104ffa1 15701->15703 15705 7ff7e104ffc0 15702->15705 15709 7ff7e104fffd 15702->15709 15704 7ff7e1054444 _set_fmode 11 API calls 15703->15704 15706 7ff7e104ffa6 15704->15706 15708 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15705->15708 15707 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 15706->15707 15713 7ff7e104ffb1 15707->15713 15708->15713 15710 7ff7e10500a6 15709->15710 15711 7ff7e1054444 _set_fmode 11 API calls 15709->15711 15712 7ff7e1054444 _set_fmode 11 API calls 15710->15712 15710->15713 15714 7ff7e105009b 15711->15714 15715 7ff7e1050150 15712->15715 15713->15439 15716 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 15714->15716 15717 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 15715->15717 15716->15710 15717->15713 15719 7ff7e105cb79 15718->15719 15720 7ff7e1053a5f 15718->15720 15719->15720 15726 7ff7e1062424 15719->15726 15722 7ff7e105cbcc 15720->15722 15723 7ff7e105cbe5 15722->15723 15725 7ff7e1053a6f 15722->15725 15723->15725 15770 7ff7e1061790 15723->15770 15725->15439 15738 7ff7e105a620 GetLastError 15726->15738 15729 7ff7e106247e 15729->15720 15739 7ff7e105a644 FlsGetValue 15738->15739 15740 7ff7e105a661 FlsSetValue 15738->15740 15741 7ff7e105a65b 15739->15741 15757 7ff7e105a651 15739->15757 15742 7ff7e105a673 15740->15742 15740->15757 15741->15740 15744 7ff7e105dd40 _set_fmode 11 API calls 15742->15744 15743 7ff7e105a6cd SetLastError 15745 7ff7e105a6ed 15743->15745 15746 7ff7e105a6da 15743->15746 15747 7ff7e105a682 15744->15747 15761 7ff7e105920c 15745->15761 15746->15729 15760 7ff7e105f788 EnterCriticalSection 15746->15760 15749 7ff7e105a6a0 FlsSetValue 15747->15749 15750 7ff7e105a690 FlsSetValue 15747->15750 15751 7ff7e105a6ac FlsSetValue 15749->15751 15752 7ff7e105a6be 15749->15752 15754 7ff7e105a699 15750->15754 15751->15754 15755 7ff7e105a3c4 _set_fmode 11 API calls 15752->15755 15756 7ff7e1059e18 __free_lconv_mon 11 API calls 15754->15756 15758 7ff7e105a6c6 15755->15758 15756->15757 15757->15743 15759 7ff7e1059e18 __free_lconv_mon 11 API calls 15758->15759 15759->15743 15762 7ff7e1062770 __FrameHandler3::FrameUnwindToEmptyState EnterCriticalSection LeaveCriticalSection 15761->15762 15763 7ff7e1059215 15762->15763 15764 7ff7e1059224 15763->15764 15765 7ff7e10627c0 __FrameHandler3::FrameUnwindToEmptyState 44 API calls 15763->15765 15766 7ff7e105922d IsProcessorFeaturePresent 15764->15766 15768 7ff7e1059257 __FrameHandler3::FrameUnwindToEmptyState 15764->15768 15765->15764 15767 7ff7e105923c 15766->15767 15769 7ff7e1059ae4 _wfindfirst32i64 14 API calls 15767->15769 15769->15768 15771 7ff7e105a620 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 15770->15771 15772 7ff7e1061799 15771->15772 15780 7ff7e10542ec EnterCriticalSection 15773->15780 15782 7ff7e10424ec 15781->15782 15783 7ff7e1053be4 49 API calls 15782->15783 15784 7ff7e104253f 15783->15784 15785 7ff7e1054444 _set_fmode 11 API calls 15784->15785 15786 7ff7e1042544 15785->15786 15800 7ff7e1054464 15786->15800 15789 7ff7e1041b30 49 API calls 15790 7ff7e1042573 __scrt_get_show_window_mode 15789->15790 15791 7ff7e1047a30 57 API calls 15790->15791 15792 7ff7e10425a0 15791->15792 15793 7ff7e10425df MessageBoxA 15792->15793 15794 7ff7e10425a5 15792->15794 15796 7ff7e10425f9 15793->15796 15795 7ff7e1047a30 57 API calls 15794->15795 15797 7ff7e10425bf MessageBoxW 15795->15797 15798 7ff7e104ad80 _wfindfirst32i64 8 API calls 15796->15798 15797->15796 15799 7ff7e1042609 15798->15799 15799->15062 15801 7ff7e105a798 _set_fmode 11 API calls 15800->15801 15802 7ff7e105447b 15801->15802 15803 7ff7e104254b 15802->15803 15804 7ff7e105dd40 _set_fmode 11 API calls 15802->15804 15807 7ff7e10544bb 15802->15807 15803->15789 15805 7ff7e10544b0 15804->15805 15806 7ff7e1059e18 __free_lconv_mon 11 API calls 15805->15806 15806->15807 15807->15803 15812 7ff7e105e418 15807->15812 15810 7ff7e1059dd0 _wfindfirst32i64 17 API calls 15811 7ff7e1054500 15810->15811 15815 7ff7e105e435 15812->15815 15813 7ff7e105e43a 15814 7ff7e1054444 _set_fmode 11 API calls 15813->15814 15818 7ff7e10544e1 15813->15818 15820 7ff7e105e444 15814->15820 15815->15813 15817 7ff7e105e484 15815->15817 15815->15818 15816 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 15816->15818 15817->15818 15819 7ff7e1054444 _set_fmode 11 API calls 15817->15819 15818->15803 15818->15810 15819->15820 15820->15816 15822 7ff7e1047bd2 WideCharToMultiByte 15821->15822 15823 7ff7e1047b64 WideCharToMultiByte 15821->15823 15824 7ff7e1047bff 15822->15824 15828 7ff7e1043c05 15822->15828 15825 7ff7e1047b8e 15823->15825 15826 7ff7e1047ba5 15823->15826 15827 7ff7e1042620 57 API calls 15824->15827 15829 7ff7e1042620 57 API calls 15825->15829 15826->15822 15830 7ff7e1047bbb 15826->15830 15827->15828 15828->15071 15828->15073 15829->15828 15831 7ff7e1042620 57 API calls 15830->15831 15831->15828 15833 7ff7e1046a0e 15832->15833 15834 7ff7e1059123 15832->15834 15833->15092 15834->15833 15835 7ff7e10591ac __std_exception_copy 37 API calls 15834->15835 15836 7ff7e1059150 15835->15836 15836->15833 15837 7ff7e1059dd0 _wfindfirst32i64 17 API calls 15836->15837 15838 7ff7e1059180 15837->15838 15840 7ff7e10417e4 15839->15840 15841 7ff7e10417d4 15839->15841 15843 7ff7e1047200 83 API calls 15840->15843 15872 7ff7e1041842 15840->15872 15842 7ff7e1043cb0 116 API calls 15841->15842 15842->15840 15844 7ff7e1041815 15843->15844 15844->15872 15873 7ff7e104f934 15844->15873 15846 7ff7e104182b 15848 7ff7e104184c 15846->15848 15849 7ff7e104182f 15846->15849 15847 7ff7e104ad80 _wfindfirst32i64 8 API calls 15850 7ff7e10419c0 15847->15850 15877 7ff7e104f5fc 15848->15877 15851 7ff7e10424d0 59 API calls 15849->15851 15850->15107 15850->15108 15851->15872 15854 7ff7e104f934 73 API calls 15856 7ff7e10418d1 15854->15856 15855 7ff7e10424d0 59 API calls 15855->15872 15857 7ff7e10418fe 15856->15857 15858 7ff7e10418e3 15856->15858 15860 7ff7e104f5fc _fread_nolock 53 API calls 15857->15860 15859 7ff7e10424d0 59 API calls 15858->15859 15859->15872 15861 7ff7e1041913 15860->15861 15862 7ff7e1041867 15861->15862 15863 7ff7e1041925 15861->15863 15862->15855 15880 7ff7e104f370 15863->15880 15866 7ff7e104193d 15868 7ff7e1042770 59 API calls 15866->15868 15867 7ff7e1041993 15870 7ff7e104f2ac 74 API calls 15867->15870 15867->15872 15868->15872 15869 7ff7e1041950 15869->15867 15871 7ff7e1042770 59 API calls 15869->15871 15870->15872 15871->15867 15872->15847 15874 7ff7e104f964 15873->15874 15886 7ff7e104f6c4 15874->15886 15876 7ff7e104f97d 15876->15846 15898 7ff7e104f61c 15877->15898 15881 7ff7e1041939 15880->15881 15882 7ff7e104f379 15880->15882 15881->15866 15881->15869 15883 7ff7e1054444 _set_fmode 11 API calls 15882->15883 15884 7ff7e104f37e 15883->15884 15885 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 15884->15885 15885->15881 15887 7ff7e104f72e 15886->15887 15888 7ff7e104f6ee 15886->15888 15887->15888 15890 7ff7e104f73a 15887->15890 15889 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 15888->15889 15891 7ff7e104f715 15889->15891 15897 7ff7e10542ec EnterCriticalSection 15890->15897 15891->15876 15899 7ff7e104f646 15898->15899 15910 7ff7e1041861 15898->15910 15900 7ff7e104f655 __scrt_get_show_window_mode 15899->15900 15901 7ff7e104f692 15899->15901 15899->15910 15903 7ff7e1054444 _set_fmode 11 API calls 15900->15903 15911 7ff7e10542ec EnterCriticalSection 15901->15911 15905 7ff7e104f66a 15903->15905 15908 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 15905->15908 15908->15910 15910->15854 15910->15862 16005 7ff7e1046720 15912->16005 15914 7ff7e1041454 15915 7ff7e1041459 15914->15915 16014 7ff7e1046a40 15914->16014 15915->15120 15918 7ff7e10414a7 15921 7ff7e10414e0 15918->15921 15924 7ff7e1043cb0 116 API calls 15918->15924 15919 7ff7e1041487 15920 7ff7e10424d0 59 API calls 15919->15920 15923 7ff7e104149d 15920->15923 15922 7ff7e104f934 73 API calls 15921->15922 15925 7ff7e10414f2 15922->15925 15923->15120 15926 7ff7e10414bf 15924->15926 15928 7ff7e1041516 15925->15928 15929 7ff7e10414f6 15925->15929 15926->15921 15927 7ff7e10414c7 15926->15927 15930 7ff7e1042770 59 API calls 15927->15930 15932 7ff7e104151c 15928->15932 15933 7ff7e1041534 15928->15933 15931 7ff7e10424d0 59 API calls 15929->15931 15940 7ff7e10414d6 __std_exception_copy 15930->15940 15931->15940 16039 7ff7e1041050 15932->16039 15935 7ff7e1041556 15933->15935 15945 7ff7e1041575 15933->15945 15937 7ff7e10424d0 59 API calls 15935->15937 15936 7ff7e1041624 15939 7ff7e104f2ac 74 API calls 15936->15939 15937->15940 15938 7ff7e104f2ac 74 API calls 15938->15936 15939->15923 15940->15936 15940->15938 15941 7ff7e104f5fc _fread_nolock 53 API calls 15941->15945 15942 7ff7e10415d5 15944 7ff7e10424d0 59 API calls 15942->15944 15944->15940 15945->15940 15945->15941 15945->15942 16059 7ff7e104fd3c 15945->16059 15947 7ff7e10429a6 15946->15947 15948 7ff7e1041b30 49 API calls 15947->15948 15950 7ff7e10429db 15948->15950 15949 7ff7e1042de1 15950->15949 15951 7ff7e1043b20 49 API calls 15950->15951 15952 7ff7e1042a4f 15951->15952 16645 7ff7e1042e00 15952->16645 15955 7ff7e1042aca 15957 7ff7e1042e00 75 API calls 15955->15957 15956 7ff7e1042a91 15958 7ff7e1046720 98 API calls 15956->15958 15959 7ff7e1042b1c 15957->15959 15960 7ff7e1042a99 15958->15960 15961 7ff7e1042b20 15959->15961 15962 7ff7e1042b86 15959->15962 15963 7ff7e1042aba 15960->15963 16653 7ff7e1046600 15960->16653 15966 7ff7e1046720 98 API calls 15961->15966 15965 7ff7e1042e00 75 API calls 15962->15965 15967 7ff7e1042770 59 API calls 15963->15967 15970 7ff7e1042ac3 15963->15970 15968 7ff7e1042bb2 15965->15968 15969 7ff7e1042b28 15966->15969 15967->15970 15971 7ff7e1042c12 15968->15971 15973 7ff7e1042e00 75 API calls 15968->15973 15969->15963 15974 7ff7e1046600 138 API calls 15969->15974 15972 7ff7e104ad80 _wfindfirst32i64 8 API calls 15970->15972 15971->15949 15975 7ff7e1046720 98 API calls 15971->15975 15976 7ff7e1042b7b 15972->15976 15977 7ff7e1042be2 15973->15977 15978 7ff7e1042b45 15974->15978 15981 7ff7e1042c22 15975->15981 15976->15120 15977->15971 15980 7ff7e1042e00 75 API calls 15977->15980 15978->15963 15979 7ff7e1042dc6 15978->15979 15984 7ff7e1042770 59 API calls 15979->15984 15980->15971 15981->15949 15982 7ff7e1041af0 59 API calls 15981->15982 15985 7ff7e1042d3f 15981->15985 15983 7ff7e1042c7f 15982->15983 15983->15949 15986 7ff7e1041b30 49 API calls 15983->15986 16000 7ff7e1042d3a 15984->16000 15989 7ff7e1042dab 15985->15989 15994 7ff7e1041780 59 API calls 15985->15994 15988 7ff7e1042ca7 15986->15988 15987 7ff7e1041ab0 74 API calls 15987->15949 15988->15979 15990 7ff7e1041b30 49 API calls 15988->15990 15989->15979 15992 7ff7e1041440 161 API calls 15989->15992 15991 7ff7e1042cd4 15990->15991 15991->15979 15993 7ff7e1041b30 49 API calls 15991->15993 15992->15989 15994->15985 16000->15987 16002 7ff7e10417a1 16001->16002 16003 7ff7e1041795 16001->16003 16002->15120 16004 7ff7e1042770 59 API calls 16003->16004 16004->16002 16006 7ff7e1046768 16005->16006 16007 7ff7e1046732 16005->16007 16006->15914 16063 7ff7e10416d0 16007->16063 16012 7ff7e1042770 59 API calls 16013 7ff7e104675d 16012->16013 16013->15914 16015 7ff7e1046a50 16014->16015 16016 7ff7e1041b30 49 API calls 16015->16016 16017 7ff7e1046a81 16016->16017 16018 7ff7e1041b30 49 API calls 16017->16018 16029 7ff7e1046c4b 16017->16029 16021 7ff7e1046aa8 16018->16021 16019 7ff7e104ad80 _wfindfirst32i64 8 API calls 16020 7ff7e104147f 16019->16020 16020->15918 16020->15919 16021->16029 16588 7ff7e10550e8 16021->16588 16023 7ff7e1046bb9 16024 7ff7e1047a30 57 API calls 16023->16024 16026 7ff7e1046bd1 16024->16026 16025 7ff7e1046c7a 16027 7ff7e1043cb0 116 API calls 16025->16027 16026->16025 16028 7ff7e1046990 61 API calls 16026->16028 16032 7ff7e1046c02 __std_exception_copy 16026->16032 16027->16029 16028->16032 16029->16019 16030 7ff7e1046c6e 16035 7ff7e1042880 59 API calls 16030->16035 16031 7ff7e1046c3f 16597 7ff7e1042880 16031->16597 16032->16030 16032->16031 16034 7ff7e1046add 16034->16023 16034->16029 16036 7ff7e10550e8 49 API calls 16034->16036 16037 7ff7e1047a30 57 API calls 16034->16037 16038 7ff7e10478a0 58 API calls 16034->16038 16035->16025 16036->16034 16037->16034 16038->16034 16040 7ff7e10410a6 16039->16040 16041 7ff7e10410ad 16040->16041 16042 7ff7e10410d3 16040->16042 16043 7ff7e1042770 59 API calls 16041->16043 16045 7ff7e1041109 16042->16045 16046 7ff7e10410ed 16042->16046 16044 7ff7e10410c0 16043->16044 16044->15940 16048 7ff7e104111b 16045->16048 16057 7ff7e1041137 memcpy_s 16045->16057 16047 7ff7e10424d0 59 API calls 16046->16047 16052 7ff7e1041104 16047->16052 16049 7ff7e10424d0 59 API calls 16048->16049 16049->16052 16051 7ff7e104f5fc _fread_nolock 53 API calls 16051->16057 16623 7ff7e104a2f0 16052->16623 16053 7ff7e1041276 __std_exception_copy 16053->15940 16054 7ff7e10411fe 16055 7ff7e1042770 59 API calls 16054->16055 16055->16052 16056 7ff7e104fd3c 76 API calls 16056->16057 16057->16051 16057->16052 16057->16054 16057->16056 16058 7ff7e104f370 37 API calls 16057->16058 16058->16057 16060 7ff7e104fd6c 16059->16060 16630 7ff7e104fa8c 16060->16630 16062 7ff7e104fd8a 16062->15945 16065 7ff7e10416f5 16063->16065 16064 7ff7e1041738 16067 7ff7e1046780 16064->16067 16065->16064 16066 7ff7e1042770 59 API calls 16065->16066 16066->16064 16068 7ff7e1046798 16067->16068 16069 7ff7e10467b8 16068->16069 16070 7ff7e104680b 16068->16070 16072 7ff7e1046990 61 API calls 16069->16072 16071 7ff7e1046810 GetTempPathW 16070->16071 16073 7ff7e1046825 16071->16073 16074 7ff7e10467c4 16072->16074 16107 7ff7e1042470 16073->16107 16131 7ff7e1046480 16074->16131 16079 7ff7e10467ea __std_exception_copy 16079->16071 16085 7ff7e10467f8 16079->16085 16080 7ff7e104ad80 _wfindfirst32i64 8 API calls 16082 7ff7e104674d 16080->16082 16082->16006 16082->16012 16083 7ff7e104683e __std_exception_copy 16086 7ff7e10468e6 16083->16086 16090 7ff7e1046871 16083->16090 16111 7ff7e105736c 16083->16111 16114 7ff7e10478a0 16083->16114 16087 7ff7e1042770 59 API calls 16085->16087 16089 7ff7e1047b40 59 API calls 16086->16089 16088 7ff7e1046804 16087->16088 16106 7ff7e10468aa __std_exception_copy 16088->16106 16092 7ff7e10468f7 __std_exception_copy 16089->16092 16091 7ff7e1047a30 57 API calls 16090->16091 16090->16106 16093 7ff7e1046887 16091->16093 16094 7ff7e1047a30 57 API calls 16092->16094 16092->16106 16095 7ff7e10468c9 SetEnvironmentVariableW 16093->16095 16096 7ff7e104688c 16093->16096 16097 7ff7e1046915 16094->16097 16095->16106 16098 7ff7e1047a30 57 API calls 16096->16098 16099 7ff7e104691a 16097->16099 16100 7ff7e104694d SetEnvironmentVariableW 16097->16100 16101 7ff7e104689c 16098->16101 16102 7ff7e1047a30 57 API calls 16099->16102 16100->16106 16104 7ff7e10566b4 38 API calls 16101->16104 16103 7ff7e104692a 16102->16103 16104->16106 16106->16080 16108 7ff7e1042495 16107->16108 16165 7ff7e1053e38 16108->16165 16337 7ff7e1056f98 16111->16337 16115 7ff7e104adb0 16114->16115 16116 7ff7e10478b0 GetCurrentProcess OpenProcessToken 16115->16116 16117 7ff7e10478fb GetTokenInformation 16116->16117 16119 7ff7e1047971 __std_exception_copy 16116->16119 16118 7ff7e104791d GetLastError 16117->16118 16120 7ff7e1047928 16117->16120 16118->16119 16118->16120 16121 7ff7e104798a 16119->16121 16122 7ff7e1047984 CloseHandle 16119->16122 16120->16119 16123 7ff7e104793e GetTokenInformation 16120->16123 16468 7ff7e10475a0 16121->16468 16122->16121 16123->16119 16125 7ff7e1047964 ConvertSidToStringSidW 16123->16125 16125->16119 16132 7ff7e104648c 16131->16132 16133 7ff7e1047a30 57 API calls 16132->16133 16134 7ff7e10464ae 16133->16134 16135 7ff7e10464c9 ExpandEnvironmentStringsW 16134->16135 16136 7ff7e10464b6 16134->16136 16138 7ff7e10464ef __std_exception_copy 16135->16138 16137 7ff7e1042770 59 API calls 16136->16137 16144 7ff7e10464c2 16137->16144 16139 7ff7e1046506 16138->16139 16140 7ff7e10464f3 16138->16140 16145 7ff7e1046520 16139->16145 16146 7ff7e1046514 16139->16146 16142 7ff7e1042770 59 API calls 16140->16142 16141 7ff7e104ad80 _wfindfirst32i64 8 API calls 16143 7ff7e10465e8 16141->16143 16142->16144 16143->16106 16155 7ff7e10566b4 16143->16155 16144->16141 16479 7ff7e1055348 16145->16479 16472 7ff7e1055f44 16146->16472 16149 7ff7e104651e 16150 7ff7e104653a 16149->16150 16153 7ff7e104654d __scrt_get_show_window_mode 16149->16153 16151 7ff7e1042770 59 API calls 16150->16151 16151->16144 16152 7ff7e10465c2 CreateDirectoryW 16152->16144 16153->16152 16154 7ff7e104659c CreateDirectoryW 16153->16154 16154->16153 16156 7ff7e10566d4 16155->16156 16157 7ff7e10566c1 16155->16157 16580 7ff7e1056338 16156->16580 16158 7ff7e1054444 _set_fmode 11 API calls 16157->16158 16160 7ff7e10566c6 16158->16160 16162 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16160->16162 16163 7ff7e10566d2 16162->16163 16163->16079 16168 7ff7e1053e92 16165->16168 16166 7ff7e1053eb7 16167 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16166->16167 16171 7ff7e1053ee1 16167->16171 16168->16166 16169 7ff7e1053ef3 16168->16169 16183 7ff7e10521f0 16169->16183 16173 7ff7e104ad80 _wfindfirst32i64 8 API calls 16171->16173 16172 7ff7e1053fd4 16174 7ff7e1059e18 __free_lconv_mon 11 API calls 16172->16174 16175 7ff7e10424b4 16173->16175 16174->16171 16175->16083 16177 7ff7e1053fa9 16179 7ff7e1059e18 __free_lconv_mon 11 API calls 16177->16179 16178 7ff7e1053ffa 16178->16172 16181 7ff7e1054004 16178->16181 16179->16171 16180 7ff7e1053fa0 16180->16172 16180->16177 16182 7ff7e1059e18 __free_lconv_mon 11 API calls 16181->16182 16182->16171 16184 7ff7e105222e 16183->16184 16185 7ff7e105221e 16183->16185 16186 7ff7e1052237 16184->16186 16190 7ff7e1052265 16184->16190 16189 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16185->16189 16187 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16186->16187 16188 7ff7e105225d 16187->16188 16188->16172 16188->16177 16188->16178 16188->16180 16189->16188 16190->16185 16190->16188 16194 7ff7e1052c04 16190->16194 16227 7ff7e1052650 16190->16227 16264 7ff7e1051de0 16190->16264 16195 7ff7e1052cb7 16194->16195 16196 7ff7e1052c46 16194->16196 16199 7ff7e1052cbc 16195->16199 16200 7ff7e1052d10 16195->16200 16197 7ff7e1052c4c 16196->16197 16198 7ff7e1052ce1 16196->16198 16201 7ff7e1052c80 16197->16201 16202 7ff7e1052c51 16197->16202 16283 7ff7e1050fb4 16198->16283 16203 7ff7e1052cbe 16199->16203 16204 7ff7e1052cf1 16199->16204 16206 7ff7e1052d27 16200->16206 16208 7ff7e1052d1a 16200->16208 16213 7ff7e1052d1f 16200->16213 16209 7ff7e1052c57 16201->16209 16201->16213 16202->16206 16202->16209 16207 7ff7e1052c60 16203->16207 16216 7ff7e1052ccd 16203->16216 16290 7ff7e1050ba4 16204->16290 16297 7ff7e105390c 16206->16297 16226 7ff7e1052d50 16207->16226 16267 7ff7e10533b8 16207->16267 16208->16198 16208->16213 16209->16207 16214 7ff7e1052c92 16209->16214 16223 7ff7e1052c7b 16209->16223 16213->16226 16301 7ff7e10513c4 16213->16301 16214->16226 16277 7ff7e10536f4 16214->16277 16216->16198 16218 7ff7e1052cd2 16216->16218 16220 7ff7e10537b8 37 API calls 16218->16220 16218->16226 16219 7ff7e104ad80 _wfindfirst32i64 8 API calls 16221 7ff7e105304a 16219->16221 16220->16223 16221->16190 16222 7ff7e1053a20 45 API calls 16225 7ff7e1052f3c 16222->16225 16223->16222 16223->16225 16223->16226 16225->16226 16308 7ff7e105dbb0 16225->16308 16226->16219 16228 7ff7e105265e 16227->16228 16229 7ff7e1052674 16227->16229 16230 7ff7e1052cb7 16228->16230 16231 7ff7e1052c46 16228->16231 16233 7ff7e10526b4 16228->16233 16232 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16229->16232 16229->16233 16236 7ff7e1052cbc 16230->16236 16237 7ff7e1052d10 16230->16237 16234 7ff7e1052c4c 16231->16234 16235 7ff7e1052ce1 16231->16235 16232->16233 16233->16190 16238 7ff7e1052c80 16234->16238 16239 7ff7e1052c51 16234->16239 16242 7ff7e1050fb4 38 API calls 16235->16242 16240 7ff7e1052cbe 16236->16240 16241 7ff7e1052cf1 16236->16241 16243 7ff7e1052d27 16237->16243 16245 7ff7e1052d1a 16237->16245 16249 7ff7e1052d1f 16237->16249 16246 7ff7e1052c57 16238->16246 16238->16249 16239->16243 16239->16246 16244 7ff7e1052c60 16240->16244 16253 7ff7e1052ccd 16240->16253 16247 7ff7e1050ba4 38 API calls 16241->16247 16260 7ff7e1052c7b 16242->16260 16250 7ff7e105390c 45 API calls 16243->16250 16248 7ff7e10533b8 47 API calls 16244->16248 16263 7ff7e1052d50 16244->16263 16245->16235 16245->16249 16246->16244 16251 7ff7e1052c92 16246->16251 16246->16260 16247->16260 16248->16260 16252 7ff7e10513c4 38 API calls 16249->16252 16249->16263 16250->16260 16254 7ff7e10536f4 46 API calls 16251->16254 16251->16263 16252->16260 16253->16235 16255 7ff7e1052cd2 16253->16255 16254->16260 16257 7ff7e10537b8 37 API calls 16255->16257 16255->16263 16256 7ff7e104ad80 _wfindfirst32i64 8 API calls 16258 7ff7e105304a 16256->16258 16257->16260 16258->16190 16259 7ff7e1053a20 45 API calls 16262 7ff7e1052f3c 16259->16262 16260->16259 16260->16262 16260->16263 16261 7ff7e105dbb0 46 API calls 16261->16262 16262->16261 16262->16263 16263->16256 16320 7ff7e1050228 16264->16320 16268 7ff7e10533de 16267->16268 16269 7ff7e104fde0 12 API calls 16268->16269 16270 7ff7e105342e 16269->16270 16271 7ff7e105d718 46 API calls 16270->16271 16272 7ff7e1053501 16271->16272 16280 7ff7e1053729 16277->16280 16278 7ff7e105376e 16278->16223 16279 7ff7e1053747 16282 7ff7e105dbb0 46 API calls 16279->16282 16280->16278 16280->16279 16281 7ff7e1053a20 45 API calls 16280->16281 16281->16279 16282->16278 16284 7ff7e1050fe7 16283->16284 16285 7ff7e1051016 16284->16285 16287 7ff7e10510d3 16284->16287 16286 7ff7e104fe88 12 API calls 16285->16286 16289 7ff7e1051053 16285->16289 16286->16289 16288 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16287->16288 16288->16289 16289->16223 16292 7ff7e1050bd7 16290->16292 16291 7ff7e1050c06 16293 7ff7e104fe88 12 API calls 16291->16293 16296 7ff7e1050c43 16291->16296 16292->16291 16294 7ff7e1050cc3 16292->16294 16293->16296 16295 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16294->16295 16295->16296 16296->16223 16298 7ff7e105394f 16297->16298 16299 7ff7e10539a8 45 API calls 16298->16299 16300 7ff7e1053953 __crtLCMapStringW 16298->16300 16299->16300 16300->16223 16302 7ff7e10513f7 16301->16302 16303 7ff7e1051426 16302->16303 16305 7ff7e10514e3 16302->16305 16304 7ff7e104fe88 12 API calls 16303->16304 16307 7ff7e1051463 16303->16307 16304->16307 16306 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16305->16306 16306->16307 16307->16223 16309 7ff7e105dbe1 16308->16309 16317 7ff7e105dbef 16308->16317 16310 7ff7e105dc0f 16309->16310 16311 7ff7e1053a20 45 API calls 16309->16311 16309->16317 16311->16310 16317->16225 16321 7ff7e105025d 16320->16321 16322 7ff7e105026f 16320->16322 16323 7ff7e1054444 _set_fmode 11 API calls 16321->16323 16325 7ff7e105027d 16322->16325 16329 7ff7e10502b9 16322->16329 16324 7ff7e1050262 16323->16324 16327 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16324->16327 16326 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16325->16326 16334 7ff7e105026d 16326->16334 16327->16334 16328 7ff7e1050635 16330 7ff7e1054444 _set_fmode 11 API calls 16328->16330 16328->16334 16329->16328 16331 7ff7e1054444 _set_fmode 11 API calls 16329->16331 16332 7ff7e10508c9 16330->16332 16333 7ff7e105062a 16331->16333 16335 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16332->16335 16336 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16333->16336 16334->16190 16335->16334 16336->16328 16378 7ff7e1060698 16337->16378 16437 7ff7e1060410 16378->16437 16458 7ff7e105f788 EnterCriticalSection 16437->16458 16469 7ff7e10475c5 16468->16469 16470 7ff7e1053e38 48 API calls 16469->16470 16471 7ff7e10475e8 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 16470->16471 16473 7ff7e1055f95 16472->16473 16474 7ff7e1055f62 16472->16474 16473->16149 16474->16473 16491 7ff7e105f924 16474->16491 16477 7ff7e1059dd0 _wfindfirst32i64 17 API calls 16478 7ff7e1055fc5 16477->16478 16480 7ff7e1055364 16479->16480 16481 7ff7e10553d2 16479->16481 16480->16481 16482 7ff7e1055369 16480->16482 16525 7ff7e105f090 16481->16525 16484 7ff7e105539e 16482->16484 16485 7ff7e1055381 16482->16485 16508 7ff7e105518c GetFullPathNameW 16484->16508 16500 7ff7e1055118 GetFullPathNameW 16485->16500 16490 7ff7e1055396 __std_exception_copy 16490->16149 16492 7ff7e105f93b 16491->16492 16493 7ff7e105f931 16491->16493 16494 7ff7e1054444 _set_fmode 11 API calls 16492->16494 16493->16492 16498 7ff7e105f957 16493->16498 16495 7ff7e105f943 16494->16495 16496 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16495->16496 16497 7ff7e1055f91 16496->16497 16497->16473 16497->16477 16498->16497 16499 7ff7e1054444 _set_fmode 11 API calls 16498->16499 16499->16495 16501 7ff7e105513e GetLastError 16500->16501 16504 7ff7e1055154 16500->16504 16502 7ff7e10543b8 _fread_nolock 11 API calls 16501->16502 16505 7ff7e105514b 16502->16505 16503 7ff7e1055150 16503->16490 16504->16503 16506 7ff7e1054444 _set_fmode 11 API calls 16504->16506 16507 7ff7e1054444 _set_fmode 11 API calls 16505->16507 16506->16503 16507->16503 16509 7ff7e10551bf GetLastError 16508->16509 16513 7ff7e10551d5 __std_exception_copy 16508->16513 16510 7ff7e10543b8 _fread_nolock 11 API calls 16509->16510 16511 7ff7e10551cc 16510->16511 16512 7ff7e1054444 _set_fmode 11 API calls 16511->16512 16514 7ff7e10551d1 16512->16514 16513->16514 16515 7ff7e105522f GetFullPathNameW 16513->16515 16516 7ff7e1055264 16514->16516 16515->16509 16515->16514 16519 7ff7e10552d8 memcpy_s 16516->16519 16520 7ff7e105528d __scrt_get_show_window_mode 16516->16520 16517 7ff7e10552c1 16518 7ff7e1054444 _set_fmode 11 API calls 16517->16518 16519->16490 16520->16517 16520->16519 16521 7ff7e10552fa 16520->16521 16521->16519 16523 7ff7e1054444 _set_fmode 11 API calls 16521->16523 16528 7ff7e105eea0 16525->16528 16529 7ff7e105eecb 16528->16529 16530 7ff7e105eee2 16528->16530 16531 7ff7e1054444 _set_fmode 11 API calls 16529->16531 16532 7ff7e105ef07 16530->16532 16533 7ff7e105eee6 16530->16533 16535 7ff7e105eed0 16531->16535 16566 7ff7e105e508 16532->16566 16554 7ff7e105f00c 16533->16554 16540 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16535->16540 16553 7ff7e105eedb __std_exception_copy 16540->16553 16544 7ff7e104ad80 _wfindfirst32i64 8 API calls 16547 7ff7e105f001 16544->16547 16547->16490 16553->16544 16555 7ff7e105f056 16554->16555 16556 7ff7e105f026 16554->16556 16557 7ff7e105f041 16555->16557 16558 7ff7e105f061 GetDriveTypeW 16555->16558 16559 7ff7e1054424 _fread_nolock 11 API calls 16556->16559 16561 7ff7e104ad80 _wfindfirst32i64 8 API calls 16557->16561 16558->16557 16560 7ff7e105f02b 16559->16560 16567 7ff7e104c210 __scrt_get_show_window_mode 16566->16567 16568 7ff7e105e53e GetCurrentDirectoryW 16567->16568 16569 7ff7e105e57c 16568->16569 16570 7ff7e105e555 16568->16570 16587 7ff7e105f788 EnterCriticalSection 16580->16587 16589 7ff7e105a620 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16588->16589 16590 7ff7e10550fd 16589->16590 16591 7ff7e105ee97 16590->16591 16595 7ff7e105edb6 16590->16595 16610 7ff7e104af14 16591->16610 16594 7ff7e104ad80 _wfindfirst32i64 8 API calls 16596 7ff7e105ee8f 16594->16596 16595->16594 16596->16034 16598 7ff7e10428a0 16597->16598 16599 7ff7e1053be4 49 API calls 16598->16599 16600 7ff7e10428ed __scrt_get_show_window_mode 16599->16600 16601 7ff7e1047a30 57 API calls 16600->16601 16602 7ff7e104291a 16601->16602 16603 7ff7e1042959 MessageBoxA 16602->16603 16604 7ff7e104291f 16602->16604 16606 7ff7e1042973 16603->16606 16605 7ff7e1047a30 57 API calls 16604->16605 16613 7ff7e104af28 IsProcessorFeaturePresent 16610->16613 16614 7ff7e104af3f 16613->16614 16619 7ff7e104afc4 RtlCaptureContext RtlLookupFunctionEntry 16614->16619 16620 7ff7e104aff4 RtlVirtualUnwind 16619->16620 16621 7ff7e104af53 16619->16621 16620->16621 16622 7ff7e104ae00 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16621->16622 16624 7ff7e104a364 16623->16624 16625 7ff7e104a2fe 16623->16625 16624->16053 16625->16624 16626 7ff7e104a342 16625->16626 16628 7ff7e1059e18 11 API calls 16625->16628 16629 7ff7e1059e18 11 API calls 16626->16629 16627 7ff7e104a354 16627->16053 16628->16626 16629->16627 16631 7ff7e104faac 16630->16631 16636 7ff7e104fad9 16630->16636 16632 7ff7e104fab6 16631->16632 16633 7ff7e104fae1 16631->16633 16631->16636 16635 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 16632->16635 16637 7ff7e104f9cc 16633->16637 16635->16636 16636->16062 16644 7ff7e10542ec EnterCriticalSection 16637->16644 16646 7ff7e1042e34 16645->16646 16647 7ff7e1053be4 49 API calls 16646->16647 16648 7ff7e1042e5a 16647->16648 16649 7ff7e1042e6b 16648->16649 16677 7ff7e1054e08 16648->16677 16651 7ff7e104ad80 _wfindfirst32i64 8 API calls 16649->16651 16652 7ff7e1042a8d 16651->16652 16652->15955 16652->15956 16654 7ff7e104660e 16653->16654 16655 7ff7e1043cb0 116 API calls 16654->16655 16656 7ff7e1046635 16655->16656 16657 7ff7e1046a40 136 API calls 16656->16657 16658 7ff7e1046643 16657->16658 16659 7ff7e10466f3 16658->16659 16660 7ff7e104665d 16658->16660 16662 7ff7e104f2ac 74 API calls 16659->16662 16663 7ff7e10466ef 16659->16663 16860 7ff7e104f344 16660->16860 16662->16663 16664 7ff7e104ad80 _wfindfirst32i64 8 API calls 16663->16664 16665 7ff7e1046715 16664->16665 16665->15963 16666 7ff7e10466d0 16667 7ff7e104f2ac 74 API calls 16666->16667 16669 7ff7e10466e7 16667->16669 16668 7ff7e104f5fc _fread_nolock 53 API calls 16676 7ff7e1046662 16668->16676 16670 7ff7e104f2ac 74 API calls 16669->16670 16670->16663 16671 7ff7e104f370 37 API calls 16671->16676 16672 7ff7e104fd3c 76 API calls 16672->16676 16673 7ff7e1046699 16866 7ff7e1057388 16673->16866 16674 7ff7e104f344 37 API calls 16674->16676 16676->16666 16676->16668 16676->16671 16676->16672 16676->16673 16676->16674 16678 7ff7e1054e25 16677->16678 16679 7ff7e1054e31 16677->16679 16694 7ff7e1054680 16678->16694 16719 7ff7e1054a1c 16679->16719 16686 7ff7e1054ed9 16690 7ff7e1054680 69 API calls 16686->16690 16687 7ff7e1054ec5 16689 7ff7e1054e2a 16687->16689 16691 7ff7e1059e18 __free_lconv_mon 11 API calls 16687->16691 16688 7ff7e1054e69 16730 7ff7e1054504 16688->16730 16689->16649 16692 7ff7e1054ee5 16690->16692 16691->16689 16692->16689 16693 7ff7e1059e18 __free_lconv_mon 11 API calls 16692->16693 16693->16689 16695 7ff7e10546b7 16694->16695 16696 7ff7e105469a 16694->16696 16695->16696 16698 7ff7e10546ca CreateFileW 16695->16698 16697 7ff7e1054424 _fread_nolock 11 API calls 16696->16697 16699 7ff7e105469f 16697->16699 16700 7ff7e10546fe 16698->16700 16701 7ff7e1054734 16698->16701 16702 7ff7e1054444 _set_fmode 11 API calls 16699->16702 16752 7ff7e10547d4 GetFileType 16700->16752 16778 7ff7e1054cf8 16701->16778 16705 7ff7e10546a7 16702->16705 16710 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16705->16710 16708 7ff7e105473d 16713 7ff7e10543b8 _fread_nolock 11 API calls 16708->16713 16709 7ff7e1054768 16799 7ff7e1054ab8 16709->16799 16715 7ff7e10546b2 16710->16715 16711 7ff7e1054729 CloseHandle 16711->16715 16712 7ff7e1054713 CloseHandle 16712->16715 16718 7ff7e1054747 16713->16718 16715->16689 16718->16715 16720 7ff7e1054a40 16719->16720 16726 7ff7e1054a3b 16719->16726 16721 7ff7e105a620 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16720->16721 16720->16726 16722 7ff7e1054a5b 16721->16722 16840 7ff7e105cb2c 16722->16840 16726->16688 16727 7ff7e105dfcc 16726->16727 16848 7ff7e105ddb8 16727->16848 16731 7ff7e105452e 16730->16731 16732 7ff7e1054552 16730->16732 16735 7ff7e105453d 16731->16735 16737 7ff7e1059e18 __free_lconv_mon 11 API calls 16731->16737 16733 7ff7e10545ac 16732->16733 16734 7ff7e1054557 16732->16734 16857 7ff7e105e7f0 16733->16857 16734->16735 16738 7ff7e1059e18 __free_lconv_mon 11 API calls 16734->16738 16744 7ff7e105456c 16734->16744 16735->16686 16735->16687 16737->16735 16738->16744 16739 7ff7e105cacc _fread_nolock 12 API calls 16739->16735 16744->16739 16753 7ff7e10548df 16752->16753 16754 7ff7e1054822 16752->16754 16756 7ff7e10548e7 16753->16756 16757 7ff7e1054909 16753->16757 16755 7ff7e105484e GetFileInformationByHandle 16754->16755 16758 7ff7e1054bf4 21 API calls 16754->16758 16759 7ff7e1054877 16755->16759 16760 7ff7e10548fa GetLastError 16755->16760 16756->16760 16761 7ff7e10548eb 16756->16761 16762 7ff7e105492c PeekNamedPipe 16757->16762 16769 7ff7e10548ca 16757->16769 16763 7ff7e105483c 16758->16763 16764 7ff7e1054ab8 51 API calls 16759->16764 16766 7ff7e10543b8 _fread_nolock 11 API calls 16760->16766 16765 7ff7e1054444 _set_fmode 11 API calls 16761->16765 16762->16769 16763->16755 16763->16769 16768 7ff7e1054882 16764->16768 16765->16769 16766->16769 16767 7ff7e104ad80 _wfindfirst32i64 8 API calls 16770 7ff7e105470c 16767->16770 16816 7ff7e105497c 16768->16816 16769->16767 16770->16711 16770->16712 16773 7ff7e105497c 10 API calls 16774 7ff7e10548a1 16773->16774 16775 7ff7e105497c 10 API calls 16774->16775 16779 7ff7e1054d2e 16778->16779 16780 7ff7e1054444 _set_fmode 11 API calls 16779->16780 16798 7ff7e1054dc6 __std_exception_copy 16779->16798 16782 7ff7e1054d40 16780->16782 16781 7ff7e104ad80 _wfindfirst32i64 8 API calls 16783 7ff7e1054739 16781->16783 16784 7ff7e1054444 _set_fmode 11 API calls 16782->16784 16783->16708 16783->16709 16785 7ff7e1054d48 16784->16785 16786 7ff7e1055348 45 API calls 16785->16786 16787 7ff7e1054d5d 16786->16787 16788 7ff7e1054d65 16787->16788 16789 7ff7e1054d6f 16787->16789 16790 7ff7e1054444 _set_fmode 11 API calls 16788->16790 16791 7ff7e1054444 _set_fmode 11 API calls 16789->16791 16795 7ff7e1054d6a 16790->16795 16792 7ff7e1054d74 16791->16792 16793 7ff7e1054444 _set_fmode 11 API calls 16792->16793 16792->16798 16794 7ff7e1054d7e 16793->16794 16796 7ff7e1055348 45 API calls 16794->16796 16797 7ff7e1054db8 GetDriveTypeW 16795->16797 16795->16798 16796->16795 16797->16798 16798->16781 16801 7ff7e1054ae0 16799->16801 16800 7ff7e1054775 16809 7ff7e1054bf4 16800->16809 16801->16800 16823 7ff7e105e674 16801->16823 16810 7ff7e1054c0e 16809->16810 16811 7ff7e1054c45 16810->16811 16812 7ff7e1054c1e 16810->16812 16813 7ff7e105e508 21 API calls 16811->16813 16814 7ff7e10543b8 _fread_nolock 11 API calls 16812->16814 16815 7ff7e1054c2e 16812->16815 16813->16815 16814->16815 16815->16718 16817 7ff7e1054998 16816->16817 16818 7ff7e10549a5 FileTimeToSystemTime 16816->16818 16817->16818 16820 7ff7e10549a0 16817->16820 16819 7ff7e10549b9 SystemTimeToTzSpecificLocalTime 16818->16819 16818->16820 16819->16820 16821 7ff7e104ad80 _wfindfirst32i64 8 API calls 16820->16821 16822 7ff7e1054891 16821->16822 16822->16773 16824 7ff7e105e6a5 16823->16824 16825 7ff7e105e681 16823->16825 16827 7ff7e105e6df 16824->16827 16830 7ff7e105e6fe 16824->16830 16825->16824 16826 7ff7e105e686 16825->16826 16828 7ff7e1054444 _set_fmode 11 API calls 16826->16828 16829 7ff7e1054444 _set_fmode 11 API calls 16827->16829 16831 7ff7e105e68b 16828->16831 16832 7ff7e105e6e4 16829->16832 16833 7ff7e1054a1c 45 API calls 16830->16833 16835 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16832->16835 16838 7ff7e105e70b 16833->16838 16837 7ff7e105e6ef 16835->16837 16838->16837 16839 7ff7e1064640 51 API calls 16838->16839 16839->16838 16841 7ff7e1054a7e 16840->16841 16842 7ff7e105cb41 16840->16842 16844 7ff7e105cb98 16841->16844 16842->16841 16843 7ff7e1062424 45 API calls 16842->16843 16843->16841 16845 7ff7e105cbad 16844->16845 16846 7ff7e105cbc0 16844->16846 16845->16846 16847 7ff7e1061790 45 API calls 16845->16847 16846->16726 16847->16846 16849 7ff7e105de15 16848->16849 16854 7ff7e105de10 __vcrt_FlsAlloc 16848->16854 16849->16688 16850 7ff7e105de45 LoadLibraryExW 16852 7ff7e105df1a 16850->16852 16853 7ff7e105de6a GetLastError 16850->16853 16851 7ff7e105df3a GetProcAddress 16851->16849 16852->16851 16855 7ff7e105df31 FreeLibrary 16852->16855 16853->16854 16854->16849 16854->16850 16854->16851 16856 7ff7e105dea4 LoadLibraryExW 16854->16856 16855->16851 16856->16852 16856->16854 16859 7ff7e105e7f9 MultiByteToWideChar 16857->16859 16861 7ff7e104f34d 16860->16861 16862 7ff7e104f35d 16860->16862 16863 7ff7e1054444 _set_fmode 11 API calls 16861->16863 16862->16676 16864 7ff7e104f352 16863->16864 16865 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16864->16865 16865->16862 16867 7ff7e1057390 16866->16867 16868 7ff7e10573ac 16867->16868 16869 7ff7e10573cd 16867->16869 16887 7ff7e105918d 16886->16887 16891 7ff7e104707a 16886->16891 16888 7ff7e1054444 _set_fmode 11 API calls 16887->16888 16889 7ff7e1059192 16888->16889 16890 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16889->16890 16890->16891 16892 7ff7e1056ef8 16891->16892 16893 7ff7e1056f16 16892->16893 16894 7ff7e1056f01 16892->16894 16897 7ff7e1054424 _fread_nolock 11 API calls 16893->16897 16900 7ff7e1056f0e 16893->16900 16895 7ff7e1054424 _fread_nolock 11 API calls 16894->16895 16896 7ff7e1056f06 16895->16896 16898 7ff7e1054444 _set_fmode 11 API calls 16896->16898 16899 7ff7e1056f51 16897->16899 16898->16900 16901 7ff7e1054444 _set_fmode 11 API calls 16899->16901 16900->15138 16902 7ff7e1056f59 16901->16902 16903 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16902->16903 16903->16900 16905 7ff7e10553fc 16904->16905 16906 7ff7e1055422 16905->16906 16908 7ff7e1055455 16905->16908 16907 7ff7e1054444 _set_fmode 11 API calls 16906->16907 16909 7ff7e1055427 16907->16909 16910 7ff7e105545b 16908->16910 16911 7ff7e1055468 16908->16911 16912 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 16909->16912 16913 7ff7e1054444 _set_fmode 11 API calls 16910->16913 16923 7ff7e105a0f8 16911->16923 16915 7ff7e1043d09 16912->16915 16913->16915 16915->15174 16936 7ff7e105f788 EnterCriticalSection 16923->16936 17284 7ff7e1057968 17283->17284 17287 7ff7e1057444 17284->17287 17286 7ff7e1057981 17286->15182 17288 7ff7e105748e 17287->17288 17289 7ff7e105745f 17287->17289 17297 7ff7e10542ec EnterCriticalSection 17288->17297 17291 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 17289->17291 17292 7ff7e105747f 17291->17292 17292->17286 17299 7ff7e104f0a3 17298->17299 17300 7ff7e104f0d1 17298->17300 17301 7ff7e1059ce4 _invalid_parameter_noinfo 37 API calls 17299->17301 17302 7ff7e104f0c3 17300->17302 17308 7ff7e10542ec EnterCriticalSection 17300->17308 17301->17302 17302->15188 17310 7ff7e10412f8 17309->17310 17311 7ff7e10412c6 17309->17311 17312 7ff7e104f934 73 API calls 17310->17312 17313 7ff7e1043cb0 116 API calls 17311->17313 17314 7ff7e104130a 17312->17314 17315 7ff7e10412d6 17313->17315 17317 7ff7e104130e 17314->17317 17318 7ff7e104132f 17314->17318 17315->17310 17316 7ff7e10412de 17315->17316 17319 7ff7e1042770 59 API calls 17316->17319 17320 7ff7e10424d0 59 API calls 17317->17320 17323 7ff7e1041364 17318->17323 17324 7ff7e1041344 17318->17324 17321 7ff7e10412ee 17319->17321 17322 7ff7e1041325 17320->17322 17321->15213 17322->15213 17325 7ff7e104137e 17323->17325 17332 7ff7e1041395 17323->17332 17326 7ff7e10424d0 59 API calls 17324->17326 17327 7ff7e1041050 98 API calls 17325->17327 17331 7ff7e104135f __std_exception_copy 17326->17331 17327->17331 17328 7ff7e1041421 17328->15213 17329 7ff7e104f5fc _fread_nolock 53 API calls 17329->17332 17330 7ff7e104f2ac 74 API calls 17330->17328 17331->17328 17331->17330 17332->17329 17332->17331 17333 7ff7e10413de 17332->17333 17334 7ff7e10424d0 59 API calls 17333->17334 17334->17331 17336 7ff7e1041b30 49 API calls 17335->17336 17337 7ff7e1043d60 17336->17337 17337->15215 17339 7ff7e10416aa 17338->17339 17340 7ff7e1041666 17338->17340 17339->15231 17340->17339 17341 7ff7e1042770 59 API calls 17340->17341 17342 7ff7e10416be 17341->17342 17342->15231 17344 7ff7e1047a30 57 API calls 17343->17344 17345 7ff7e10471c7 LoadLibraryExW 17344->17345 17346 7ff7e10471e4 __std_exception_copy 17345->17346 17346->15239 17347->15315 17348->15312 17350 7ff7e1044970 17349->17350 17351 7ff7e1041b30 49 API calls 17350->17351 17352 7ff7e10449a2 17351->17352 17353 7ff7e10449cb 17352->17353 17354 7ff7e10449ab 17352->17354 17355 7ff7e1044a22 17353->17355 17357 7ff7e1043d30 49 API calls 17353->17357 17356 7ff7e1042770 59 API calls 17354->17356 17358 7ff7e1043d30 49 API calls 17355->17358 17359 7ff7e10449c1 17356->17359 17361 7ff7e10449ec 17357->17361 17364 7ff7e1044a3b 17358->17364 17362 7ff7e104ad80 _wfindfirst32i64 8 API calls 17359->17362 17360 7ff7e1044a0a 17434 7ff7e1043c40 17360->17434 17361->17360 17366 7ff7e1042770 59 API calls 17361->17366 17368 7ff7e10430be 17362->17368 17363 7ff7e1044a59 17365 7ff7e10471b0 58 API calls 17363->17365 17364->17363 17369 7ff7e1042770 59 API calls 17364->17369 17370 7ff7e1044a66 17365->17370 17366->17360 17368->15324 17377 7ff7e1044ce0 17368->17377 17369->17363 17372 7ff7e1044a8d 17370->17372 17373 7ff7e1044a6b 17370->17373 17440 7ff7e1043df0 GetProcAddress 17372->17440 17374 7ff7e1042620 57 API calls 17373->17374 17374->17359 17376 7ff7e10471b0 58 API calls 17376->17355 17378 7ff7e1046990 61 API calls 17377->17378 17381 7ff7e1044cf5 17378->17381 17379 7ff7e1044d10 17380 7ff7e1047a30 57 API calls 17379->17380 17383 7ff7e1044d54 17380->17383 17381->17379 17382 7ff7e1042880 59 API calls 17381->17382 17382->17379 17384 7ff7e1044d59 17383->17384 17385 7ff7e1044d70 17383->17385 17386 7ff7e1042770 59 API calls 17384->17386 17388 7ff7e1047a30 57 API calls 17385->17388 17387 7ff7e1044d65 17386->17387 17387->15326 17389 7ff7e1044da5 17388->17389 17391 7ff7e1041b30 49 API calls 17389->17391 17404 7ff7e1044daa __std_exception_copy 17389->17404 17390 7ff7e1042770 59 API calls 17392 7ff7e1044f51 17390->17392 17393 7ff7e1044e27 17391->17393 17392->15326 17394 7ff7e1044e2e 17393->17394 17395 7ff7e1044e53 17393->17395 17396 7ff7e1042770 59 API calls 17394->17396 17397 7ff7e1047a30 57 API calls 17395->17397 17398 7ff7e1044e43 17396->17398 17399 7ff7e1044e6c 17397->17399 17398->15326 17399->17404 17547 7ff7e1044ac0 17399->17547 17403 7ff7e1044f3a 17403->15326 17404->17390 17404->17403 17406 7ff7e10446f7 17405->17406 17406->17406 17407 7ff7e1044720 17406->17407 17414 7ff7e1044737 __std_exception_copy 17406->17414 17408 7ff7e1042770 59 API calls 17407->17408 17409 7ff7e104472c 17408->17409 17409->15328 17410 7ff7e104481b 17410->15328 17411 7ff7e10412b0 122 API calls 17411->17414 17412 7ff7e1041780 59 API calls 17412->17414 17413 7ff7e1042770 59 API calls 17413->17414 17414->17410 17414->17411 17414->17412 17414->17413 17416 7ff7e1044947 17415->17416 17418 7ff7e104485b 17415->17418 17416->15330 17417 7ff7e1041780 59 API calls 17417->17418 17418->17416 17418->17417 17419 7ff7e1042770 59 API calls 17418->17419 17419->17418 17435 7ff7e1043c4a 17434->17435 17436 7ff7e1047a30 57 API calls 17435->17436 17437 7ff7e1043c72 17436->17437 17438 7ff7e104ad80 _wfindfirst32i64 8 API calls 17437->17438 17439 7ff7e1043c9a 17438->17439 17439->17355 17439->17376 17441 7ff7e1043e18 17440->17441 17442 7ff7e1043e3b GetProcAddress 17440->17442 17444 7ff7e1042620 57 API calls 17441->17444 17442->17441 17443 7ff7e1043e60 GetProcAddress 17442->17443 17443->17441 17445 7ff7e1043e85 GetProcAddress 17443->17445 17446 7ff7e1043e2b 17444->17446 17445->17441 17447 7ff7e1043ead GetProcAddress 17445->17447 17446->17359 17447->17441 17448 7ff7e1043ed5 GetProcAddress 17447->17448 17448->17441 17449 7ff7e1043efd GetProcAddress 17448->17449 17450 7ff7e1043f19 17449->17450 17451 7ff7e1043f25 GetProcAddress 17449->17451 17450->17451 17452 7ff7e1043f4d GetProcAddress 17451->17452 17453 7ff7e1043f41 17451->17453 17454 7ff7e1043f69 17452->17454 17453->17452 17455 7ff7e1043f7d GetProcAddress 17454->17455 17456 7ff7e1043fa5 GetProcAddress 17454->17456 17455->17456 17457 7ff7e1043f99 17455->17457 17458 7ff7e1043fcd GetProcAddress 17456->17458 17459 7ff7e1043fc1 17456->17459 17457->17456 17460 7ff7e1043fe9 17458->17460 17461 7ff7e1043ff5 GetProcAddress 17458->17461 17459->17458 17460->17461 17462 7ff7e104401d GetProcAddress 17461->17462 17463 7ff7e1044011 17461->17463 17464 7ff7e1044039 17462->17464 17465 7ff7e1044045 GetProcAddress 17462->17465 17463->17462 17464->17465 17466 7ff7e104406d GetProcAddress 17465->17466 17467 7ff7e1044061 17465->17467 17468 7ff7e1044089 17466->17468 17469 7ff7e1044095 GetProcAddress 17466->17469 17467->17466 17468->17469 17554 7ff7e1044ada 17547->17554 17548 7ff7e104ad80 _wfindfirst32i64 8 API calls 17550 7ff7e1044cb0 17548->17550 17549 7ff7e1041780 59 API calls 17549->17554 17574 7ff7e1047c30 17550->17574 17551 7ff7e1044bf3 17553 7ff7e1059184 _fread_nolock 37 API calls 17551->17553 17560 7ff7e1044c91 17551->17560 17555 7ff7e1044c0a 17553->17555 17554->17549 17554->17551 17556 7ff7e1044cc9 17554->17556 17554->17560 17581 7ff7e10556d0 17554->17581 17585 7ff7e10557dc 17555->17585 17558 7ff7e1042770 59 API calls 17556->17558 17558->17560 17560->17548 17577 7ff7e1047c4f 17574->17577 17582 7ff7e1055700 17581->17582 17610 7ff7e10554d4 17582->17610 17611 7ff7e1055507 17610->17611 17612 7ff7e105550c 17611->17612 17613 7ff7e105551c 17611->17613 17614 7ff7e1055549 17611->17614 17715 7ff7e105a620 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17714->17715 17716 7ff7e10590e1 17715->17716 17717 7ff7e105920c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17716->17717 17718 7ff7e1059101 17717->17718 18432 7ff7e105a4a0 18433 7ff7e105a4a5 18432->18433 18434 7ff7e105a4ba 18432->18434 18438 7ff7e105a4c0 18433->18438 18439 7ff7e105a50a 18438->18439 18440 7ff7e105a502 18438->18440 18442 7ff7e1059e18 __free_lconv_mon 11 API calls 18439->18442 18441 7ff7e1059e18 __free_lconv_mon 11 API calls 18440->18441 18441->18439 18443 7ff7e105a517 18442->18443 18444 7ff7e1059e18 __free_lconv_mon 11 API calls 18443->18444 18445 7ff7e105a524 18444->18445 18446 7ff7e1059e18 __free_lconv_mon 11 API calls 18445->18446 18447 7ff7e105a531 18446->18447 18448 7ff7e1059e18 __free_lconv_mon 11 API calls 18447->18448 18449 7ff7e105a53e 18448->18449 18450 7ff7e1059e18 __free_lconv_mon 11 API calls 18449->18450 18451 7ff7e105a54b 18450->18451 18452 7ff7e1059e18 __free_lconv_mon 11 API calls 18451->18452 18453 7ff7e105a558 18452->18453 18454 7ff7e1059e18 __free_lconv_mon 11 API calls 18453->18454 18455 7ff7e105a565 18454->18455 18456 7ff7e1059e18 __free_lconv_mon 11 API calls 18455->18456 18457 7ff7e105a575 18456->18457 18458 7ff7e1059e18 __free_lconv_mon 11 API calls 18457->18458 18459 7ff7e105a585 18458->18459 18464 7ff7e105a364 18459->18464 18478 7ff7e105f788 EnterCriticalSection 18464->18478 18500 7ff7e1066fa0 18503 7ff7e1061730 18500->18503 18504 7ff7e106173d 18503->18504 18505 7ff7e1061782 18503->18505 18509 7ff7e105a6f4 18504->18509 18510 7ff7e105a705 FlsGetValue 18509->18510 18511 7ff7e105a720 FlsSetValue 18509->18511 18513 7ff7e105a71a 18510->18513 18514 7ff7e105a712 18510->18514 18512 7ff7e105a72d 18511->18512 18511->18514 18517 7ff7e105dd40 _set_fmode 11 API calls 18512->18517 18513->18511 18515 7ff7e105a718 18514->18515 18516 7ff7e105920c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18514->18516 18529 7ff7e1061404 18515->18529 18518 7ff7e105a795 18516->18518 18519 7ff7e105a73c 18517->18519 18520 7ff7e105a75a FlsSetValue 18519->18520 18521 7ff7e105a74a FlsSetValue 18519->18521 18523 7ff7e105a778 18520->18523 18524 7ff7e105a766 FlsSetValue 18520->18524 18522 7ff7e105a753 18521->18522 18525 7ff7e1059e18 __free_lconv_mon 11 API calls 18522->18525 18526 7ff7e105a3c4 _set_fmode 11 API calls 18523->18526 18524->18522 18525->18514 18527 7ff7e105a780 18526->18527 18528 7ff7e1059e18 __free_lconv_mon 11 API calls 18527->18528 18528->18515 18552 7ff7e1061674 18529->18552 18531 7ff7e1061439 18567 7ff7e1061104 18531->18567 18534 7ff7e105cacc _fread_nolock 12 API calls 18535 7ff7e1061467 18534->18535 18536 7ff7e106146f 18535->18536 18538 7ff7e106147e 18535->18538 18537 7ff7e1059e18 __free_lconv_mon 11 API calls 18536->18537 18549 7ff7e1061456 18537->18549 18538->18538 18574 7ff7e10617ac 18538->18574 18541 7ff7e106157a 18542 7ff7e1054444 _set_fmode 11 API calls 18541->18542 18543 7ff7e106157f 18542->18543 18545 7ff7e1059e18 __free_lconv_mon 11 API calls 18543->18545 18544 7ff7e10615d5 18547 7ff7e106163c 18544->18547 18585 7ff7e1060f34 18544->18585 18545->18549 18546 7ff7e1061594 18546->18544 18550 7ff7e1059e18 __free_lconv_mon 11 API calls 18546->18550 18548 7ff7e1059e18 __free_lconv_mon 11 API calls 18547->18548 18548->18549 18549->18505 18550->18544 18553 7ff7e1061697 18552->18553 18554 7ff7e10616a1 18553->18554 18600 7ff7e105f788 EnterCriticalSection 18553->18600 18557 7ff7e1061713 18554->18557 18559 7ff7e105920c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18554->18559 18557->18531 18561 7ff7e106172b 18559->18561 18563 7ff7e1061782 18561->18563 18564 7ff7e105a6f4 50 API calls 18561->18564 18563->18531 18565 7ff7e106176c 18564->18565 18566 7ff7e1061404 65 API calls 18565->18566 18566->18563 18568 7ff7e1054a1c 45 API calls 18567->18568 18569 7ff7e1061118 18568->18569 18570 7ff7e1061124 GetOEMCP 18569->18570 18571 7ff7e1061136 18569->18571 18572 7ff7e106114b 18570->18572 18571->18572 18573 7ff7e106113b GetACP 18571->18573 18572->18534 18572->18549 18573->18572 18575 7ff7e1061104 47 API calls 18574->18575 18576 7ff7e10617d9 18575->18576 18577 7ff7e106192f 18576->18577 18579 7ff7e1061816 IsValidCodePage 18576->18579 18584 7ff7e1061830 __scrt_get_show_window_mode 18576->18584 18578 7ff7e104ad80 _wfindfirst32i64 8 API calls 18577->18578 18580 7ff7e1061571 18578->18580 18579->18577 18581 7ff7e1061827 18579->18581 18580->18541 18580->18546 18582 7ff7e1061856 GetCPInfo 18581->18582 18581->18584 18582->18577 18582->18584 18601 7ff7e106121c 18584->18601 18672 7ff7e105f788 EnterCriticalSection 18585->18672 18602 7ff7e1061259 GetCPInfo 18601->18602 18603 7ff7e106134f 18601->18603 18602->18603 18608 7ff7e106126c 18602->18608 18604 7ff7e104ad80 _wfindfirst32i64 8 API calls 18603->18604 18605 7ff7e10613ee 18604->18605 18605->18577 18612 7ff7e1061f60 18608->18612 18611 7ff7e1066f04 54 API calls 18611->18603 18613 7ff7e1054a1c 45 API calls 18612->18613 18614 7ff7e1061fa2 18613->18614 18615 7ff7e105e7f0 _fread_nolock MultiByteToWideChar 18614->18615 18617 7ff7e1061fd8 18615->18617 18616 7ff7e1061fdf 18619 7ff7e104ad80 _wfindfirst32i64 8 API calls 18616->18619 18617->18616 18618 7ff7e105cacc _fread_nolock 12 API calls 18617->18618 18620 7ff7e106209c 18617->18620 18623 7ff7e1062008 __scrt_get_show_window_mode 18617->18623 18618->18623 18621 7ff7e10612e3 18619->18621 18620->18616 18622 7ff7e1059e18 __free_lconv_mon 11 API calls 18620->18622 18627 7ff7e1066f04 18621->18627 18622->18616 18623->18620 18624 7ff7e105e7f0 _fread_nolock MultiByteToWideChar 18623->18624 18625 7ff7e106207e 18624->18625 18625->18620 18626 7ff7e1062082 GetStringTypeW 18625->18626 18626->18620 18628 7ff7e1054a1c 45 API calls 18627->18628 18629 7ff7e1066f29 18628->18629 18632 7ff7e1066bd0 18629->18632 18633 7ff7e1066c11 18632->18633 18634 7ff7e105e7f0 _fread_nolock MultiByteToWideChar 18633->18634 18637 7ff7e1066c5b 18634->18637 18635 7ff7e1066ed9 18636 7ff7e104ad80 _wfindfirst32i64 8 API calls 18635->18636 18638 7ff7e1061316 18636->18638 18637->18635 18639 7ff7e105cacc _fread_nolock 12 API calls 18637->18639 18640 7ff7e1066d91 18637->18640 18642 7ff7e1066c93 18637->18642 18638->18611 18639->18642 18640->18635 18641 7ff7e1059e18 __free_lconv_mon 11 API calls 18640->18641 18641->18635 18642->18640 18643 7ff7e105e7f0 _fread_nolock MultiByteToWideChar 18642->18643 18644 7ff7e1066d06 18643->18644 18644->18640 18663 7ff7e105e18c 18644->18663 18647 7ff7e1066da2 18649 7ff7e105cacc _fread_nolock 12 API calls 18647->18649 18651 7ff7e1066e74 18647->18651 18653 7ff7e1066dc0 18647->18653 18648 7ff7e1066d51 18648->18640 18650 7ff7e105e18c __crtLCMapStringW 6 API calls 18648->18650 18649->18653 18650->18640 18651->18640 18652 7ff7e1059e18 __free_lconv_mon 11 API calls 18651->18652 18652->18640 18653->18640 18654 7ff7e105e18c __crtLCMapStringW 6 API calls 18653->18654 18655 7ff7e1066e40 18654->18655 18655->18651 18656 7ff7e1066e76 18655->18656 18657 7ff7e1066e60 18655->18657 18659 7ff7e105f0b8 WideCharToMultiByte 18656->18659 18658 7ff7e105f0b8 WideCharToMultiByte 18657->18658 18660 7ff7e1066e6e 18658->18660 18659->18660 18660->18651 18661 7ff7e1066e8e 18660->18661 18661->18640 18662 7ff7e1059e18 __free_lconv_mon 11 API calls 18661->18662 18662->18640 18664 7ff7e105ddb8 __crtLCMapStringW 5 API calls 18663->18664 18665 7ff7e105e1ca 18664->18665 18666 7ff7e105e1d2 18665->18666 18669 7ff7e105e278 18665->18669 18666->18640 18666->18647 18666->18648 18668 7ff7e105e23b LCMapStringW 18668->18666 18670 7ff7e105ddb8 __crtLCMapStringW 5 API calls 18669->18670 18671 7ff7e105e2a6 __crtLCMapStringW 18670->18671 18671->18668 17719 7ff7e104a620 17720 7ff7e104a643 17719->17720 17721 7ff7e104a65f memcpy_s 17719->17721 17722 7ff7e105cacc 12 API calls 17720->17722 17722->17721 18732 7ff7e104a2cb 18733 7ff7e104a364 18732->18733 18734 7ff7e104a2fe 18732->18734 18734->18733 18735 7ff7e104a342 18734->18735 18737 7ff7e1059e18 11 API calls 18734->18737 18738 7ff7e1059e18 11 API calls 18735->18738 18736 7ff7e104a354 18737->18735 18738->18736 17810 7ff7e1058a50 17813 7ff7e10589d0 17810->17813 17820 7ff7e105f788 EnterCriticalSection 17813->17820 18793 7ff7e105b9f0 18804 7ff7e105f788 EnterCriticalSection 18793->18804 18809 7ff7e10607f0 18820 7ff7e1066764 18809->18820 18821 7ff7e1066771 18820->18821 18822 7ff7e1059e18 __free_lconv_mon 11 API calls 18821->18822 18823 7ff7e106678d 18821->18823 18822->18821 18824 7ff7e1059e18 __free_lconv_mon 11 API calls 18823->18824 18825 7ff7e10607f9 18823->18825 18824->18823 18826 7ff7e105f788 EnterCriticalSection 18825->18826 17723 7ff7e104a370 17724 7ff7e104a39e 17723->17724 17725 7ff7e104a385 17723->17725 17725->17724 17727 7ff7e105cacc 12 API calls 17725->17727 17726 7ff7e104a3fc 17727->17726 14703 7ff7e105e8dc 14704 7ff7e105eace 14703->14704 14708 7ff7e105e91e _isindst 14703->14708 14756 7ff7e1054444 14704->14756 14708->14704 14709 7ff7e105e99e _isindst 14708->14709 14724 7ff7e10653b4 14709->14724 14714 7ff7e105eafa 14768 7ff7e1059dd0 IsProcessorFeaturePresent 14714->14768 14721 7ff7e105e9fb 14723 7ff7e105eabe 14721->14723 14749 7ff7e10653f8 14721->14749 14759 7ff7e104ad80 14723->14759 14725 7ff7e10653c3 14724->14725 14726 7ff7e105e9bc 14724->14726 14772 7ff7e105f788 EnterCriticalSection 14725->14772 14731 7ff7e10647b8 14726->14731 14732 7ff7e105e9d1 14731->14732 14733 7ff7e10647c1 14731->14733 14732->14714 14737 7ff7e10647e8 14732->14737 14734 7ff7e1054444 _set_fmode 11 API calls 14733->14734 14735 7ff7e10647c6 14734->14735 14773 7ff7e1059db0 14735->14773 14738 7ff7e10647f1 14737->14738 14740 7ff7e105e9e2 14737->14740 14739 7ff7e1054444 _set_fmode 11 API calls 14738->14739 14741 7ff7e10647f6 14739->14741 14740->14714 14743 7ff7e1064818 14740->14743 14742 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 14741->14742 14742->14740 14744 7ff7e105e9f3 14743->14744 14745 7ff7e1064821 14743->14745 14744->14714 14744->14721 14746 7ff7e1054444 _set_fmode 11 API calls 14745->14746 14747 7ff7e1064826 14746->14747 14748 7ff7e1059db0 _invalid_parameter_noinfo 37 API calls 14747->14748 14748->14744 14854 7ff7e105f788 EnterCriticalSection 14749->14854 14855 7ff7e105a798 GetLastError 14756->14855 14758 7ff7e105444d 14758->14723 14760 7ff7e104ad89 14759->14760 14761 7ff7e104ad94 14760->14761 14762 7ff7e104ae40 IsProcessorFeaturePresent 14760->14762 14763 7ff7e104ae58 14762->14763 14872 7ff7e104b034 RtlCaptureContext 14763->14872 14769 7ff7e1059de3 14768->14769 14877 7ff7e1059ae4 14769->14877 14775 7ff7e1059c48 14773->14775 14776 7ff7e1059c73 14775->14776 14779 7ff7e1059ce4 14776->14779 14778 7ff7e1059c9a 14787 7ff7e1059a2c 14779->14787 14783 7ff7e1059d1f 14783->14778 14785 7ff7e1059dd0 _wfindfirst32i64 17 API calls 14786 7ff7e1059daf 14785->14786 14788 7ff7e1059a48 GetLastError 14787->14788 14789 7ff7e1059a83 14787->14789 14790 7ff7e1059a58 14788->14790 14789->14783 14793 7ff7e1059a98 14789->14793 14796 7ff7e105a860 14790->14796 14794 7ff7e1059acc 14793->14794 14795 7ff7e1059ab4 GetLastError SetLastError 14793->14795 14794->14783 14794->14785 14795->14794 14797 7ff7e105a89a FlsSetValue 14796->14797 14798 7ff7e105a87f FlsGetValue 14796->14798 14799 7ff7e105a8a7 14797->14799 14810 7ff7e1059a73 SetLastError 14797->14810 14800 7ff7e105a894 14798->14800 14798->14810 14813 7ff7e105dd40 14799->14813 14800->14797 14803 7ff7e105a8d4 FlsSetValue 14806 7ff7e105a8e0 FlsSetValue 14803->14806 14807 7ff7e105a8f2 14803->14807 14804 7ff7e105a8c4 FlsSetValue 14805 7ff7e105a8cd 14804->14805 14820 7ff7e1059e18 14805->14820 14806->14805 14826 7ff7e105a3c4 14807->14826 14810->14789 14818 7ff7e105dd51 _set_fmode 14813->14818 14814 7ff7e105dda2 14816 7ff7e1054444 _set_fmode 10 API calls 14814->14816 14815 7ff7e105dd86 RtlAllocateHeap 14817 7ff7e105a8b6 14815->14817 14815->14818 14816->14817 14817->14803 14817->14804 14818->14814 14818->14815 14831 7ff7e10626b0 14818->14831 14821 7ff7e1059e1d RtlRestoreThreadPreferredUILanguages 14820->14821 14825 7ff7e1059e4c 14820->14825 14822 7ff7e1059e38 GetLastError 14821->14822 14821->14825 14823 7ff7e1059e45 __free_lconv_mon 14822->14823 14824 7ff7e1054444 _set_fmode 9 API calls 14823->14824 14824->14825 14825->14810 14840 7ff7e105a29c 14826->14840 14834 7ff7e10626f0 14831->14834 14839 7ff7e105f788 EnterCriticalSection 14834->14839 14852 7ff7e105f788 EnterCriticalSection 14840->14852 14856 7ff7e105a7d9 FlsSetValue 14855->14856 14861 7ff7e105a7bc 14855->14861 14857 7ff7e105a7eb 14856->14857 14860 7ff7e105a7c9 14856->14860 14859 7ff7e105dd40 _set_fmode 5 API calls 14857->14859 14858 7ff7e105a845 SetLastError 14858->14758 14862 7ff7e105a7fa 14859->14862 14860->14858 14861->14856 14861->14860 14863 7ff7e105a818 FlsSetValue 14862->14863 14864 7ff7e105a808 FlsSetValue 14862->14864 14866 7ff7e105a824 FlsSetValue 14863->14866 14867 7ff7e105a836 14863->14867 14865 7ff7e105a811 14864->14865 14868 7ff7e1059e18 __free_lconv_mon 5 API calls 14865->14868 14866->14865 14869 7ff7e105a3c4 _set_fmode 5 API calls 14867->14869 14868->14860 14870 7ff7e105a83e 14869->14870 14871 7ff7e1059e18 __free_lconv_mon 5 API calls 14870->14871 14871->14858 14873 7ff7e104b04e RtlLookupFunctionEntry 14872->14873 14874 7ff7e104ae6b 14873->14874 14875 7ff7e104b064 RtlVirtualUnwind 14873->14875 14876 7ff7e104ae00 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 14874->14876 14875->14873 14875->14874 14878 7ff7e1059b1e _wfindfirst32i64 __scrt_get_show_window_mode 14877->14878 14879 7ff7e1059b46 RtlCaptureContext RtlLookupFunctionEntry 14878->14879 14880 7ff7e1059bb6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 14879->14880 14881 7ff7e1059b80 RtlVirtualUnwind 14879->14881 14883 7ff7e1059c08 _wfindfirst32i64 14880->14883 14881->14880 14882 7ff7e104ad80 _wfindfirst32i64 8 API calls 14884 7ff7e1059c27 GetCurrentProcess TerminateProcess 14882->14884 14883->14882 18827 7ff7e10694de 18828 7ff7e10694ee 18827->18828 18831 7ff7e10542f8 LeaveCriticalSection 18828->18831 18178 7ff7e1069664 18181 7ff7e10542f8 LeaveCriticalSection 18178->18181 18206 7ff7e1054290 18207 7ff7e105429b 18206->18207 18215 7ff7e105e354 18207->18215 18228 7ff7e105f788 EnterCriticalSection 18215->18228 19378 7ff7e10696f9 19379 7ff7e1069708 19378->19379 19380 7ff7e1069712 19378->19380 19382 7ff7e105f7e8 LeaveCriticalSection 19379->19382

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 135 7ff7e1064e20-7ff7e1064e5b call 7ff7e10647a8 call 7ff7e10647b0 call 7ff7e1064818 142 7ff7e1065085-7ff7e10650d1 call 7ff7e1059dd0 call 7ff7e10647a8 call 7ff7e10647b0 call 7ff7e1064818 135->142 143 7ff7e1064e61-7ff7e1064e6c call 7ff7e10647b8 135->143 169 7ff7e10650d7-7ff7e10650e2 call 7ff7e10647b8 142->169 170 7ff7e106520f-7ff7e106527d call 7ff7e1059dd0 call 7ff7e10606b8 142->170 143->142 148 7ff7e1064e72-7ff7e1064e7c 143->148 150 7ff7e1064e9e-7ff7e1064ea2 148->150 151 7ff7e1064e7e-7ff7e1064e81 148->151 154 7ff7e1064ea5-7ff7e1064ead 150->154 153 7ff7e1064e84-7ff7e1064e8f 151->153 156 7ff7e1064e9a-7ff7e1064e9c 153->156 157 7ff7e1064e91-7ff7e1064e98 153->157 154->154 158 7ff7e1064eaf-7ff7e1064ec2 call 7ff7e105cacc 154->158 156->150 160 7ff7e1064ecb-7ff7e1064ed9 156->160 157->153 157->156 166 7ff7e1064eda-7ff7e1064ee6 call 7ff7e1059e18 158->166 167 7ff7e1064ec4-7ff7e1064ec6 call 7ff7e1059e18 158->167 176 7ff7e1064eed-7ff7e1064ef5 166->176 167->160 169->170 178 7ff7e10650e8-7ff7e10650f3 call 7ff7e10647e8 169->178 189 7ff7e106528b-7ff7e106528e 170->189 190 7ff7e106527f-7ff7e1065286 170->190 176->176 179 7ff7e1064ef7-7ff7e1064f08 call 7ff7e105f924 176->179 178->170 187 7ff7e10650f9-7ff7e106511c call 7ff7e1059e18 GetTimeZoneInformation 178->187 179->142 188 7ff7e1064f0e-7ff7e1064f64 call 7ff7e104c210 * 4 call 7ff7e1064d3c 179->188 203 7ff7e10651e4-7ff7e106520e call 7ff7e10647a0 call 7ff7e1064790 call 7ff7e1064798 187->203 204 7ff7e1065122-7ff7e1065143 187->204 247 7ff7e1064f66-7ff7e1064f6a 188->247 194 7ff7e10652c5-7ff7e10652d8 call 7ff7e105cacc 189->194 195 7ff7e1065290 189->195 193 7ff7e106531b-7ff7e106531e 190->193 196 7ff7e1065324-7ff7e106532c call 7ff7e1064e20 193->196 197 7ff7e1065293 call 7ff7e106509c 193->197 209 7ff7e10652da 194->209 210 7ff7e10652e3-7ff7e10652fe call 7ff7e10606b8 194->210 195->197 207 7ff7e1065298-7ff7e10652c4 call 7ff7e1059e18 call 7ff7e104ad80 196->207 197->207 211 7ff7e106514e-7ff7e1065155 204->211 212 7ff7e1065145-7ff7e106514b 204->212 217 7ff7e10652dc-7ff7e10652e1 call 7ff7e1059e18 209->217 234 7ff7e1065305-7ff7e1065317 call 7ff7e1059e18 210->234 235 7ff7e1065300-7ff7e1065303 210->235 219 7ff7e1065157-7ff7e106515f 211->219 220 7ff7e1065169 211->220 212->211 217->195 219->220 227 7ff7e1065161-7ff7e1065167 219->227 222 7ff7e106516b-7ff7e10651df call 7ff7e104c210 * 4 call 7ff7e1061c7c call 7ff7e1065334 * 2 220->222 222->203 227->222 234->193 235->217 249 7ff7e1064f6c 247->249 250 7ff7e1064f70-7ff7e1064f74 247->250 249->250 250->247 252 7ff7e1064f76-7ff7e1064f9b call 7ff7e1067c64 250->252 258 7ff7e1064f9e-7ff7e1064fa2 252->258 260 7ff7e1064fa4-7ff7e1064faf 258->260 261 7ff7e1064fb1-7ff7e1064fb5 258->261 260->261 263 7ff7e1064fb7-7ff7e1064fbb 260->263 261->258 266 7ff7e106503c-7ff7e1065040 263->266 267 7ff7e1064fbd-7ff7e1064fe5 call 7ff7e1067c64 263->267 268 7ff7e1065047-7ff7e1065054 266->268 269 7ff7e1065042-7ff7e1065044 266->269 274 7ff7e1064fe7 267->274 275 7ff7e1065003-7ff7e1065007 267->275 272 7ff7e1065056-7ff7e106506c call 7ff7e1064d3c 268->272 273 7ff7e106506f-7ff7e106507e call 7ff7e10647a0 call 7ff7e1064790 268->273 269->268 272->273 273->142 279 7ff7e1064fea-7ff7e1064ff1 274->279 275->266 281 7ff7e1065009-7ff7e1065027 call 7ff7e1067c64 275->281 279->275 282 7ff7e1064ff3-7ff7e1065001 279->282 287 7ff7e1065033-7ff7e106503a 281->287 282->275 282->279 287->266 288 7ff7e1065029-7ff7e106502d 287->288 288->266 289 7ff7e106502f 288->289 289->287
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E1064E65
                                                                                                                                                                                        • Part of subcall function 00007FF7E10647B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E10647CC
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E2E
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: GetLastError.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E38
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E1059DAF,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E1059DD9
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E1059DAF,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E1059DFE
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E1064E54
                                                                                                                                                                                        • Part of subcall function 00007FF7E1064818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E106482C
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650CA
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650DB
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650EC
                                                                                                                                                                                      • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E106532C), ref: 00007FF7E1065113
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
                                                                                                                                                                                      • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                                                      • API String ID: 1458651798-690618308
                                                                                                                                                                                      • Opcode ID: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
                                                                                                                                                                                      • Instruction ID: a00442f71666b9808c62b0ed5741b5a187ff532359de14e5efa8142ff2930e2e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6BD1C266B0825286E720BF21D9527B9A391FF447E4FC44137EA0D87A85DFBCE441C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 320 7ff7e1065d6c-7ff7e1065ddf call 7ff7e1065aa0 323 7ff7e1065df9-7ff7e1065e03 call 7ff7e1056cfc 320->323 324 7ff7e1065de1-7ff7e1065dea call 7ff7e1054424 320->324 329 7ff7e1065e1e-7ff7e1065e87 CreateFileW 323->329 330 7ff7e1065e05-7ff7e1065e1c call 7ff7e1054424 call 7ff7e1054444 323->330 331 7ff7e1065ded-7ff7e1065df4 call 7ff7e1054444 324->331 333 7ff7e1065e89-7ff7e1065e8f 329->333 334 7ff7e1065f04-7ff7e1065f0f GetFileType 329->334 330->331 347 7ff7e106613a-7ff7e106615a 331->347 337 7ff7e1065ed1-7ff7e1065eff GetLastError call 7ff7e10543b8 333->337 338 7ff7e1065e91-7ff7e1065e95 333->338 340 7ff7e1065f62-7ff7e1065f69 334->340 341 7ff7e1065f11-7ff7e1065f4c GetLastError call 7ff7e10543b8 CloseHandle 334->341 337->331 338->337 345 7ff7e1065e97-7ff7e1065ecf CreateFileW 338->345 343 7ff7e1065f6b-7ff7e1065f6f 340->343 344 7ff7e1065f71-7ff7e1065f74 340->344 341->331 354 7ff7e1065f52-7ff7e1065f5d call 7ff7e1054444 341->354 350 7ff7e1065f7a-7ff7e1065fcf call 7ff7e1056c14 343->350 344->350 351 7ff7e1065f76 344->351 345->334 345->337 359 7ff7e1065fee-7ff7e106601f call 7ff7e1065820 350->359 360 7ff7e1065fd1-7ff7e1065fdd call 7ff7e1065ca8 350->360 351->350 354->331 365 7ff7e1066025-7ff7e1066067 359->365 366 7ff7e1066021-7ff7e1066023 359->366 360->359 367 7ff7e1065fdf 360->367 369 7ff7e1066089-7ff7e1066094 365->369 370 7ff7e1066069-7ff7e106606d 365->370 368 7ff7e1065fe1-7ff7e1065fe9 call 7ff7e1059f90 366->368 367->368 368->347 372 7ff7e1066138 369->372 373 7ff7e106609a-7ff7e106609e 369->373 370->369 371 7ff7e106606f-7ff7e1066084 370->371 371->369 372->347 373->372 376 7ff7e10660a4-7ff7e10660e9 CloseHandle CreateFileW 373->376 377 7ff7e10660eb-7ff7e1066119 GetLastError call 7ff7e10543b8 call 7ff7e1056e3c 376->377 378 7ff7e106611e-7ff7e1066133 376->378 377->378 378->372
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1617910340-0
                                                                                                                                                                                      • Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
                                                                                                                                                                                      • Instruction ID: 6f04ec5f2802caac0a5287471991ba07b9a2719eb9f055022da73d4c7e3117b0
                                                                                                                                                                                      • Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 85C1D472B28A4285EB10EF64C4927AC7761FB48B98B814236DE2E9BBD5DF78D051C311
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTempPathW.KERNEL32(?,00000000,?,00007FF7E104674D), ref: 00007FF7E104681A
                                                                                                                                                                                        • Part of subcall function 00007FF7E1046990: GetEnvironmentVariableW.KERNEL32(00007FF7E10436E7), ref: 00007FF7E10469CA
                                                                                                                                                                                        • Part of subcall function 00007FF7E1046990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E10469E7
                                                                                                                                                                                        • Part of subcall function 00007FF7E10566B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E10566CD
                                                                                                                                                                                      • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7E10468D1
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042770: MessageBoxW.USER32 ref: 00007FF7E1042841
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                      • API String ID: 3752271684-1116378104
                                                                                                                                                                                      • Opcode ID: 3863800b2665c7901903b481e41fcfda7d0e5020c540a2559d82cfcc8f27efd6
                                                                                                                                                                                      • Instruction ID: 04c5c7397e8fd5fb0995f40bb918583899d2084b31a3fd2114145c6b74d61802
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3863800b2665c7901903b481e41fcfda7d0e5020c540a2559d82cfcc8f27efd6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A519E11B1D64280FB64B76295A73FAD2615F89BE0FC41437ED0E87B97EDBCE4018222
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 773 7ff7e106509c-7ff7e10650d1 call 7ff7e10647a8 call 7ff7e10647b0 call 7ff7e1064818 780 7ff7e10650d7-7ff7e10650e2 call 7ff7e10647b8 773->780 781 7ff7e106520f-7ff7e106527d call 7ff7e1059dd0 call 7ff7e10606b8 773->781 780->781 786 7ff7e10650e8-7ff7e10650f3 call 7ff7e10647e8 780->786 793 7ff7e106528b-7ff7e106528e 781->793 794 7ff7e106527f-7ff7e1065286 781->794 786->781 792 7ff7e10650f9-7ff7e106511c call 7ff7e1059e18 GetTimeZoneInformation 786->792 805 7ff7e10651e4-7ff7e106520e call 7ff7e10647a0 call 7ff7e1064790 call 7ff7e1064798 792->805 806 7ff7e1065122-7ff7e1065143 792->806 797 7ff7e10652c5-7ff7e10652d8 call 7ff7e105cacc 793->797 798 7ff7e1065290 793->798 796 7ff7e106531b-7ff7e106531e 794->796 799 7ff7e1065324-7ff7e106532c call 7ff7e1064e20 796->799 800 7ff7e1065293 call 7ff7e106509c 796->800 810 7ff7e10652da 797->810 811 7ff7e10652e3-7ff7e10652fe call 7ff7e10606b8 797->811 798->800 808 7ff7e1065298-7ff7e10652c4 call 7ff7e1059e18 call 7ff7e104ad80 799->808 800->808 812 7ff7e106514e-7ff7e1065155 806->812 813 7ff7e1065145-7ff7e106514b 806->813 817 7ff7e10652dc-7ff7e10652e1 call 7ff7e1059e18 810->817 831 7ff7e1065305-7ff7e1065317 call 7ff7e1059e18 811->831 832 7ff7e1065300-7ff7e1065303 811->832 819 7ff7e1065157-7ff7e106515f 812->819 820 7ff7e1065169 812->820 813->812 817->798 819->820 826 7ff7e1065161-7ff7e1065167 819->826 821 7ff7e106516b-7ff7e10651df call 7ff7e104c210 * 4 call 7ff7e1061c7c call 7ff7e1065334 * 2 820->821 821->805 826->821 831->796 832->817
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650CA
                                                                                                                                                                                        • Part of subcall function 00007FF7E1064818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E106482C
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650DB
                                                                                                                                                                                        • Part of subcall function 00007FF7E10647B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E10647CC
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650EC
                                                                                                                                                                                        • Part of subcall function 00007FF7E10647E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E10647FC
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E2E
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: GetLastError.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E38
                                                                                                                                                                                      • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E106532C), ref: 00007FF7E1065113
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
                                                                                                                                                                                      • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                                                      • API String ID: 2248164782-690618308
                                                                                                                                                                                      • Opcode ID: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
                                                                                                                                                                                      • Instruction ID: 455dd86d165b7a9c4d7f528c6f387292a9727fa14431834dcc3f285330702228
                                                                                                                                                                                      • Opcode Fuzzy Hash: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
                                                                                                                                                                                      • Instruction Fuzzy Hash: A4519172B1864286E710FF21E9926B9E360FB48794FC44137EA4D87A95DFBCE4018761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _fread_nolock$Message_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                      • API String ID: 2153230061-4158440160
                                                                                                                                                                                      • Opcode ID: 112923ec32d6f186eac5f2ab0a77da39edfd2b220831cd908ecf82d0e10a0867
                                                                                                                                                                                      • Instruction ID: ed365d079f68785e9157c03fbba709a9125809c394d8adf7e5a5dbc66c30480c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 112923ec32d6f186eac5f2ab0a77da39edfd2b220831cd908ecf82d0e10a0867
                                                                                                                                                                                      • Instruction Fuzzy Hash: F2514171B1960686EB54EF28E492378B3A0FF48B44B918137DA0D87795DFBCE940C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 53 7ff7e1041440-7ff7e1041457 call 7ff7e1046720 56 7ff7e1041459-7ff7e1041461 53->56 57 7ff7e1041462-7ff7e1041485 call 7ff7e1046a40 53->57 60 7ff7e10414a7-7ff7e10414ad 57->60 61 7ff7e1041487-7ff7e10414a2 call 7ff7e10424d0 57->61 63 7ff7e10414e0-7ff7e10414f4 call 7ff7e104f934 60->63 64 7ff7e10414af-7ff7e10414ba call 7ff7e1043cb0 60->64 69 7ff7e1041635-7ff7e1041647 61->69 72 7ff7e1041516-7ff7e104151a 63->72 73 7ff7e10414f6-7ff7e1041511 call 7ff7e10424d0 63->73 70 7ff7e10414bf-7ff7e10414c5 64->70 70->63 71 7ff7e10414c7-7ff7e10414db call 7ff7e1042770 70->71 82 7ff7e1041617-7ff7e104161d 71->82 76 7ff7e104151c-7ff7e1041528 call 7ff7e1041050 72->76 77 7ff7e1041534-7ff7e1041554 call 7ff7e10540b0 72->77 73->82 83 7ff7e104152d-7ff7e104152f 76->83 85 7ff7e1041556-7ff7e1041570 call 7ff7e10424d0 77->85 86 7ff7e1041575-7ff7e104157b 77->86 87 7ff7e104162b-7ff7e104162e call 7ff7e104f2ac 82->87 88 7ff7e104161f call 7ff7e104f2ac 82->88 83->82 99 7ff7e104160d-7ff7e1041612 85->99 90 7ff7e1041581-7ff7e1041586 86->90 91 7ff7e1041605-7ff7e1041608 call 7ff7e105409c 86->91 98 7ff7e1041633 87->98 97 7ff7e1041624 88->97 96 7ff7e1041590-7ff7e10415b2 call 7ff7e104f5fc 90->96 91->99 102 7ff7e10415e5-7ff7e10415ec 96->102 103 7ff7e10415b4-7ff7e10415cc call 7ff7e104fd3c 96->103 97->87 98->69 99->82 105 7ff7e10415f3-7ff7e10415fb call 7ff7e10424d0 102->105 109 7ff7e10415ce-7ff7e10415d1 103->109 110 7ff7e10415d5-7ff7e10415e3 103->110 111 7ff7e1041600 105->111 109->96 112 7ff7e10415d3 109->112 110->105 111->91 112->111
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                      • API String ID: 0-666925554
                                                                                                                                                                                      • Opcode ID: 7d98bec7aa736b3e112fe31d03abe5caac626d57e9de28b2eb1f3448b9d5579f
                                                                                                                                                                                      • Instruction ID: fbe836bd1c251a61c87332898b6cd0d0f7707ea5b51441b343d144707e3315fd
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7d98bec7aa736b3e112fe31d03abe5caac626d57e9de28b2eb1f3448b9d5579f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 59518D61B0864285EB10FB11A4967B9E3A0BF89BD4FC44133DE1D47B96EEBCF5458322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                                                      • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                      • API String ID: 4998090-2855260032
                                                                                                                                                                                      • Opcode ID: a514ac21f5a9f1b0c29302b8773991edac034ab817825ff09080fe9ed33bccc0
                                                                                                                                                                                      • Instruction ID: 84abd6dbd312e7b3e39acff3583d9a61d08a735408b669ba151228a984e10289
                                                                                                                                                                                      • Opcode Fuzzy Hash: a514ac21f5a9f1b0c29302b8773991edac034ab817825ff09080fe9ed33bccc0
                                                                                                                                                                                      • Instruction Fuzzy Hash: C841633161C682C2EB50BF60E4857AAB361FB84794F841232FA9E47AD5DFBCD444C761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                      • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                      • API String ID: 2895956056-3524285272
                                                                                                                                                                                      • Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
                                                                                                                                                                                      • Instruction ID: c0779bcd39692deb3cd3dd7fe70fb270a02538bc22212b6946bba7ee1e08cf2c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9F411531A0878282DB20BB64E4563AAF364FB95364F900736E5AD47BD5DFBCD0448751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 383 7ff7e1041000-7ff7e1043686 call 7ff7e104f080 call 7ff7e104f078 call 7ff7e1047600 call 7ff7e104f078 call 7ff7e104adb0 call 7ff7e1054270 call 7ff7e1054f14 call 7ff7e1041af0 401 7ff7e104379a 383->401 402 7ff7e104368c-7ff7e104369b call 7ff7e1043ba0 383->402 403 7ff7e104379f-7ff7e10437bf call 7ff7e104ad80 401->403 402->401 408 7ff7e10436a1-7ff7e10436b4 call 7ff7e1043a70 402->408 408->401 411 7ff7e10436ba-7ff7e10436cd call 7ff7e1043b20 408->411 411->401 414 7ff7e10436d3-7ff7e10436fa call 7ff7e1046990 411->414 417 7ff7e104373c-7ff7e1043764 call 7ff7e1046f90 call 7ff7e10419d0 414->417 418 7ff7e10436fc-7ff7e104370b call 7ff7e1046990 414->418 428 7ff7e104376a-7ff7e1043780 call 7ff7e10419d0 417->428 429 7ff7e104384d-7ff7e104385e 417->429 418->417 424 7ff7e104370d-7ff7e1043713 418->424 426 7ff7e104371f-7ff7e1043739 call 7ff7e105409c call 7ff7e1046f90 424->426 427 7ff7e1043715-7ff7e104371d 424->427 426->417 427->426 441 7ff7e1043782-7ff7e1043795 call 7ff7e1042770 428->441 442 7ff7e10437c0-7ff7e10437c3 428->442 433 7ff7e1043860-7ff7e104386a call 7ff7e1043280 429->433 434 7ff7e1043873-7ff7e104388b call 7ff7e1047a30 429->434 444 7ff7e104386c 433->444 445 7ff7e10438ab-7ff7e10438b8 call 7ff7e1045e40 433->445 446 7ff7e104389e-7ff7e10438a5 SetDllDirectoryW 434->446 447 7ff7e104388d-7ff7e1043899 call 7ff7e1042770 434->447 441->401 442->429 449 7ff7e10437c9-7ff7e10437e0 call 7ff7e1043cb0 442->449 444->434 458 7ff7e10438ba-7ff7e10438ca call 7ff7e1045ae0 445->458 459 7ff7e1043906-7ff7e104390b call 7ff7e1045dc0 445->459 446->445 447->401 456 7ff7e10437e7-7ff7e1043813 call 7ff7e1047200 449->456 457 7ff7e10437e2-7ff7e10437e5 449->457 468 7ff7e104383d-7ff7e104384b 456->468 469 7ff7e1043815-7ff7e104381d call 7ff7e104f2ac 456->469 460 7ff7e1043822-7ff7e1043838 call 7ff7e1042770 457->460 458->459 473 7ff7e10438cc-7ff7e10438db call 7ff7e1045640 458->473 466 7ff7e1043910-7ff7e1043913 459->466 460->401 471 7ff7e1043919-7ff7e1043926 466->471 472 7ff7e10439c6-7ff7e10439d5 call 7ff7e1043110 466->472 468->433 469->460 477 7ff7e1043930-7ff7e104393a 471->477 472->401 487 7ff7e10439db-7ff7e1043a12 call 7ff7e1046f20 call 7ff7e1046990 call 7ff7e10453e0 472->487 485 7ff7e10438dd-7ff7e10438e9 call 7ff7e10455d0 473->485 486 7ff7e10438fc-7ff7e1043901 call 7ff7e1045890 473->486 481 7ff7e104393c-7ff7e1043941 477->481 482 7ff7e1043943-7ff7e1043945 477->482 481->477 481->482 483 7ff7e1043947-7ff7e104396a call 7ff7e1041b30 482->483 484 7ff7e1043991-7ff7e10439c1 call 7ff7e1043270 call 7ff7e10430b0 call 7ff7e1043260 call 7ff7e1045890 call 7ff7e1045dc0 482->484 483->401 497 7ff7e1043970-7ff7e104397b 483->497 484->403 485->486 498 7ff7e10438eb-7ff7e10438fa call 7ff7e1045c90 485->498 486->459 487->401 510 7ff7e1043a18-7ff7e1043a2b call 7ff7e1043270 call 7ff7e1046fd0 487->510 501 7ff7e1043980-7ff7e104398f 497->501 498->466 501->484 501->501 518 7ff7e1043a30-7ff7e1043a4d call 7ff7e1045890 call 7ff7e1045dc0 510->518 523 7ff7e1043a57-7ff7e1043a61 call 7ff7e1041ab0 518->523 524 7ff7e1043a4f-7ff7e1043a52 call 7ff7e1046c90 518->524 523->403 524->523
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF7E1043BA0: GetModuleFileNameW.KERNEL32(?,00007FF7E1043699), ref: 00007FF7E1043BD1
                                                                                                                                                                                      • SetDllDirectoryW.KERNEL32 ref: 00007FF7E10438A5
                                                                                                                                                                                        • Part of subcall function 00007FF7E1046990: GetEnvironmentVariableW.KERNEL32(00007FF7E10436E7), ref: 00007FF7E10469CA
                                                                                                                                                                                        • Part of subcall function 00007FF7E1046990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E10469E7
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                      • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                      • API String ID: 2344891160-3602715111
                                                                                                                                                                                      • Opcode ID: 44b475a59b26ac604398257d32b032ffcccbc2e891c2c812d1ce445b27ff6486
                                                                                                                                                                                      • Instruction ID: 1f6a89982292649c280a3ee8668f3ecec52b9260dca59b53bf0c39dd87dc68a6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 44b475a59b26ac604398257d32b032ffcccbc2e891c2c812d1ce445b27ff6486
                                                                                                                                                                                      • Instruction Fuzzy Hash: 58B1A061A1C69395FB60FB2194933FDE290BF84784FC05137EA4D4B696EEBCE5048322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 528 7ff7e1041050-7ff7e10410ab call 7ff7e104a610 531 7ff7e10410ad-7ff7e10410d2 call 7ff7e1042770 528->531 532 7ff7e10410d3-7ff7e10410eb call 7ff7e10540b0 528->532 537 7ff7e1041109-7ff7e1041119 call 7ff7e10540b0 532->537 538 7ff7e10410ed-7ff7e1041104 call 7ff7e10424d0 532->538 544 7ff7e1041137-7ff7e1041147 537->544 545 7ff7e104111b-7ff7e1041132 call 7ff7e10424d0 537->545 543 7ff7e104126c-7ff7e1041281 call 7ff7e104a2f0 call 7ff7e105409c * 2 538->543 561 7ff7e1041286-7ff7e10412a0 543->561 547 7ff7e1041150-7ff7e1041175 call 7ff7e104f5fc 544->547 545->543 554 7ff7e104125e 547->554 555 7ff7e104117b-7ff7e1041185 call 7ff7e104f370 547->555 557 7ff7e1041264 554->557 555->554 562 7ff7e104118b-7ff7e1041197 555->562 557->543 563 7ff7e10411a0-7ff7e10411c8 call 7ff7e1048a60 562->563 566 7ff7e10411ca-7ff7e10411cd 563->566 567 7ff7e1041241-7ff7e104125c call 7ff7e1042770 563->567 568 7ff7e104123c 566->568 569 7ff7e10411cf-7ff7e10411d9 566->569 567->557 568->567 571 7ff7e10411db-7ff7e10411e8 call 7ff7e104fd3c 569->571 572 7ff7e1041203-7ff7e1041206 569->572 577 7ff7e10411ed-7ff7e10411f0 571->577 575 7ff7e1041219-7ff7e104121e 572->575 576 7ff7e1041208-7ff7e1041216 call 7ff7e104bb60 572->576 575->563 579 7ff7e1041220-7ff7e1041223 575->579 576->575 582 7ff7e10411fe-7ff7e1041201 577->582 583 7ff7e10411f2-7ff7e10411fc call 7ff7e104f370 577->583 580 7ff7e1041237-7ff7e104123a 579->580 581 7ff7e1041225-7ff7e1041228 579->581 580->557 581->567 585 7ff7e104122a-7ff7e1041232 581->585 582->567 583->575 583->582 585->547
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                      • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                      • API String ID: 2030045667-1655038675
                                                                                                                                                                                      • Opcode ID: 3779129f6717ee64bf2fd80a95aba7003bb6db5e346ab8bcb12fcd43ee4628c9
                                                                                                                                                                                      • Instruction ID: 140204831273d19b7894a7cad1ff581cd6d6c4549363e33ec01712c7c1df2fea
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3779129f6717ee64bf2fd80a95aba7003bb6db5e346ab8bcb12fcd43ee4628c9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4F51F362B0C68285EB20BB51E4823BAA290FB84794FC44133EE4D83795EFBCF555C312
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 660 7ff7e105af2c-7ff7e105af52 661 7ff7e105af6d-7ff7e105af71 660->661 662 7ff7e105af54-7ff7e105af68 call 7ff7e1054424 call 7ff7e1054444 660->662 663 7ff7e105b347-7ff7e105b353 call 7ff7e1054424 call 7ff7e1054444 661->663 664 7ff7e105af77-7ff7e105af7e 661->664 676 7ff7e105b35e 662->676 683 7ff7e105b359 call 7ff7e1059db0 663->683 664->663 666 7ff7e105af84-7ff7e105afb2 664->666 666->663 670 7ff7e105afb8-7ff7e105afbf 666->670 673 7ff7e105afd8-7ff7e105afdb 670->673 674 7ff7e105afc1-7ff7e105afd3 call 7ff7e1054424 call 7ff7e1054444 670->674 679 7ff7e105b343-7ff7e105b345 673->679 680 7ff7e105afe1-7ff7e105afe7 673->680 674->683 681 7ff7e105b361-7ff7e105b378 676->681 679->681 680->679 684 7ff7e105afed-7ff7e105aff0 680->684 683->676 684->674 687 7ff7e105aff2-7ff7e105b017 684->687 689 7ff7e105b04a-7ff7e105b051 687->689 690 7ff7e105b019-7ff7e105b01b 687->690 693 7ff7e105b053-7ff7e105b07b call 7ff7e105cacc call 7ff7e1059e18 * 2 689->693 694 7ff7e105b026-7ff7e105b03d call 7ff7e1054424 call 7ff7e1054444 call 7ff7e1059db0 689->694 691 7ff7e105b01d-7ff7e105b024 690->691 692 7ff7e105b042-7ff7e105b048 690->692 691->692 691->694 696 7ff7e105b0c8-7ff7e105b0df 692->696 720 7ff7e105b07d-7ff7e105b093 call 7ff7e1054444 call 7ff7e1054424 693->720 721 7ff7e105b098-7ff7e105b0c3 call 7ff7e105b754 693->721 724 7ff7e105b1d0 694->724 699 7ff7e105b15a-7ff7e105b164 call 7ff7e1062a3c 696->699 700 7ff7e105b0e1-7ff7e105b0e9 696->700 711 7ff7e105b1ee 699->711 712 7ff7e105b16a-7ff7e105b17f 699->712 700->699 704 7ff7e105b0eb-7ff7e105b0ed 700->704 704->699 708 7ff7e105b0ef-7ff7e105b105 704->708 708->699 713 7ff7e105b107-7ff7e105b113 708->713 716 7ff7e105b1f3-7ff7e105b213 ReadFile 711->716 712->711 718 7ff7e105b181-7ff7e105b193 GetConsoleMode 712->718 713->699 719 7ff7e105b115-7ff7e105b117 713->719 722 7ff7e105b30d-7ff7e105b316 GetLastError 716->722 723 7ff7e105b219-7ff7e105b221 716->723 718->711 725 7ff7e105b195-7ff7e105b19d 718->725 719->699 726 7ff7e105b119-7ff7e105b131 719->726 720->724 721->696 732 7ff7e105b318-7ff7e105b32e call 7ff7e1054444 call 7ff7e1054424 722->732 733 7ff7e105b333-7ff7e105b336 722->733 723->722 729 7ff7e105b227 723->729 734 7ff7e105b1d3-7ff7e105b1dd call 7ff7e1059e18 724->734 725->716 731 7ff7e105b19f-7ff7e105b1c1 ReadConsoleW 725->731 726->699 727 7ff7e105b133-7ff7e105b13f 726->727 727->699 735 7ff7e105b141-7ff7e105b143 727->735 739 7ff7e105b22e-7ff7e105b243 729->739 741 7ff7e105b1c3 GetLastError 731->741 742 7ff7e105b1e2-7ff7e105b1ec 731->742 732->724 736 7ff7e105b33c-7ff7e105b33e 733->736 737 7ff7e105b1c9-7ff7e105b1cb call 7ff7e10543b8 733->737 734->681 735->699 746 7ff7e105b145-7ff7e105b155 735->746 736->734 737->724 739->734 748 7ff7e105b245-7ff7e105b250 739->748 741->737 742->739 746->699 752 7ff7e105b277-7ff7e105b27f 748->752 753 7ff7e105b252-7ff7e105b26b call 7ff7e105ab44 748->753 757 7ff7e105b2fb-7ff7e105b308 call 7ff7e105a984 752->757 758 7ff7e105b281-7ff7e105b293 752->758 760 7ff7e105b270-7ff7e105b272 753->760 757->760 761 7ff7e105b2ee-7ff7e105b2f6 758->761 762 7ff7e105b295 758->762 760->734 761->734 764 7ff7e105b29a-7ff7e105b2a1 762->764 765 7ff7e105b2dd-7ff7e105b2e8 764->765 766 7ff7e105b2a3-7ff7e105b2a7 764->766 765->761 767 7ff7e105b2a9-7ff7e105b2b0 766->767 768 7ff7e105b2c3 766->768 767->768 769 7ff7e105b2b2-7ff7e105b2b6 767->769 770 7ff7e105b2c9-7ff7e105b2d9 768->770 769->768 771 7ff7e105b2b8-7ff7e105b2c1 769->771 770->764 772 7ff7e105b2db 770->772 771->770 772->761
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
                                                                                                                                                                                      • Instruction ID: 4e0aa0140a3ff1cd725df88fd325c3d6fcb413c85be68b7f0ad2635046e9a9e7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
                                                                                                                                                                                      • Instruction Fuzzy Hash: CEC1D72290C68691EB70BB1594623BDBBA6FB80B80FD54132D94D07792DEFCF445C726
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 850 7ff7e105c430-7ff7e105c455 851 7ff7e105c45b-7ff7e105c45e 850->851 852 7ff7e105c723 850->852 853 7ff7e105c497-7ff7e105c4c3 851->853 854 7ff7e105c460-7ff7e105c492 call 7ff7e1059ce4 851->854 855 7ff7e105c725-7ff7e105c735 852->855 857 7ff7e105c4ce-7ff7e105c4d4 853->857 858 7ff7e105c4c5-7ff7e105c4cc 853->858 854->855 860 7ff7e105c4e4-7ff7e105c4f9 call 7ff7e1062a3c 857->860 861 7ff7e105c4d6-7ff7e105c4df call 7ff7e105b7f0 857->861 858->854 858->857 865 7ff7e105c613-7ff7e105c61c 860->865 866 7ff7e105c4ff-7ff7e105c508 860->866 861->860 868 7ff7e105c61e-7ff7e105c624 865->868 869 7ff7e105c670-7ff7e105c695 WriteFile 865->869 866->865 867 7ff7e105c50e-7ff7e105c512 866->867 870 7ff7e105c514-7ff7e105c51c call 7ff7e1053a20 867->870 871 7ff7e105c523-7ff7e105c52e 867->871 874 7ff7e105c65c-7ff7e105c66e call 7ff7e105bee8 868->874 875 7ff7e105c626-7ff7e105c629 868->875 872 7ff7e105c697-7ff7e105c69d GetLastError 869->872 873 7ff7e105c6a0 869->873 870->871 879 7ff7e105c530-7ff7e105c539 871->879 880 7ff7e105c53f-7ff7e105c554 GetConsoleMode 871->880 872->873 882 7ff7e105c6a3 873->882 897 7ff7e105c600-7ff7e105c607 874->897 876 7ff7e105c62b-7ff7e105c62e 875->876 877 7ff7e105c648-7ff7e105c65a call 7ff7e105c108 875->877 883 7ff7e105c6b4-7ff7e105c6be 876->883 884 7ff7e105c634-7ff7e105c646 call 7ff7e105bfec 876->884 877->897 879->865 879->880 887 7ff7e105c60c 880->887 888 7ff7e105c55a-7ff7e105c560 880->888 890 7ff7e105c6a8 882->890 891 7ff7e105c71c-7ff7e105c721 883->891 892 7ff7e105c6c0-7ff7e105c6c5 883->892 884->897 887->865 895 7ff7e105c5e9-7ff7e105c5fb call 7ff7e105ba70 888->895 896 7ff7e105c566-7ff7e105c569 888->896 898 7ff7e105c6ad 890->898 891->855 899 7ff7e105c6c7-7ff7e105c6ca 892->899 900 7ff7e105c6f3-7ff7e105c6fd 892->900 895->897 903 7ff7e105c56b-7ff7e105c56e 896->903 904 7ff7e105c574-7ff7e105c582 896->904 897->890 898->883 905 7ff7e105c6cc-7ff7e105c6db 899->905 906 7ff7e105c6e3-7ff7e105c6ee call 7ff7e1054400 899->906 907 7ff7e105c704-7ff7e105c713 900->907 908 7ff7e105c6ff-7ff7e105c702 900->908 903->898 903->904 909 7ff7e105c584 904->909 910 7ff7e105c5e0-7ff7e105c5e4 904->910 905->906 906->900 907->891 908->852 908->907 912 7ff7e105c588-7ff7e105c59f call 7ff7e1062b08 909->912 910->882 916 7ff7e105c5d7-7ff7e105c5dd GetLastError 912->916 917 7ff7e105c5a1-7ff7e105c5ad 912->917 916->910 918 7ff7e105c5cc-7ff7e105c5d3 917->918 919 7ff7e105c5af-7ff7e105c5c1 call 7ff7e1062b08 917->919 918->910 921 7ff7e105c5d5 918->921 919->916 923 7ff7e105c5c3-7ff7e105c5ca 919->923 921->912 923->918
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E105C41B), ref: 00007FF7E105C54C
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E105C41B), ref: 00007FF7E105C5D7
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConsoleErrorLastMode
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 953036326-0
                                                                                                                                                                                      • Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
                                                                                                                                                                                      • Instruction ID: 9fbdd96ac681d9992da8d4d938099312ee08e9bcb19976300c0886d2f8502bbd
                                                                                                                                                                                      • Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
                                                                                                                                                                                      • Instruction Fuzzy Hash: C991F622F0865185F7B0AF6595613BDABA8FB04788FD45137DE0E56AC4CFB8E441C722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight$_isindst
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4170891091-0
                                                                                                                                                                                      • Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
                                                                                                                                                                                      • Instruction ID: 682776e61ada55a9617c3928bbe602820cea8a4fb0f03825a5feecc05ce00168
                                                                                                                                                                                      • Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 12510772F046114AFB24EF7499627BCE7A1BB00358FA44236ED5E52AD5DB7CB802C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2780335769-0
                                                                                                                                                                                      • Opcode ID: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
                                                                                                                                                                                      • Instruction ID: 427e6230c297a7fcd97fccdb129c7e9e4670472a349d2480824769d22e208983
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F517022E186428AFB20EF64D4623BD73B1AF48768F504136DE0D97689EF78D445C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1452418845-0
                                                                                                                                                                                      • Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
                                                                                                                                                                                      • Instruction ID: 0c94d8f64f68ef283eeae1628e4ab55070aed244e9b9a728d5eee199a439df65
                                                                                                                                                                                      • Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 90312821E0C10345FB64BB65A5A33B9A291BF95384FC44037E90D8B6D3DEFCA8458273
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1279662727-0
                                                                                                                                                                                      • Opcode ID: aa6a3d9890cc6a7f195a6e990ba186583f2f0d5ddde8471eaaef5ef51b0941e7
                                                                                                                                                                                      • Instruction ID: bb0e42dae40344a5bd18e309500fb0e9ac2171529744744d95ba623db277db9d
                                                                                                                                                                                      • Opcode Fuzzy Hash: aa6a3d9890cc6a7f195a6e990ba186583f2f0d5ddde8471eaaef5ef51b0941e7
                                                                                                                                                                                      • Instruction Fuzzy Hash: F441D622E1878183F764AB2095213B9B2A0FF95774F509336E65C43AD1EFBCA1E08721
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
                                                                                                                                                                                      • Instruction ID: e158ef74f5031020fdd0e038f848754a93a145f39f897a024e2cf382f2ab8a5a
                                                                                                                                                                                      • Opcode Fuzzy Hash: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F510C71B0924245EB64BE2994427F6F181BF84BB5F944732DE6D437C5CFBCD4018662
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7E1059EA5,?,?,00000000,00007FF7E1059F5A), ref: 00007FF7E105A096
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E1059EA5,?,?,00000000,00007FF7E1059F5A), ref: 00007FF7E105A0A0
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1687624791-0
                                                                                                                                                                                      • Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
                                                                                                                                                                                      • Instruction ID: d300ddf34335dc54b639d836822a31a2638d7dc61b0d76f08b1ff0ebee44762f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5321A411B2C68281FFB07765A4A637DD691AF447A4FC45237EA2E477C1CEFCA4458322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF7E105B79D), ref: 00007FF7E105B650
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7E105B79D), ref: 00007FF7E105B65A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFileLastPointer
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2976181284-0
                                                                                                                                                                                      • Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
                                                                                                                                                                                      • Instruction ID: 1b9d6a4de71296517bd20ad02a00f11b7fad6c7c5002dd99e7f75402266e77ea
                                                                                                                                                                                      • Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C11B261718B8181DB20AB25A465269E762BB44BF4F944332EA7D0BBD9CFBCE0518711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E1054891), ref: 00007FF7E10549AF
                                                                                                                                                                                      • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E1054891), ref: 00007FF7E10549C5
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1707611234-0
                                                                                                                                                                                      • Opcode ID: 42d85f7bbfb38a33647f37402af2049ec243a38652db21839daf1665d9964160
                                                                                                                                                                                      • Instruction ID: c692bdf078b16ded2037c552023c9448191589748baf6c5f30914e6cec9e740b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 42d85f7bbfb38a33647f37402af2049ec243a38652db21839daf1665d9964160
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0C11737160C652C2EB64AB15A46227EF760FB85771F900236F6DE819D8EFBCD054CB21
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E2E
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E38
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 588628887-0
                                                                                                                                                                                      • Opcode ID: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
                                                                                                                                                                                      • Instruction ID: 81c606a4376ae23032f6186a6122ae6b6b943824238685964b30cb24925684d4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
                                                                                                                                                                                      • Instruction Fuzzy Hash: 64E08650F0C30282FF247BB1685737992509F44B50BC44036D90E86252EEBC68459332
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
                                                                                                                                                                                      • Instruction ID: 9f735d6a5ad93de1760542cc329970f4376e3826f57aab0f4387e8e80554c8ba
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3241E33290860183EB34EB15A56237DB7A1FB95B40F901136DA8E876D1DFBCF402CB62
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _fread_nolock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 840049012-0
                                                                                                                                                                                      • Opcode ID: e2e74b9e2a8e76fc536388d61138624af022f1471ed3dc712add419cb1f7a993
                                                                                                                                                                                      • Instruction ID: ffab27d8876b02eed598edc0378f20c81832e1a91ded142e423199c4c2a8e718
                                                                                                                                                                                      • Opcode Fuzzy Hash: e2e74b9e2a8e76fc536388d61138624af022f1471ed3dc712add419cb1f7a993
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8821E721B0829146FB22BB1265463FAE751BF45BD4FC84432EE4D07786CEBCE101C321
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
                                                                                                                                                                                      • Instruction ID: 868b2a69eb6fcdf5522e2d4934680969409dee25ef32672a26af9d6ecdb8595e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
                                                                                                                                                                                      • Instruction Fuzzy Hash: 39316021A1865285EB61BB55D8623B8AA90AF40B65FC10237EA1D473D2DFFCE4419733
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
                                                                                                                                                                                      • Instruction ID: 896287432fef2af73ca1a621a7c4b1a61c9a58435e4464493cdd5a978b1ced13
                                                                                                                                                                                      • Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 94115461B1C64181EF70BF5194223BDE6A0AF85B84FC44432EA4C57B96DFBCD4408F22
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
                                                                                                                                                                                      • Instruction ID: c71041890b31a645d177438231cd914c973ac1704b716ea7dfcb31b94a44ec97
                                                                                                                                                                                      • Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5721F672B18A8287DB70AF18E442379B7A0FB84B94F944236EB5D47AD9DF7CD4018B11
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
                                                                                                                                                                                      • Instruction ID: 0d773f157ec7c4d093b7622986e2811f76d90184e0c4ec486e54900c8a7883c0
                                                                                                                                                                                      • Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A010821A0874240EB10FB6699422B9E695FF45FE4F888632DE5C43BD6DEBCD4014711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7E105A8B6,?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E), ref: 00007FF7E105DD95
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                      • Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
                                                                                                                                                                                      • Instruction ID: 03345c39296eed3b4412e0237a7a1243b2303ca8f1a12edeccc303a9bb551631
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
                                                                                                                                                                                      • Instruction Fuzzy Hash: C6F06D64B1920280FFB4766299233B5D6845F88B90FCC9433C90E866C2EDBCE4808332
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(?,?,?,00007FF7E104FE44,?,?,?,00007FF7E1051356,?,?,?,?,?,00007FF7E1052949), ref: 00007FF7E105CB0A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                      • Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
                                                                                                                                                                                      • Instruction ID: a1ae283995eae3767b42e28753a0ba84da614203444b7cd764b8713a95d28732
                                                                                                                                                                                      • Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 83F05E10B0D34240FFB476B15A2377591984F487A0FC80632DC2E866C2EDFCA8809232
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                      • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                      • API String ID: 2238633743-1453502826
                                                                                                                                                                                      • Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
                                                                                                                                                                                      • Instruction ID: 814c9f532e1e004f61dc6bc73f265fdbb72e26aeb2a0cd16368cf7b664dad8c7
                                                                                                                                                                                      • Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
                                                                                                                                                                                      • Instruction Fuzzy Hash: C5E177A4B0DB43D0FB95FB54A992374A3A5AF04790BD45037D81E06AA4EFFCB5588233
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                                                                                      • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                      • API String ID: 2446303242-1601438679
                                                                                                                                                                                      • Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
                                                                                                                                                                                      • Instruction ID: fd96fa4c3bead2f91e2a7f975329ef243dbc4c3bd30437466efc052ce52748eb
                                                                                                                                                                                      • Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 27A13936318B81C6E714AF11E99579AB760F788B94F90413AEB8D03B24CFBDE165CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                      • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                      • API String ID: 808467561-2761157908
                                                                                                                                                                                      • Opcode ID: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
                                                                                                                                                                                      • Instruction ID: b6eb90d0f78655bf2eb3408bf02a346b08668b0604a2db4a137a415ba80481d1
                                                                                                                                                                                      • Opcode Fuzzy Hash: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
                                                                                                                                                                                      • Instruction Fuzzy Hash: 70B2E472F182928FE7649F64D4427FDB7A1FB54348F805136DA0D9BE84DBB8A900CB91
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00007FF7E10426A0), ref: 00007FF7E10474D7
                                                                                                                                                                                      • FormatMessageW.KERNEL32(00000000,00007FF7E10426A0), ref: 00007FF7E1047506
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32 ref: 00007FF7E104755C
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                      • API String ID: 2920928814-2573406579
                                                                                                                                                                                      • Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
                                                                                                                                                                                      • Instruction ID: c0865a6e1b20f85190cdb29f5d6ebbde017f0b25d7d39d182f4bcbdd9a959a87
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7D214431B18A8282F760BB11E882365B361FF48384FC40037E54D86A95DFFCE115C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3140674995-0
                                                                                                                                                                                      • Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
                                                                                                                                                                                      • Instruction ID: 36a833de8078d959b7860b08c0cd357406b1f71f4961ee5dbd8d5c634de6d465
                                                                                                                                                                                      • Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
                                                                                                                                                                                      • Instruction Fuzzy Hash: 93311D72709A81C6EB60AF64E8813EDB365FB84744F84443ADA4E47A98DF7CD648C721
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1239891234-0
                                                                                                                                                                                      • Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
                                                                                                                                                                                      • Instruction ID: 79eb8c4da3f7d1fea9dba07eba6db3d05943b7ed9529bd979fdc85879e19d49e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
                                                                                                                                                                                      • Instruction Fuzzy Hash: 43318632618B81C6EB60EF25E8413AEB3A4FB88794F900136EA8D47B55DF7CC545C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2227656907-0
                                                                                                                                                                                      • Opcode ID: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
                                                                                                                                                                                      • Instruction ID: e07e0660dbfb4adddaefe29b9de8ae4fbf240d975e546b9f59092308f7356525
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
                                                                                                                                                                                      • Instruction Fuzzy Hash: B7B1B422B5869681EB61BB21D4123BDE391EB44BE4F845133E95E07F8DDEBCE541C322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memcpy_s
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1502251526-0
                                                                                                                                                                                      • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                      • Instruction ID: 6d24be918332a20eb937e2f864d0159efb85bca2942848fbc39e83872fa167ad
                                                                                                                                                                                      • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                      • Instruction Fuzzy Hash: D6C11872B182868BEB24DF15E44576AF7A1F784B84F848136DB4E4BB44DB7DE805CB80
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 15204871-0
                                                                                                                                                                                      • Opcode ID: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
                                                                                                                                                                                      • Instruction ID: 897bb621d951c90ce8684c7e79d4796d693a8ad60a699cea7d034e1c6286bb84
                                                                                                                                                                                      • Opcode Fuzzy Hash: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5EB17B73604B898BEB15DF29C846368BBE0F784B48F158923DB5D83BA8CB79D491C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Find$CloseFileFirst
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2295610775-0
                                                                                                                                                                                      • Opcode ID: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
                                                                                                                                                                                      • Instruction ID: 60e1e2e8f5bb103b54f51c592580616eead304c50528ee398c329dfd6ae21e76
                                                                                                                                                                                      • Opcode Fuzzy Hash: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
                                                                                                                                                                                      • Instruction Fuzzy Hash: A0F04432A18781C7F761AF64E48676AB390BB44764F84433AD66E066D4DF7CD049CB11
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: $
                                                                                                                                                                                      • API String ID: 0-227171996
                                                                                                                                                                                      • Opcode ID: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
                                                                                                                                                                                      • Instruction ID: bc1aa6a65191a5bc0303724a1d4670fdf51ef13eb8460a2c624bff1ede0f890d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
                                                                                                                                                                                      • Instruction Fuzzy Hash: AAE1D732A08646C5EB78BE65807223DB3A0FF44B48F945137DA0E07794DFB9E852C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: e+000$gfff
                                                                                                                                                                                      • API String ID: 0-3030954782
                                                                                                                                                                                      • Opcode ID: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
                                                                                                                                                                                      • Instruction ID: 9e09432a7bd47de20e8ab29de4783fae86e31b2283053b92589fef8dcd89e3f1
                                                                                                                                                                                      • Opcode Fuzzy Hash: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
                                                                                                                                                                                      • Instruction Fuzzy Hash: 53517922B182C546E7309E35A862769FB91F744B90F888233CB9C8BAC5CEBDD441C712
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1010374628-0
                                                                                                                                                                                      • Opcode ID: 3dd89506066c6ffdf0f12fb75a986cd17193a66726dd75fee6c51e450970bbea
                                                                                                                                                                                      • Instruction ID: b9e7ba5f71fe5fcdc515c807c87425e0fb1c5691213539dc22f38149a4c77594
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3dd89506066c6ffdf0f12fb75a986cd17193a66726dd75fee6c51e450970bbea
                                                                                                                                                                                      • Instruction Fuzzy Hash: B702A122B0D65242FB74BB11A5273B9A690AF41BA0FC44537DD5D4BBD2DEFCA8019332
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: gfffffff
                                                                                                                                                                                      • API String ID: 0-1523873471
                                                                                                                                                                                      • Opcode ID: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
                                                                                                                                                                                      • Instruction ID: c1189a7e2b914162e19a04e3f87412ebf38e49fab0f6d11316ea19cee92e6622
                                                                                                                                                                                      • Opcode Fuzzy Hash: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
                                                                                                                                                                                      • Instruction Fuzzy Hash: D0A17662A087C546EB71DB29A1217AABB98EB50BC4F848033DE4D477C1DE7DE401C722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: TMP
                                                                                                                                                                                      • API String ID: 3215553584-3125297090
                                                                                                                                                                                      • Opcode ID: 5b671ef3ad5ea4a92c1a22baee6b1fc4a25078c79dff921e20ebb84a05e1d939
                                                                                                                                                                                      • Instruction ID: 19e122a09aee42dde73e01717544bc474ad4aca37a33f6a4266c3f36bf182c26
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5b671ef3ad5ea4a92c1a22baee6b1fc4a25078c79dff921e20ebb84a05e1d939
                                                                                                                                                                                      • Instruction Fuzzy Hash: E051C415F0824281FB75BA26492377AE2D17F84BC4FC85436EE0D437D6EEBCE401A226
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: HeapProcess
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 54951025-0
                                                                                                                                                                                      • Opcode ID: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
                                                                                                                                                                                      • Instruction ID: b6bbb9b19554a5eb5dcc5d666fbf6c1b131a238babcb538f05453574c2b602db
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 03B09220F0BB02C2EB083B216C8371463A4BF58760FD8013AC00C44720DF7C20AA5722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
                                                                                                                                                                                      • Instruction ID: 6e7caff28452b69e25dacba98ef17858edb7a44b318bc9ed3a6d39e84fe03844
                                                                                                                                                                                      • Opcode Fuzzy Hash: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
                                                                                                                                                                                      • Instruction Fuzzy Hash: B4D1E722A08642C6FB78AE65846237DA3A0FF45B98F944137CE0D07795DFBDD845C362
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
                                                                                                                                                                                      • Instruction ID: d4e562c8544f42606d2f7a969550f26cc1d26d3e6bed15e81cb455389ce65f5f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1EC192722141E08BE2C9EB29E46997EB391F78930DBD4403BEB8747B89C73CA514D761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
                                                                                                                                                                                      • Instruction ID: a93a4c511077141d85e93b3c500a8c07f8b6813a776df8966fced3c8e638da69
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 48B1BC76A08685C5EB74AF29C06133DBBA1EB55B48FA80136DB4E03395CFB9D441C726
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
                                                                                                                                                                                      • Instruction ID: eb2b0573e671c4a9263d6a235848650a27d0c3abfdc71661553240ee62b8a848
                                                                                                                                                                                      • Opcode Fuzzy Hash: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
                                                                                                                                                                                      • Instruction Fuzzy Hash: B8812772A0878186EB74EB19A462379FAA1FB45794F844237DB9E43B89DF7CD4008B11
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 43964b9baea6600a933ee8e1a049a499104490ec7162e6d0a4f8078b6de4c171
                                                                                                                                                                                      • Instruction ID: 136ea77c975a3639b59cca7ecfc0b3390d4579ffef2df1647caece880168d337
                                                                                                                                                                                      • Opcode Fuzzy Hash: 43964b9baea6600a933ee8e1a049a499104490ec7162e6d0a4f8078b6de4c171
                                                                                                                                                                                      • Instruction Fuzzy Hash: F8610A72F1829246FB74A928945237DE691BF413B0FD8023BD65E46ED5DEFDE8008722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
                                                                                                                                                                                      • Instruction ID: b7403ff6337569481ed0335230273975144b6d6bb24792f6b69c631c2b25b5e1
                                                                                                                                                                                      • Opcode Fuzzy Hash: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9551D536A1875686E734AF29C06133CB7A0EB45F58F644132CE8D07799CBBAE943C761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
                                                                                                                                                                                      • Instruction ID: c06d531f6d01ea701580f2f7dbef95fe28504f727448a5c19397eda87a6f545b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
                                                                                                                                                                                      • Instruction Fuzzy Hash: E651A536A1865186EB349B29D061738B7A2EB44B6CF685132CE4D07794CFBAEC43CB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
                                                                                                                                                                                      • Instruction ID: 4a9fc13acd511ff616d174b535a86f2b3819879b396f0d6b1e15c293f789260e
                                                                                                                                                                                      • Opcode Fuzzy Hash: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D51B636B1865182E7349B29C065338B7A2EB45FA8FA45132DE4D07794CFFAE843C751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
                                                                                                                                                                                      • Instruction ID: 41afd462357a63d98a84a5632f2d168edbacd34e932e3c1d8e1ef74baca6fc85
                                                                                                                                                                                      • Opcode Fuzzy Hash: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
                                                                                                                                                                                      • Instruction Fuzzy Hash: FF51D536A1865581E7349F28C06233CB7A1EB44B58FA84232CE4C17799DFBAED43C751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
                                                                                                                                                                                      • Instruction ID: b44890441990152af92d02c9aeae56419006090856e0eb387a8d66012668a6ff
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9B510476A1865186E7349B29C06133CB3A2EB44F98FA48132CE4C47799CFBAEC53C751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
                                                                                                                                                                                      • Instruction ID: 2f3c5224c82b19afa7b94f0098b2428e9cd1d7d41ac9b831ea075f83b403c572
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4951E236A1865286E7349B28C06233CB3A0EB44F58FB44132CE4D17799CBBAED53D751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                      • Instruction ID: c54a8630b7e9654637ebd446d339245b084c51ed265ee8bdf7584ebd97ae437a
                                                                                                                                                                                      • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                      • Instruction Fuzzy Hash: F6415B82C0D64E44FBB0991C44367B89680EF227B0DE872B2EC9A573D3DD7C2586C263
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 588628887-0
                                                                                                                                                                                      • Opcode ID: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
                                                                                                                                                                                      • Instruction ID: 2f5d3aaafef5f65ae038bf1e6805092f8726c7188b561034ba6bdbe15a3ddabc
                                                                                                                                                                                      • Opcode Fuzzy Hash: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
                                                                                                                                                                                      • Instruction Fuzzy Hash: C1412972714A5882EF54DF2AD925679B3A1F748FD0B88A033EE0D87B54DE7CC0828351
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
                                                                                                                                                                                      • Instruction ID: 06f9602127f3283e6ca40692895d7e58a318c10d2ff33f3fc7be677ce1bea4d7
                                                                                                                                                                                      • Opcode Fuzzy Hash: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
                                                                                                                                                                                      • Instruction Fuzzy Hash: AF31F632708B4242EB34EF21645237EB6D4AF84BA0F54423AEA5D53BD5DFBCD0028715
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
                                                                                                                                                                                      • Instruction ID: 3bc2e551d71d5c9489c32ebcdea98096a540f6a84f62fe99421413e68e19a1ac
                                                                                                                                                                                      • Opcode Fuzzy Hash: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
                                                                                                                                                                                      • Instruction Fuzzy Hash: C2F068717283558ADB98EF69A80372977D0F7083C0F80D13AD58D87F04D67C90518F15
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
                                                                                                                                                                                      • Instruction ID: 202bc0188ad2416885c93b9b01a43341b51ef17029c7794e064297339dca3b4b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
                                                                                                                                                                                      • Instruction Fuzzy Hash: C7A00261A0CC06D5FB44BB10E892230A370FF50340BC01037D40D854A09FBCA440D322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                      • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                                                      • API String ID: 190572456-3109299426
                                                                                                                                                                                      • Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
                                                                                                                                                                                      • Instruction ID: e98b570a3872d988a2b578128e0772add45f41fc06d8b657578c12b967432d4a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
                                                                                                                                                                                      • Instruction Fuzzy Hash: 924276A4B0EB0791FB55FB05A892374A3A1BF44794BC46137D80E066A4EFFCE5588363
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                      • String ID: P%
                                                                                                                                                                                      • API String ID: 2147705588-2959514604
                                                                                                                                                                                      • Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
                                                                                                                                                                                      • Instruction ID: c7532c6cca579d1a8a28cfc9c1894c78bab0eb7d791f73b1d30807309c66f47a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
                                                                                                                                                                                      • Instruction Fuzzy Hash: FA5106266047A186D734AF22B4182BAF7A1FB98B61F004132EBCF43A84DF7CD045DB20
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: f$f$p$p$f
                                                                                                                                                                                      • API String ID: 3215553584-1325933183
                                                                                                                                                                                      • Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
                                                                                                                                                                                      • Instruction ID: 893050cba977d8074dd8c689e3a7c6833496573c73f10f3753ac75d7b1610a56
                                                                                                                                                                                      • Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9F125276E0C14386FB347A14A06677EF6A1FB80754FD44036D699466CCDBBCEA808B62
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                      • API String ID: 2030045667-3659356012
                                                                                                                                                                                      • Opcode ID: 706f67567fe9d97461f636796ec72d9822deea69ea5ed36219c079b934f27261
                                                                                                                                                                                      • Instruction ID: 1305c5f6c87e22688e824d04bdb0865e4b7d6aeac403cd64f3b1ea1d2060a0b7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 706f67567fe9d97461f636796ec72d9822deea69ea5ed36219c079b934f27261
                                                                                                                                                                                      • Instruction Fuzzy Hash: C8415D61B0864286EB24FB15F4823AAE3A0FF84794FD48433DE4D47A55EEBCF5428721
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                      • API String ID: 849930591-393685449
                                                                                                                                                                                      • Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
                                                                                                                                                                                      • Instruction ID: 09834ffc68168695cc735180b486482c3eb6f3c2f5ab3b2887ea07adc0dc0c04
                                                                                                                                                                                      • Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 33E18172A087418AEB60EF65D4823ADB7A0FB55798F900136EE8D47B95CF7CE490C712
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,00000000,?,00007FF7E105E152,?,?,000002D5B607BF88,00007FF7E105A223,?,?,?,00007FF7E105A11A,?,?,?,00007FF7E1055472), ref: 00007FF7E105DF34
                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00000000,?,00007FF7E105E152,?,?,000002D5B607BF88,00007FF7E105A223,?,?,?,00007FF7E105A11A,?,?,?,00007FF7E1055472), ref: 00007FF7E105DF40
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressFreeLibraryProc
                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                      • API String ID: 3013587201-537541572
                                                                                                                                                                                      • Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
                                                                                                                                                                                      • Instruction ID: 7c8d539c82131e40031f9bce504c3e5eb0f3c319f33ed4018f21a0ba40da07a9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 42412821B1961281FB66FB129822775A391BF14BD0F884137DD0D47788EFBCE845D362
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E104769F
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E10476EF
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                      • API String ID: 626452242-27947307
                                                                                                                                                                                      • Opcode ID: 267b0c8d8adbe99f9cc92f3d6e900d5b31c1cd71cb2f75f25f71044bd00c2d8e
                                                                                                                                                                                      • Instruction ID: f14d254c8659790c7c00a1e197210349e1ce57043d1d9b819e1fe8a701437e80
                                                                                                                                                                                      • Opcode Fuzzy Hash: 267b0c8d8adbe99f9cc92f3d6e900d5b31c1cd71cb2f75f25f71044bd00c2d8e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3341A032A08B82C2D761EF11B88126AF7A5FB847A0FD84136DA8D47B95EFBCD051C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,00007FF7E1043699), ref: 00007FF7E1047B81
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,00007FF7E1043699), ref: 00007FF7E1047BF5
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                      • API String ID: 3723044601-27947307
                                                                                                                                                                                      • Opcode ID: 8b53d79f468dfdec202439f2cfc50ec12b2c6f4620d2deddc649c41771dd01b7
                                                                                                                                                                                      • Instruction ID: 207e492fc41a9bede0b49a861d64449fa16bd111322a4431bf80a12cb1cb1807
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b53d79f468dfdec202439f2cfc50ec12b2c6f4620d2deddc649c41771dd01b7
                                                                                                                                                                                      • Instruction Fuzzy Hash: CE21A031B08B4285EB50BF12E982279B361EB84B80FD44137CA0D43B55EFBCE441C321
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: f$p$p
                                                                                                                                                                                      • API String ID: 3215553584-1995029353
                                                                                                                                                                                      • Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
                                                                                                                                                                                      • Instruction ID: 3d2ade6ff8a918f3573c39b17c1a0dc7bf344576015ad3dd97febfdf94c67470
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E127E62A0C14386FB34BB15D1667B9B6A5EB80750FC84037D68B466C4DBBCE984CB32
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                      • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                      • API String ID: 626452242-876015163
                                                                                                                                                                                      • Opcode ID: bb74e9033905d9d92ee291b3b90ebe20a645d5fe0ae5b755d0038c0cd893acdc
                                                                                                                                                                                      • Instruction ID: 8b5ded07451aa43928c5c79f6224e3f368dd122916388be3371d652fbdf06e65
                                                                                                                                                                                      • Opcode Fuzzy Hash: bb74e9033905d9d92ee291b3b90ebe20a645d5fe0ae5b755d0038c0cd893acdc
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2741C032A18B42C2E761FF25A882279E7B5FB44790F945136EA8D47BA4EF7CD012C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF7E1047A30: MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047A6A
                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7E10467CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7E10464DF
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042770: MessageBoxW.USER32 ref: 00007FF7E1042841
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7E10464F3
                                                                                                                                                                                      • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7E10464B6
                                                                                                                                                                                      • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7E104653A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                      • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                      • API String ID: 1662231829-3498232454
                                                                                                                                                                                      • Opcode ID: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
                                                                                                                                                                                      • Instruction ID: 27cc9412e4fcf0e71d94d9da5276501850687326ac1f3746fcc8f2dbb2ba6a72
                                                                                                                                                                                      • Opcode Fuzzy Hash: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3C316851B1C78281FB61F761A5973B9D251AF987C0FC44433DA4E4269AFEBCE5048722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CF6D
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CF7B
                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CFA5
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CFEB
                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CFF7
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                      • API String ID: 2559590344-2084034818
                                                                                                                                                                                      • Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
                                                                                                                                                                                      • Instruction ID: d57573de2d56351a26f58fb7495b36cdc65d0e663194a6bbfe825ad0595f683b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7231E421B0A64291FF51BB02A542778A394FF08BA0FC94537ED1D0B784EFBCE4458722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047A6A
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047AF0
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                      • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                      • API String ID: 3723044601-876015163
                                                                                                                                                                                      • Opcode ID: 13c7105583b4bafff51af941118006f09f2c49fe6ed44ac5ad13a55b88dd0971
                                                                                                                                                                                      • Instruction ID: a1ffeb8dad59d1add64487a1fbb773f6b31f9e4f8bad584b91e48a0f096b711c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 13c7105583b4bafff51af941118006f09f2c49fe6ed44ac5ad13a55b88dd0971
                                                                                                                                                                                      • Instruction Fuzzy Hash: A0219622B08A4281EB50EB25F941269E361FF887C4FD84533DB4C83B69EFBCD5518711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A62F
                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A644
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A665
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A692
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A6A3
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A6B4
                                                                                                                                                                                      • SetLastError.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A6CF
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                      • Opcode ID: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
                                                                                                                                                                                      • Instruction ID: cc7d78e6064134ee8d494b4c52fb6b11e8b8dc3ea93953257f3ff73fda862956
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2621ED20A0C64281FB7877215667379E2515F88BB0F944636D97E076D6DEBCA4418732
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                      • String ID: CONOUT$
                                                                                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                                                                                      • Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
                                                                                                                                                                                      • Instruction ID: 990f302916d4bc9d83845b5ad6e1a37c38457b4a9299fdccc76a3b9a8a9e4946
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 79116321B18A41C6F751BB56E856339B3A0FB88FE4F844236EA5E87B94CFBCD4048751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A7A7
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A7DD
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A80A
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A81B
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A82C
                                                                                                                                                                                      • SetLastError.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A847
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                      • Opcode ID: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
                                                                                                                                                                                      • Instruction ID: 9110cb9d43fa90bf26f0c4225ed0c23171e4fffe7257860f02807169b14bf579
                                                                                                                                                                                      • Opcode Fuzzy Hash: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
                                                                                                                                                                                      • Instruction Fuzzy Hash: C3111D20E0C64282FB7877215A67379E1925F48BB0F944736E92E076D6DEBCE4428722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                      • String ID: csm$f
                                                                                                                                                                                      • API String ID: 2395640692-629598281
                                                                                                                                                                                      • Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
                                                                                                                                                                                      • Instruction ID: 8c4d3cb1481ec4a292faf98c3e9915f5e3983f22cd06e34d2a076dc43dc2872d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
                                                                                                                                                                                      • Instruction Fuzzy Hash: C251F232B0A60286DB94EF15E585B39B395FB44B88FD08132DE4A43788DFB8ED41C715
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                      • String ID: Unhandled exception in script
                                                                                                                                                                                      • API String ID: 3081866767-2699770090
                                                                                                                                                                                      • Opcode ID: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
                                                                                                                                                                                      • Instruction ID: 221038b6d76983a0d2bfe3c046beaad839c71ae57e59333d2e5c3c2b5f29f770
                                                                                                                                                                                      • Opcode Fuzzy Hash: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
                                                                                                                                                                                      • Instruction Fuzzy Hash: EC316372A08682C9EB24FF61E8562F9A360FF88794F840136EA4D4BB55DFBCD145C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E10474B0: GetLastError.KERNEL32(00000000,00007FF7E10426A0), ref: 00007FF7E10474D7
                                                                                                                                                                                        • Part of subcall function 00007FF7E10474B0: FormatMessageW.KERNEL32(00000000,00007FF7E10426A0), ref: 00007FF7E1047506
                                                                                                                                                                                        • Part of subcall function 00007FF7E1047A30: MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047A6A
                                                                                                                                                                                      • MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      • MessageBoxA.USER32 ref: 00007FF7E1042748
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                                                                                      • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                      • API String ID: 2806210788-2410924014
                                                                                                                                                                                      • Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
                                                                                                                                                                                      • Instruction ID: efa7e181a82984fa4fbc1e8e33f8b426d20a7d67907f12ef4b9c76ef823cc612
                                                                                                                                                                                      • Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7531037272868191E720FB50E4927EAA364FB84784FC05037EA8D07A99DFBCD645CB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                      • Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
                                                                                                                                                                                      • Instruction ID: 1ec82e94c70e57324290006cc0de4c0b7ecf7c5d1c08bc329898e5e0c4cd7855
                                                                                                                                                                                      • Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
                                                                                                                                                                                      • Instruction Fuzzy Hash: C4F06261B1960281EB20BB25E457379A370EF897A1FD80637DA6D456F4CFBCD489C322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _set_statfp
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1156100317-0
                                                                                                                                                                                      • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                      • Instruction ID: b7e265ab75e35932adf61afb21d9aff4207f132402890ff4cea304cc4555cef2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9C11BF72F18B1706F794B224F45337594416F583A4F840233EA6E06ED6CEBCADC141A2
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A87F
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A89E
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A8C6
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A8D7
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A8E8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                      • Opcode ID: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
                                                                                                                                                                                      • Instruction ID: 4e05def6f3cd5b2b266f23f9e6117f28049a5c3a8599d37b47945c6c1ed87bad
                                                                                                                                                                                      • Opcode Fuzzy Hash: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D113A20E0C24281FB78B325696737AE1916F447B0F844336E97E066D6DEBCE8428732
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A705
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A724
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A74C
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A75D
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A76E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                      • Opcode ID: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
                                                                                                                                                                                      • Instruction ID: ac551a065b830b550dfce25c81ace21a910c7194cd705075c5a156b09b00b218
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3011D624E0820782FB78B62158373BAE2925F45770F944737E93E0A2D2DDBCB4419233
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                      • API String ID: 3215553584-1196891531
                                                                                                                                                                                      • Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
                                                                                                                                                                                      • Instruction ID: adebee2020230fe1e16de74801ae4b1aaa847facf62756bf1977417e6712d778
                                                                                                                                                                                      • Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 56819676E0D20287F7747E2581223F8BB90AB11B88FD58037CA4997696DFBDE5019723
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                                                                                      • Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
                                                                                                                                                                                      • Instruction ID: fd5ee2b284d1de3ec6a13d0e21df4cc1bd082bb31733233e610f358e93b21a64
                                                                                                                                                                                      • Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
                                                                                                                                                                                      • Instruction Fuzzy Hash: D1615A32A08B458AE710AF65D4813ADB7A0FB44B88F544236EF4D17B98CBBCE155C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                      • String ID: csm$csm
                                                                                                                                                                                      • API String ID: 3896166516-3733052814
                                                                                                                                                                                      • Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
                                                                                                                                                                                      • Instruction ID: fdb8ecf6dff1b6299dc37f3b29885f68c9655a1b7a75060e5af4ba9da59be0de
                                                                                                                                                                                      • Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
                                                                                                                                                                                      • Instruction Fuzzy Hash: CC51C47290834286EB74AF159185378B7A1FB58B88F944137EA8C47BD5DFBCE450CB22
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                      • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                      • API String ID: 1878133881-2410924014
                                                                                                                                                                                      • Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
                                                                                                                                                                                      • Instruction ID: bbafb996333b03628a94466efdfc3d0bb7db2290c24b9199a6e48fbbfa58f02e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D31327272868191E720FB50E4527EAA365FB84784FC04037EA8D47A99DFBCD345CB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,00007FF7E1043699), ref: 00007FF7E1043BD1
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFileLastMessageModuleName
                                                                                                                                                                                      • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                      • API String ID: 2581892565-1977442011
                                                                                                                                                                                      • Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
                                                                                                                                                                                      • Instruction ID: c1f5c144d17d1ab88ef6418fac51fbd60d8f2056facc858d1333968207ec2272
                                                                                                                                                                                      • Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 19018421B1C652C5FB21B721E8873B99251AF48384FC01033D94E8A682EEFCE1448732
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2718003287-0
                                                                                                                                                                                      • Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
                                                                                                                                                                                      • Instruction ID: 2b71122a381e2bd1ae5bae1ce07fcaef6a5d526db142abc6ab7fa58eccbbe4df
                                                                                                                                                                                      • Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 22D10232B18A8489E720DF75D4513AC77B2FB04B98B848236DF4E97B99DE78E406C311
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1956198572-0
                                                                                                                                                                                      • Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                      • Instruction ID: 544960a468427fb05dc0d735dc098ec5587fcdaa55b85dd410e8450e4b0db253
                                                                                                                                                                                      • Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                      • Instruction Fuzzy Hash: F211A921F1815282F754B769F5863B99292EF997C0FC48032FA4D06B9ECEBCE4C58211
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: ?
                                                                                                                                                                                      • API String ID: 1286766494-1684325040
                                                                                                                                                                                      • Opcode ID: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
                                                                                                                                                                                      • Instruction ID: 57fe290d97e32099b002e067e6475cba0f765b326356dc1fcb04aea0299d0aa1
                                                                                                                                                                                      • Opcode Fuzzy Hash: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7F41F612F0C28246FB60BB25941237AA690EF90BB4F944236EE5C46ED9DE7CD4518712
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E1057E9E
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E2E
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: GetLastError.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E38
                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E104B105), ref: 00007FF7E1057EBC
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                      • API String ID: 2553983749-4189964347
                                                                                                                                                                                      • Opcode ID: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
                                                                                                                                                                                      • Instruction ID: 0c699488ec86dad6203cb404ba39430607e02e8dd616a155af412b1364390228
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
                                                                                                                                                                                      • Instruction Fuzzy Hash: DD419032A08B5285EB25FF2195622FCA7A4FB44780BD44037E90E47B85DF7CE841D322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                      • String ID: U
                                                                                                                                                                                      • API String ID: 442123175-4171548499
                                                                                                                                                                                      • Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
                                                                                                                                                                                      • Instruction ID: 9c00c37599600af74c3c2e29d961efc69dd9fa040068affc255538df5b71ee02
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B41B432718A8182DB60EF65E4553A9B7A5FB88784FC04036EE4D87794DF7CD441C751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentDirectory
                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                      • API String ID: 1611563598-336475711
                                                                                                                                                                                      • Opcode ID: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
                                                                                                                                                                                      • Instruction ID: 641d4aa8831fc045b598fb4019b01a388a3e2f3c1fc80c7c6e7b63e201f098e9
                                                                                                                                                                                      • Opcode Fuzzy Hash: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0621A562A0864181FB30AB15D46636DF3A1FB84B88FC54036D68D43684EFBCE9458762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                      • String ID: Error detected
                                                                                                                                                                                      • API String ID: 1878133881-3513342764
                                                                                                                                                                                      • Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
                                                                                                                                                                                      • Instruction ID: 10a4c9e9767edb0b1bd89b155d9f50fb8a1ffc07309f1bb0736d6a93818f678b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B21747272868291FB21BB10F4927EAA354FB84788FC05137EA8D47A95DFBCD205C761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                      • String ID: Fatal error detected
                                                                                                                                                                                      • API String ID: 1878133881-4025702859
                                                                                                                                                                                      • Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
                                                                                                                                                                                      • Instruction ID: 5c1bcd0a3bcd35285378503e243c047af77d28bd405a0f1e1b048941f4b98dfc
                                                                                                                                                                                      • Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
                                                                                                                                                                                      • Instruction Fuzzy Hash: DC21627272868291FB20BB50F4927EAA354FB84788FC05136EA8D47A95DFBCD205C761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                      • API String ID: 2573137834-1018135373
                                                                                                                                                                                      • Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
                                                                                                                                                                                      • Instruction ID: f72965a12610cc07d2e318d93197db78eb1aa9975ed957d0dc45d3f4e31fe81a
                                                                                                                                                                                      • Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
                                                                                                                                                                                      • Instruction Fuzzy Hash: FA115E32608B8182EB219F19F540369B7A4FB88B94F584232EF8C07B68DF7DD551CB00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.3070299870.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.3070255243.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070384306.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070452600.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.3070554575.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                      • API String ID: 2595371189-336475711
                                                                                                                                                                                      • Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
                                                                                                                                                                                      • Instruction ID: 53c40a3d0911439521d1c3e37856dccac92930accf0daa8759a149ff65235325
                                                                                                                                                                                      • Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A01712191820286FB31BB6094633BEA3A0EF44704FC42037E64D82691DEBCD5449A26
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                      Execution Coverage:3.8%
                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                      Total number of Limit Nodes:35
                                                                                                                                                                                      execution_graph 117212 7ffdfaecc3c9 117213 7ffdfaf41930 36 API calls 117212->117213 117214 7ffdfaecc3d7 117213->117214 117215 7ffdfaf41930 36 API calls 117214->117215 117216 7ffdfaecc415 117215->117216 117217 7ffdfaf41930 36 API calls 117216->117217 117218 7ffdfaecc448 117217->117218 117219 7ffdfaf41930 36 API calls 117218->117219 117220 7ffdfaecc47b 117219->117220 117221 7ffdfaf41930 36 API calls 117220->117221 117222 7ffdfaecc52d 117221->117222 117223 7ffdfafd0f20 28 API calls 117222->117223 117258 7ffdfaecc684 117222->117258 117223->117258 117224 7ffdfaecc691 117225 7ffdfaecd2d6 117224->117225 117240 7ffdfaecd554 117224->117240 117230 7ffdfaecd38e 117225->117230 117337 7ffdfaf8c690 181 API calls 117225->117337 117227 7ffdfaecd3ce 117228 7ffdfaecd3ea 117227->117228 117339 7ffdfafd0c00 28 API calls 117227->117339 117229 7ffdfaecd456 117228->117229 117340 7ffdfafd0c00 28 API calls 117228->117340 117233 7ffdfaecd470 117229->117233 117342 7ffdfafd0c00 28 API calls 117229->117342 117230->117227 117338 7ffdfafa4170 53 API calls 117230->117338 117241 7ffdfaecd4b3 117233->117241 117343 7ffdfafa4170 53 API calls 117233->117343 117235 7ffdfaecd44c 117341 7ffdfafd0c00 28 API calls 117235->117341 117239 7ffdfaecd632 117240->117239 117344 7ffdfafd0c00 28 API calls 117240->117344 117244 7ffdfafba870 36 API calls 117244->117258 117245 7ffdfaf81760 167 API calls 117245->117258 117249 7ffdfafbf9c0 29 API calls 117249->117258 117251 7ffdfaecd26d 117336 7ffdfafa4170 53 API calls 117251->117336 117256 7ffdfafa4170 53 API calls 117256->117258 117257 7ffdfafd0c00 28 API calls 117257->117258 117258->117224 117258->117240 117258->117244 117258->117245 117258->117249 117258->117251 117258->117256 117258->117257 117259 7ffdfafab4f0 117258->117259 117276 7ffdfaecaed0 117258->117276 117282 7ffdfaecb470 117258->117282 117316 7ffdfafc2d10 167 API calls 117258->117316 117317 7ffdfafa3570 52 API calls 117258->117317 117318 7ffdfafbb210 167 API calls 117258->117318 117319 7ffdfafa4370 29 API calls 117258->117319 117320 7ffdfafc0450 117258->117320 117274 7ffdfafab568 117259->117274 117260 7ffdfafab9c9 117260->117258 117261 7ffdfafab96d 117261->117260 117262 7ffdfafab9ae 117261->117262 117348 7ffdfafba7c0 53 API calls 117261->117348 117262->117260 117351 7ffdfafa4170 53 API calls 117262->117351 117265 7ffdfafab982 117268 7ffdfafab99f 117265->117268 117349 7ffdfafa34c0 52 API calls 117265->117349 117268->117262 117350 7ffdfafd0c00 28 API calls 117268->117350 117269 7ffdfafbf9c0 29 API calls 117269->117274 117271 7ffdfafc0450 65 API calls 117271->117274 117273 7ffdfafba870 36 API calls 117273->117274 117274->117260 117274->117261 117274->117269 117274->117271 117274->117273 117345 7ffdfaeca950 167 API calls 117274->117345 117346 7ffdfafa9940 16 API calls 117274->117346 117347 7ffdfafd0d50 TlsGetValue 117274->117347 117277 7ffdfaecaf05 117276->117277 117278 7ffdfaecaefa 117276->117278 117277->117278 117279 7ffdfafd0f20 28 API calls 117277->117279 117280 7ffdfaecaf79 117278->117280 117281 7ffdfafd0f20 28 API calls 117278->117281 117279->117278 117280->117258 117281->117280 117283 7ffdfaecb48f 117282->117283 117287 7ffdfaecb494 117282->117287 117284 7ffdfafba870 36 API calls 117283->117284 117284->117287 117285 7ffdfaecb50a 117285->117258 117287->117285 117352 7ffdfaee60a7 117287->117352 117392 7ffdfaee696b 117287->117392 117456 7ffdfaee68e5 117287->117456 117523 7ffdfaee60ec 117287->117523 117563 7ffdfaee68eb 117287->117563 117630 7ffdfaee75b0 117287->117630 117676 7ffdfaedc470 117287->117676 117698 7ffdfaee60e7 117287->117698 117738 7ffdfaee60f4 117287->117738 117778 7ffdfaee60b7 117287->117778 117818 7ffdfaee68f2 117287->117818 117885 7ffdfaee67a0 117287->117885 117952 7ffdfaee60f9 117287->117952 117992 7ffdfaedbf00 117287->117992 118023 7ffdfaee60dc 117287->118023 118063 7ffdfaee60c7 117287->118063 118103 7ffdfaee5f80 117287->118103 118143 7ffdfaee68d0 117287->118143 118210 7ffdfaee68ca 117287->118210 118277 7ffdfaee61b1 117287->118277 118317 7ffdfaedc110 117287->118317 118330 7ffdfaee60ff 117287->118330 118374 7ffdfaedbd40 117287->118374 118387 7ffdfaee60d7 117287->118387 118427 7ffdfaee68dc 117287->118427 118494 7ffdfaedbd90 117287->118494 118507 7ffdfaee68d6 117287->118507 118574 7ffdfaedc6a0 117287->118574 118579 7ffdfafd10d0 24 API calls 117287->118579 117316->117258 117317->117258 117318->117258 117319->117258 117325 7ffdfafc047a 117320->117325 117321 7ffdfafc05d5 117324 7ffdfafc0450 65 API calls 117321->117324 117322 7ffdfafc0576 117328 7ffdfafc0a10 57 API calls 117322->117328 117323 7ffdfafc054d 117323->117322 117326 7ffdfafc0566 117323->117326 117327 7ffdfafc0608 117324->117327 117325->117321 117325->117323 117335 7ffdfafc05a6 117325->117335 119986 7ffdfafc09c0 30 API calls 117326->119986 117327->117258 117330 7ffdfafc0574 117328->117330 117331 7ffdfafc05a8 117330->117331 117333 7ffdfafc0598 117330->117333 117330->117335 117332 7ffdfafc0a10 57 API calls 117331->117332 117332->117335 119987 7ffdfafc09c0 30 API calls 117333->119987 117335->117258 117336->117224 117337->117230 117338->117230 117339->117228 117340->117235 117341->117229 117342->117233 117343->117241 117344->117240 117345->117274 117346->117274 117348->117265 117349->117268 117350->117262 117351->117260 117353 7ffdfaee5fe0 117352->117353 117354 7ffdfaee6283 117353->117354 117356 7ffdfaee61de 117353->117356 117363 7ffdfaee65b9 117353->117363 117364 7ffdfaee6195 117353->117364 117355 7ffdfaee6288 117354->117355 117360 7ffdfaee62bc 117354->117360 117357 7ffdfafb90e0 267 API calls 117355->117357 117358 7ffdfafd0f20 28 API calls 117356->117358 117359 7ffdfaee6296 117357->117359 117369 7ffdfaee61e3 117358->117369 117359->117364 118586 7ffdfafb9190 179 API calls 117359->118586 117361 7ffdfaee6317 117360->117361 117362 7ffdfaee62e6 117360->117362 118587 7ffdfafddd20 201 API calls 117360->118587 118580 7ffdfafb90e0 117361->118580 117362->117361 118588 7ffdfafa4170 53 API calls 117362->118588 117363->117287 117364->117363 118595 7ffdfafa4170 53 API calls 117364->118595 117369->117363 118584 7ffdfafba7c0 53 API calls 117369->118584 117371 7ffdfaee6253 118585 7ffdfafbb210 167 API calls 117371->118585 117374 7ffdfaee6331 117374->117363 117380 7ffdfafd0f20 28 API calls 117374->117380 117385 7ffdfafa5620 34 API calls 117374->117385 117387 7ffdfaee6591 117374->117387 117388 7ffdfaee66c4 117374->117388 118589 7ffdfafbfc30 memmove TlsGetValue 117374->118589 118590 7ffdfafb8e40 178 API calls 117374->118590 118591 7ffdfafd0c00 28 API calls 117374->118591 118592 7ffdfafbfe00 44 API calls 117374->118592 118593 7ffdfaf7fff0 167 API calls 117374->118593 118596 7ffdfafe1390 207 API calls 117374->118596 117377 7ffdfaee66e0 117377->117363 118597 7ffdfafa5620 117377->118597 117378 7ffdfaee6708 118626 7ffdfafba7c0 53 API calls 117378->118626 117380->117374 117385->117374 117387->117364 118594 7ffdfafa4170 53 API calls 117387->118594 117388->117363 117388->117377 117388->117378 117393 7ffdfaee696d 117392->117393 117397 7ffdfaee6990 117393->117397 117398 7ffdfaee739a 117393->117398 117394 7ffdfaee6dca 117396 7ffdfafb90e0 267 API calls 117394->117396 117395 7ffdfaee7396 117395->117287 117401 7ffdfaee6dde 117396->117401 117399 7ffdfaee69ea 117397->117399 117402 7ffdfaee69b0 117397->117402 119315 7ffdfafddd20 201 API calls 117397->119315 117398->117395 119337 7ffdfafa4170 53 API calls 117398->119337 117399->117394 117400 7ffdfaee6a1e strpbrk 117399->117400 117400->117394 117404 7ffdfaee6a37 117400->117404 117401->117395 117409 7ffdfaee6e09 117401->117409 119325 7ffdfafa4370 29 API calls 117401->119325 117402->117399 119316 7ffdfafa4170 53 API calls 117402->119316 117406 7ffdfaee6a49 strpbrk 117404->117406 117406->117394 117412 7ffdfaee6a62 117406->117412 117410 7ffdfaee6e3b 117409->117410 119326 7ffdfafc33d0 memmove TlsGetValue 117409->119326 117416 7ffdfaee6e62 117410->117416 119327 7ffdfafa4370 29 API calls 117410->119327 117413 7ffdfaee6aae 117412->117413 119317 7ffdfafc33d0 memmove TlsGetValue 117412->119317 117420 7ffdfaee6aef 117413->117420 119318 7ffdfafc33d0 memmove TlsGetValue 117413->119318 117455 7ffdfaee6e9b 117416->117455 119328 7ffdfafc33d0 memmove TlsGetValue 117416->119328 117419 7ffdfaee6b34 117423 7ffdfaee6d04 117419->117423 117450 7ffdfaee6b4f 117419->117450 117420->117419 119319 7ffdfafc33d0 memmove TlsGetValue 117420->119319 117421 7ffdfaee72d3 117434 7ffdfaee6cc2 117423->117434 119321 7ffdfafbfac0 35 API calls 117423->119321 117426 7ffdfaee7296 117426->117421 117429 7ffdfafa5620 34 API calls 117426->117429 117435 7ffdfaee72f7 117426->117435 117429->117421 117432 7ffdfaee725f 117433 7ffdfaee72db 117432->117433 117432->117434 117433->117435 117434->117426 119331 7ffdfafc0610 64 API calls 117434->119331 117437 7ffdfafc0610 64 API calls 117437->117455 117438 7ffdfaee740d 117441 7ffdfafd0f20 28 API calls 117441->117455 117443 7ffdfafd0f20 28 API calls 117443->117450 117447 7ffdfaee6d27 117447->117434 117447->117438 117448 7ffdfafc0610 64 API calls 117448->117450 117450->117434 117450->117443 117450->117448 119320 7ffdfafc0340 29 API calls 117450->119320 117453 7ffdfafc0870 30 API calls 117453->117455 117454 7ffdfafc36f0 56 API calls 117454->117455 117455->117426 117455->117432 117455->117434 117455->117437 117455->117438 117455->117441 117455->117453 117455->117454 119278 7ffdfaebd510 TlsGetValue 117455->119278 119329 7ffdfafc33d0 memmove TlsGetValue 117455->119329 119330 7ffdfafc0340 29 API calls 117455->119330 117463 7ffdfaee680f 117456->117463 117457 7ffdfaee696d 117461 7ffdfaee6990 117457->117461 117462 7ffdfaee739a 117457->117462 117458 7ffdfaee6dca 117460 7ffdfafb90e0 267 API calls 117458->117460 117459 7ffdfaee7396 117459->117287 117466 7ffdfaee6dde 117460->117466 117464 7ffdfaee69ea 117461->117464 117467 7ffdfaee69b0 117461->117467 119352 7ffdfafddd20 201 API calls 117461->119352 117462->117459 119374 7ffdfafa4170 53 API calls 117462->119374 117463->117457 117463->117462 117468 7ffdfaee73e9 117463->117468 119350 7ffdfafddd20 201 API calls 117463->119350 119351 7ffdfafa4170 53 API calls 117463->119351 117464->117458 117465 7ffdfaee6a1e strpbrk 117464->117465 117465->117458 117470 7ffdfaee6a37 117465->117470 117466->117459 117475 7ffdfaee6e09 117466->117475 119362 7ffdfafa4370 29 API calls 117466->119362 117467->117464 119353 7ffdfafa4170 53 API calls 117467->119353 117472 7ffdfaee6a49 strpbrk 117470->117472 117472->117458 117479 7ffdfaee6a62 117472->117479 117476 7ffdfaee6e3b 117475->117476 119363 7ffdfafc33d0 memmove TlsGetValue 117475->119363 117484 7ffdfaee6e62 117476->117484 119364 7ffdfafa4370 29 API calls 117476->119364 117483 7ffdfaee6aae 117479->117483 119354 7ffdfafc33d0 memmove TlsGetValue 117479->119354 117488 7ffdfaee6aef 117483->117488 119355 7ffdfafc33d0 memmove TlsGetValue 117483->119355 117520 7ffdfaee6e9b 117484->117520 119365 7ffdfafc33d0 memmove TlsGetValue 117484->119365 117487 7ffdfaee6b34 117491 7ffdfaee6d04 117487->117491 117510 7ffdfaee6b4f 117487->117510 117488->117487 119356 7ffdfafc33d0 memmove TlsGetValue 117488->119356 117502 7ffdfaee6cc2 117491->117502 117494 7ffdfaee7296 117496 7ffdfaebd510 62 API calls 117496->117520 117500 7ffdfaee725f 117500->117502 117502->117494 117507 7ffdfafd0f20 28 API calls 117507->117520 117509 7ffdfafd0f20 28 API calls 117509->117510 117510->117502 117510->117509 117516 7ffdfafc0610 64 API calls 117510->117516 119357 7ffdfafc0340 29 API calls 117510->119357 117516->117510 117519 7ffdfafc0610 64 API calls 117519->117520 117520->117468 117520->117494 117520->117496 117520->117500 117520->117502 117520->117507 117520->117519 117521 7ffdfafc0870 30 API calls 117520->117521 117522 7ffdfafc36f0 56 API calls 117520->117522 119366 7ffdfafc33d0 memmove TlsGetValue 117520->119366 119367 7ffdfafc0340 29 API calls 117520->119367 117521->117520 117522->117520 117524 7ffdfaee5fe0 117523->117524 117525 7ffdfaee6283 117524->117525 117527 7ffdfaee61de 117524->117527 117531 7ffdfaee65b9 117524->117531 117535 7ffdfaee6195 117524->117535 117526 7ffdfaee6288 117525->117526 117532 7ffdfaee62bc 117525->117532 117528 7ffdfafb90e0 267 API calls 117526->117528 117529 7ffdfafd0f20 28 API calls 117527->117529 117530 7ffdfaee6296 117528->117530 117540 7ffdfaee61e3 117529->117540 117530->117535 119377 7ffdfafb9190 179 API calls 117530->119377 117531->117287 117533 7ffdfaee6317 117532->117533 117534 7ffdfaee62e6 117532->117534 119378 7ffdfafddd20 201 API calls 117532->119378 117537 7ffdfafb90e0 267 API calls 117533->117537 117534->117533 119379 7ffdfafa4170 53 API calls 117534->119379 117535->117531 119386 7ffdfafa4170 53 API calls 117535->119386 117561 7ffdfaee6331 117537->117561 117540->117531 119375 7ffdfafba7c0 53 API calls 117540->119375 117542 7ffdfaee6253 119376 7ffdfafbb210 167 API calls 117542->119376 117547 7ffdfaee66c4 117547->117531 117548 7ffdfaee66e0 117547->117548 117549 7ffdfaee6708 117547->117549 117548->117531 117551 7ffdfafa5620 34 API calls 117548->117551 119389 7ffdfafba7c0 53 API calls 117549->119389 117552 7ffdfaee66ec 117551->117552 119388 7ffdfafba7c0 53 API calls 117552->119388 117555 7ffdfafd0f20 28 API calls 117555->117561 117556 7ffdfafa5620 34 API calls 117556->117561 117558 7ffdfaee6591 117558->117535 119385 7ffdfafa4170 53 API calls 117558->119385 117561->117531 117561->117547 117561->117555 117561->117556 117561->117558 119380 7ffdfafbfc30 memmove TlsGetValue 117561->119380 119381 7ffdfafb8e40 178 API calls 117561->119381 119382 7ffdfafd0c00 28 API calls 117561->119382 119383 7ffdfafbfe00 44 API calls 117561->119383 119384 7ffdfaf7fff0 167 API calls 117561->119384 119387 7ffdfafe1390 207 API calls 117561->119387 117570 7ffdfaee680f 117563->117570 117564 7ffdfaee696d 117568 7ffdfaee6990 117564->117568 117569 7ffdfaee739a 117564->117569 117565 7ffdfaee6dca 117567 7ffdfafb90e0 267 API calls 117565->117567 117566 7ffdfaee7396 117566->117287 117573 7ffdfaee6dde 117567->117573 117571 7ffdfaee69ea 117568->117571 117574 7ffdfaee69b0 117568->117574 119392 7ffdfafddd20 201 API calls 117568->119392 117569->117566 119414 7ffdfafa4170 53 API calls 117569->119414 117570->117564 117570->117569 117575 7ffdfaee73e9 117570->117575 119390 7ffdfafddd20 201 API calls 117570->119390 119391 7ffdfafa4170 53 API calls 117570->119391 117571->117565 117572 7ffdfaee6a1e strpbrk 117571->117572 117572->117565 117577 7ffdfaee6a37 117572->117577 117573->117566 117582 7ffdfaee6e09 117573->117582 119402 7ffdfafa4370 29 API calls 117573->119402 117574->117571 119393 7ffdfafa4170 53 API calls 117574->119393 117579 7ffdfaee6a49 strpbrk 117577->117579 117579->117565 117586 7ffdfaee6a62 117579->117586 117583 7ffdfaee6e3b 117582->117583 119403 7ffdfafc33d0 memmove TlsGetValue 117582->119403 117591 7ffdfaee6e62 117583->117591 119404 7ffdfafa4370 29 API calls 117583->119404 117590 7ffdfaee6aae 117586->117590 119394 7ffdfafc33d0 memmove TlsGetValue 117586->119394 117595 7ffdfaee6aef 117590->117595 119395 7ffdfafc33d0 memmove TlsGetValue 117590->119395 117606 7ffdfaee6e9b 117591->117606 119405 7ffdfafc33d0 memmove TlsGetValue 117591->119405 117594 7ffdfaee6b34 117598 7ffdfaee6d04 117594->117598 117610 7ffdfaee6b4f 117594->117610 117595->117594 119396 7ffdfafc33d0 memmove TlsGetValue 117595->119396 117599 7ffdfaee6cc2 117598->117599 117602 7ffdfaee7296 117599->117602 117604 7ffdfaebd510 62 API calls 117604->117606 117606->117575 117606->117599 117606->117602 117606->117604 117609 7ffdfaee725f 117606->117609 117617 7ffdfafd0f20 28 API calls 117606->117617 117627 7ffdfafc0610 64 API calls 117606->117627 117628 7ffdfafc0870 30 API calls 117606->117628 117629 7ffdfafc36f0 56 API calls 117606->117629 119406 7ffdfafc33d0 memmove TlsGetValue 117606->119406 119407 7ffdfafc0340 29 API calls 117606->119407 117609->117599 117610->117599 117617->117606 117627->117606 117628->117606 117629->117606 117631 7ffdfaee75d1 117630->117631 117633 7ffdfaee75f8 117630->117633 117631->117287 117632 7ffdfaee7644 117632->117287 117633->117632 117675 7ffdfaf74f40 117633->117675 119415 7ffdfaf77420 117633->119415 117635 7ffdfb01ae00 8 API calls 117638 7ffdfaf75160 117635->117638 117636 7ffdfaf74ebb 117637 7ffdfaf750d5 _errno 117636->117637 117639 7ffdfaf74ed1 117636->117639 117640 7ffdfaf750e1 _errno _errno 117637->117640 117638->117287 117639->117640 117644 7ffdfaf74ee5 117639->117644 117641 7ffdfaf750f1 _errno 117640->117641 119455 7ffdfafb5010 strerror 117641->119455 117644->117641 117650 7ffdfaf74f09 117644->117650 117651 7ffdfafa3a00 28 API calls 117650->117651 117650->117675 117653 7ffdfaf74f55 117651->117653 119448 7ffdfaf67e10 117653->119448 117675->117635 117677 7ffdfaedc4ad 117676->117677 117680 7ffdfaedc486 117676->117680 119553 7ffdfaf77580 117677->119553 117679 7ffdfaedc4b6 117681 7ffdfaedc56b 117679->117681 117682 7ffdfaedc4bf 117679->117682 117680->117287 119619 7ffdfafba7c0 53 API calls 117681->119619 117683 7ffdfafd0f20 28 API calls 117682->117683 117685 7ffdfaedc4c9 117683->117685 117687 7ffdfaedc4e8 117685->117687 117688 7ffdfaedc583 117685->117688 117686 7ffdfaedc576 117686->117287 119617 7ffdfafba7c0 53 API calls 117687->119617 117691 7ffdfaedc5b2 117688->117691 119571 7ffdfafacdf0 117688->119571 117690 7ffdfaedc522 117691->117287 117699 7ffdfaee5fe0 117698->117699 117700 7ffdfaee6195 117699->117700 117701 7ffdfaee6283 117699->117701 117703 7ffdfaee61de 117699->117703 117707 7ffdfaee65b9 117699->117707 117700->117707 119679 7ffdfafa4170 53 API calls 117700->119679 117702 7ffdfaee6288 117701->117702 117709 7ffdfaee62bc 117701->117709 117704 7ffdfafb90e0 267 API calls 117702->117704 117705 7ffdfafd0f20 28 API calls 117703->117705 117706 7ffdfaee6296 117704->117706 117715 7ffdfaee61e3 117705->117715 117706->117700 119670 7ffdfafb9190 179 API calls 117706->119670 117707->117287 117708 7ffdfaee6317 117712 7ffdfafb90e0 267 API calls 117708->117712 117709->117708 117710 7ffdfaee62e6 117709->117710 119671 7ffdfafddd20 201 API calls 117709->119671 117710->117708 119672 7ffdfafa4170 53 API calls 117710->119672 117736 7ffdfaee6331 117712->117736 117715->117707 119668 7ffdfafba7c0 53 API calls 117715->119668 117717 7ffdfaee6253 119669 7ffdfafbb210 167 API calls 117717->119669 117722 7ffdfaee66c4 117722->117707 117723 7ffdfaee66e0 117722->117723 117724 7ffdfaee6708 117722->117724 117723->117707 117726 7ffdfafa5620 34 API calls 117723->117726 119682 7ffdfafba7c0 53 API calls 117724->119682 117727 7ffdfaee66ec 117726->117727 119681 7ffdfafba7c0 53 API calls 117727->119681 117730 7ffdfafd0f20 28 API calls 117730->117736 117731 7ffdfafa5620 34 API calls 117731->117736 117733 7ffdfaee6591 117733->117700 119678 7ffdfafa4170 53 API calls 117733->119678 117736->117707 117736->117722 117736->117730 117736->117731 117736->117733 119673 7ffdfafbfc30 memmove TlsGetValue 117736->119673 119674 7ffdfafb8e40 178 API calls 117736->119674 119675 7ffdfafd0c00 28 API calls 117736->119675 119676 7ffdfafbfe00 44 API calls 117736->119676 119677 7ffdfaf7fff0 167 API calls 117736->119677 119680 7ffdfafe1390 207 API calls 117736->119680 117739 7ffdfaee5fe0 117738->117739 117740 7ffdfaee6283 117739->117740 117742 7ffdfaee61de 117739->117742 117746 7ffdfaee65b9 117739->117746 117750 7ffdfaee6195 117739->117750 117741 7ffdfaee6288 117740->117741 117747 7ffdfaee62bc 117740->117747 117743 7ffdfafb90e0 267 API calls 117741->117743 117744 7ffdfafd0f20 28 API calls 117742->117744 117745 7ffdfaee6296 117743->117745 117755 7ffdfaee61e3 117744->117755 117745->117750 119685 7ffdfafb9190 179 API calls 117745->119685 117746->117287 117748 7ffdfaee6317 117747->117748 117749 7ffdfaee62e6 117747->117749 119686 7ffdfafddd20 201 API calls 117747->119686 117752 7ffdfafb90e0 267 API calls 117748->117752 117749->117748 119687 7ffdfafa4170 53 API calls 117749->119687 117750->117746 119694 7ffdfafa4170 53 API calls 117750->119694 117776 7ffdfaee6331 117752->117776 117755->117746 119683 7ffdfafba7c0 53 API calls 117755->119683 117757 7ffdfaee6253 119684 7ffdfafbb210 167 API calls 117757->119684 117762 7ffdfaee66c4 117762->117746 117763 7ffdfaee66e0 117762->117763 117764 7ffdfaee6708 117762->117764 117763->117746 117767 7ffdfafa5620 34 API calls 117763->117767 119697 7ffdfafba7c0 53 API calls 117764->119697 117766 7ffdfafd0f20 28 API calls 117766->117776 117768 7ffdfaee66ec 117767->117768 119696 7ffdfafba7c0 53 API calls 117768->119696 117771 7ffdfafa5620 34 API calls 117771->117776 117773 7ffdfaee6591 117773->117750 119693 7ffdfafa4170 53 API calls 117773->119693 117776->117746 117776->117762 117776->117766 117776->117771 117776->117773 119688 7ffdfafbfc30 memmove TlsGetValue 117776->119688 119689 7ffdfafb8e40 178 API calls 117776->119689 119690 7ffdfafd0c00 28 API calls 117776->119690 119691 7ffdfafbfe00 44 API calls 117776->119691 119692 7ffdfaf7fff0 167 API calls 117776->119692 119695 7ffdfafe1390 207 API calls 117776->119695 117779 7ffdfaee5fe0 117778->117779 117780 7ffdfaee6283 117779->117780 117782 7ffdfaee61de 117779->117782 117789 7ffdfaee65b9 117779->117789 117790 7ffdfaee6195 117779->117790 117781 7ffdfaee6288 117780->117781 117786 7ffdfaee62bc 117780->117786 117783 7ffdfafb90e0 267 API calls 117781->117783 117784 7ffdfafd0f20 28 API calls 117782->117784 117785 7ffdfaee6296 117783->117785 117795 7ffdfaee61e3 117784->117795 117785->117790 119700 7ffdfafb9190 179 API calls 117785->119700 117787 7ffdfaee6317 117786->117787 117788 7ffdfaee62e6 117786->117788 119701 7ffdfafddd20 201 API calls 117786->119701 117792 7ffdfafb90e0 267 API calls 117787->117792 117788->117787 119702 7ffdfafa4170 53 API calls 117788->119702 117789->117287 117790->117789 119709 7ffdfafa4170 53 API calls 117790->119709 117816 7ffdfaee6331 117792->117816 117795->117789 119698 7ffdfafba7c0 53 API calls 117795->119698 117797 7ffdfaee6253 119699 7ffdfafbb210 167 API calls 117797->119699 117802 7ffdfaee66c4 117802->117789 117803 7ffdfaee66e0 117802->117803 117804 7ffdfaee6708 117802->117804 117803->117789 117807 7ffdfafa5620 34 API calls 117803->117807 119712 7ffdfafba7c0 53 API calls 117804->119712 117806 7ffdfafd0f20 28 API calls 117806->117816 117808 7ffdfaee66ec 117807->117808 119711 7ffdfafba7c0 53 API calls 117808->119711 117811 7ffdfafa5620 34 API calls 117811->117816 117813 7ffdfaee6591 117813->117790 119708 7ffdfafa4170 53 API calls 117813->119708 117816->117789 117816->117802 117816->117806 117816->117811 117816->117813 119703 7ffdfafbfc30 memmove TlsGetValue 117816->119703 119704 7ffdfafb8e40 178 API calls 117816->119704 119705 7ffdfafd0c00 28 API calls 117816->119705 119706 7ffdfafbfe00 44 API calls 117816->119706 119707 7ffdfaf7fff0 167 API calls 117816->119707 119710 7ffdfafe1390 207 API calls 117816->119710 117819 7ffdfaee696d 117818->117819 117835 7ffdfaee680f 117818->117835 117824 7ffdfaee6990 117819->117824 117825 7ffdfaee739a 117819->117825 117822 7ffdfaee6dca 117823 7ffdfafb90e0 267 API calls 117822->117823 117828 7ffdfaee6dde 117823->117828 117826 7ffdfaee69ea 117824->117826 117829 7ffdfaee69b0 117824->117829 119715 7ffdfafddd20 201 API calls 117824->119715 117864 7ffdfaee7396 117825->117864 119737 7ffdfafa4170 53 API calls 117825->119737 117826->117822 117827 7ffdfaee6a1e strpbrk 117826->117827 117827->117822 117831 7ffdfaee6a37 117827->117831 117837 7ffdfaee6e09 117828->117837 117828->117864 119725 7ffdfafa4370 29 API calls 117828->119725 117829->117826 119716 7ffdfafa4170 53 API calls 117829->119716 117833 7ffdfaee6a49 strpbrk 117831->117833 117833->117822 117841 7ffdfaee6a62 117833->117841 117835->117818 117835->117819 117835->117825 117839 7ffdfaee73e9 117835->117839 119713 7ffdfafddd20 201 API calls 117835->119713 119714 7ffdfafa4170 53 API calls 117835->119714 117838 7ffdfaee6e3b 117837->117838 119726 7ffdfafc33d0 memmove TlsGetValue 117837->119726 117845 7ffdfaee6e62 117838->117845 119727 7ffdfafa4370 29 API calls 117838->119727 117844 7ffdfaee6aae 117841->117844 119717 7ffdfafc33d0 memmove TlsGetValue 117841->119717 117849 7ffdfaee6aef 117844->117849 119718 7ffdfafc33d0 memmove TlsGetValue 117844->119718 117859 7ffdfaee6e9b 117845->117859 119728 7ffdfafc33d0 memmove TlsGetValue 117845->119728 117848 7ffdfaee6b34 117851 7ffdfaee6d04 117848->117851 117852 7ffdfaee6b4f 117848->117852 117849->117848 119719 7ffdfafc33d0 memmove TlsGetValue 117849->119719 117882 7ffdfaee6cc2 117851->117882 119721 7ffdfafbfac0 35 API calls 117851->119721 117872 7ffdfafd0f20 28 API calls 117852->117872 117877 7ffdfafc0610 64 API calls 117852->117877 117852->117882 119720 7ffdfafc0340 29 API calls 117852->119720 117853 7ffdfaee7296 117858 7ffdfafa5620 34 API calls 117853->117858 117860 7ffdfaee72d3 117853->117860 117868 7ffdfaee72f7 117853->117868 117857 7ffdfaebd510 62 API calls 117857->117859 117858->117860 117859->117839 117859->117853 117859->117857 117862 7ffdfaee725f 117859->117862 117870 7ffdfafd0f20 28 API calls 117859->117870 117881 7ffdfafc0610 64 API calls 117859->117881 117859->117882 117883 7ffdfafc0870 30 API calls 117859->117883 117884 7ffdfafc36f0 56 API calls 117859->117884 119729 7ffdfafc33d0 memmove TlsGetValue 117859->119729 119730 7ffdfafc0340 29 API calls 117859->119730 117863 7ffdfaee72db 117862->117863 117862->117882 117863->117868 117864->117287 117870->117859 117872->117852 117877->117852 117881->117859 117882->117853 119731 7ffdfafc0610 64 API calls 117882->119731 117883->117859 117884->117859 117886 7ffdfaee696d 117885->117886 117887 7ffdfaee680b 117885->117887 117891 7ffdfaee6990 117886->117891 117892 7ffdfaee739a 117886->117892 117887->117886 117889 7ffdfaee73e9 117887->117889 117887->117892 119738 7ffdfafddd20 201 API calls 117887->119738 119739 7ffdfafa4170 53 API calls 117887->119739 117888 7ffdfaee6dca 117890 7ffdfafb90e0 267 API calls 117888->117890 117898 7ffdfaee6dde 117890->117898 117895 7ffdfaee69ea 117891->117895 117899 7ffdfaee69b0 117891->117899 119740 7ffdfafddd20 201 API calls 117891->119740 117931 7ffdfaee7396 117892->117931 119762 7ffdfafa4170 53 API calls 117892->119762 117893 7ffdfaee6a1e strpbrk 117893->117888 117896 7ffdfaee6a37 117893->117896 117895->117888 117895->117893 117900 7ffdfaee6a49 strpbrk 117896->117900 117903 7ffdfaee6e09 117898->117903 117898->117931 119750 7ffdfafa4370 29 API calls 117898->119750 117899->117895 119741 7ffdfafa4170 53 API calls 117899->119741 117900->117888 117907 7ffdfaee6a62 117900->117907 117904 7ffdfaee6e3b 117903->117904 119751 7ffdfafc33d0 memmove TlsGetValue 117903->119751 117912 7ffdfaee6e62 117904->117912 119752 7ffdfafa4370 29 API calls 117904->119752 117911 7ffdfaee6aae 117907->117911 119742 7ffdfafc33d0 memmove TlsGetValue 117907->119742 117916 7ffdfaee6aef 117911->117916 119743 7ffdfafc33d0 memmove TlsGetValue 117911->119743 117949 7ffdfaee6e9b 117912->117949 119753 7ffdfafc33d0 memmove TlsGetValue 117912->119753 117915 7ffdfaee6b34 117919 7ffdfaee6d04 117915->117919 117944 7ffdfaee6b4f 117915->117944 117916->117915 119744 7ffdfafc33d0 memmove TlsGetValue 117916->119744 117917 7ffdfaee72d3 117930 7ffdfaee6cc2 117919->117930 119746 7ffdfafbfac0 35 API calls 117919->119746 117922 7ffdfaee7296 117922->117917 117925 7ffdfafa5620 34 API calls 117922->117925 117932 7ffdfaee72f7 117922->117932 117924 7ffdfaebd510 62 API calls 117924->117949 117925->117917 117928 7ffdfaee725f 117929 7ffdfaee72db 117928->117929 117928->117930 117929->117932 117930->117922 119756 7ffdfafc0610 64 API calls 117930->119756 117931->117287 117936 7ffdfafd0f20 28 API calls 117936->117949 117938 7ffdfafd0f20 28 API calls 117938->117944 117944->117930 117944->117938 117945 7ffdfafc0610 64 API calls 117944->117945 119745 7ffdfafc0340 29 API calls 117944->119745 117945->117944 117948 7ffdfafc0610 64 API calls 117948->117949 117949->117889 117949->117922 117949->117924 117949->117928 117949->117930 117949->117936 117949->117948 117950 7ffdfafc0870 30 API calls 117949->117950 117951 7ffdfafc36f0 56 API calls 117949->117951 119754 7ffdfafc33d0 memmove TlsGetValue 117949->119754 119755 7ffdfafc0340 29 API calls 117949->119755 117950->117949 117951->117949 117958 7ffdfaee5fe0 117952->117958 117953 7ffdfaee6283 117954 7ffdfaee6288 117953->117954 117961 7ffdfaee62bc 117953->117961 117956 7ffdfafb90e0 267 API calls 117954->117956 117955 7ffdfaee61de 117957 7ffdfafd0f20 28 API calls 117955->117957 117959 7ffdfaee6296 117956->117959 117969 7ffdfaee61e3 117957->117969 117958->117953 117958->117955 117960 7ffdfaee65b9 117958->117960 117964 7ffdfaee6195 117958->117964 117959->117964 119765 7ffdfafb9190 179 API calls 117959->119765 117960->117287 117962 7ffdfaee6317 117961->117962 117963 7ffdfaee62e6 117961->117963 119766 7ffdfafddd20 201 API calls 117961->119766 117966 7ffdfafb90e0 267 API calls 117962->117966 117963->117962 119767 7ffdfafa4170 53 API calls 117963->119767 117964->117960 119774 7ffdfafa4170 53 API calls 117964->119774 117990 7ffdfaee6331 117966->117990 117969->117960 119763 7ffdfafba7c0 53 API calls 117969->119763 117971 7ffdfaee6253 119764 7ffdfafbb210 167 API calls 117971->119764 117976 7ffdfaee66c4 117976->117960 117977 7ffdfaee66e0 117976->117977 117978 7ffdfaee6708 117976->117978 117977->117960 117980 7ffdfafa5620 34 API calls 117977->117980 119777 7ffdfafba7c0 53 API calls 117978->119777 117981 7ffdfaee66ec 117980->117981 119776 7ffdfafba7c0 53 API calls 117981->119776 117984 7ffdfafa5620 34 API calls 117984->117990 117986 7ffdfafd0f20 28 API calls 117986->117990 117987 7ffdfaee6591 117987->117964 119773 7ffdfafa4170 53 API calls 117987->119773 117990->117960 117990->117976 117990->117984 117990->117986 117990->117987 119768 7ffdfafbfc30 memmove TlsGetValue 117990->119768 119769 7ffdfafb8e40 178 API calls 117990->119769 119770 7ffdfafd0c00 28 API calls 117990->119770 119771 7ffdfafbfe00 44 API calls 117990->119771 119772 7ffdfaf7fff0 167 API calls 117990->119772 119775 7ffdfafe1390 207 API calls 117990->119775 117993 7ffdfaedbf12 117992->117993 117994 7ffdfaedbf34 117992->117994 117993->117287 117995 7ffdfaedbf6f GetNamedSecurityInfoW 117994->117995 117996 7ffdfaedc074 117995->117996 117997 7ffdfaedbfa6 GetCurrentProcess OpenProcessToken 117995->117997 117998 7ffdfafa5620 34 API calls 117996->117998 117999 7ffdfaedbfc5 GetTokenInformation 117997->117999 118000 7ffdfaedc057 117997->118000 118001 7ffdfaedc081 117998->118001 118002 7ffdfaedc04c CloseHandle 117999->118002 118008 7ffdfaedbff8 117999->118008 118003 7ffdfaedc067 118000->118003 118004 7ffdfaedc061 LocalFree 118000->118004 119786 7ffdfafba7c0 53 API calls 118001->119786 118002->118000 118003->117996 119785 7ffdfafd0c00 28 API calls 118003->119785 118004->118003 118006 7ffdfaedc08c 118006->117287 118009 7ffdfaedc00f GetTokenInformation 118008->118009 118011 7ffdfaedc0ae 118008->118011 118009->118002 118010 7ffdfaedc03b EqualSid 118009->118010 118010->118002 118012 7ffdfaedc0d3 118011->118012 119778 7ffdfafad720 118011->119778 118012->117287 118015 7ffdfaf77420 183 API calls 118017 7ffdfaedcb1d 118015->118017 118016 7ffdfafa5620 34 API calls 118018 7ffdfaedcb52 118016->118018 118019 7ffdfaedcb35 _errno 118017->118019 118021 7ffdfaedcb11 118017->118021 119787 7ffdfafba7c0 53 API calls 118018->119787 118019->118021 118021->118016 118029 7ffdfaee5fe0 118023->118029 118024 7ffdfaee6283 118025 7ffdfaee6288 118024->118025 118032 7ffdfaee62bc 118024->118032 118027 7ffdfafb90e0 267 API calls 118025->118027 118026 7ffdfaee61de 118028 7ffdfafd0f20 28 API calls 118026->118028 118030 7ffdfaee6296 118027->118030 118040 7ffdfaee61e3 118028->118040 118029->118024 118029->118026 118031 7ffdfaee65b9 118029->118031 118035 7ffdfaee6195 118029->118035 118030->118035 119792 7ffdfafb9190 179 API calls 118030->119792 118031->117287 118033 7ffdfaee6317 118032->118033 118034 7ffdfaee62e6 118032->118034 119793 7ffdfafddd20 201 API calls 118032->119793 118037 7ffdfafb90e0 267 API calls 118033->118037 118034->118033 119794 7ffdfafa4170 53 API calls 118034->119794 118035->118031 119801 7ffdfafa4170 53 API calls 118035->119801 118061 7ffdfaee6331 118037->118061 118040->118031 119790 7ffdfafba7c0 53 API calls 118040->119790 118042 7ffdfaee6253 119791 7ffdfafbb210 167 API calls 118042->119791 118047 7ffdfaee66c4 118047->118031 118048 7ffdfaee66e0 118047->118048 118049 7ffdfaee6708 118047->118049 118048->118031 118052 7ffdfafa5620 34 API calls 118048->118052 119804 7ffdfafba7c0 53 API calls 118049->119804 118051 7ffdfafd0f20 28 API calls 118051->118061 118053 7ffdfaee66ec 118052->118053 119803 7ffdfafba7c0 53 API calls 118053->119803 118056 7ffdfafa5620 34 API calls 118056->118061 118058 7ffdfaee6591 118058->118035 119800 7ffdfafa4170 53 API calls 118058->119800 118061->118031 118061->118047 118061->118051 118061->118056 118061->118058 119795 7ffdfafbfc30 memmove TlsGetValue 118061->119795 119796 7ffdfafb8e40 178 API calls 118061->119796 119797 7ffdfafd0c00 28 API calls 118061->119797 119798 7ffdfafbfe00 44 API calls 118061->119798 119799 7ffdfaf7fff0 167 API calls 118061->119799 119802 7ffdfafe1390 207 API calls 118061->119802 118067 7ffdfaee5fe0 118063->118067 118064 7ffdfaee6283 118065 7ffdfaee6288 118064->118065 118071 7ffdfaee62bc 118064->118071 118068 7ffdfafb90e0 267 API calls 118065->118068 118066 7ffdfaee61de 118069 7ffdfafd0f20 28 API calls 118066->118069 118067->118064 118067->118066 118074 7ffdfaee6195 118067->118074 118078 7ffdfaee65b9 118067->118078 118070 7ffdfaee6296 118068->118070 118080 7ffdfaee61e3 118069->118080 118070->118074 119807 7ffdfafb9190 179 API calls 118070->119807 118072 7ffdfaee6317 118071->118072 118073 7ffdfaee62e6 118071->118073 119808 7ffdfafddd20 201 API calls 118071->119808 118076 7ffdfafb90e0 267 API calls 118072->118076 118073->118072 119809 7ffdfafa4170 53 API calls 118073->119809 118074->118078 119816 7ffdfafa4170 53 API calls 118074->119816 118090 7ffdfaee6331 118076->118090 118078->117287 118080->118078 119805 7ffdfafba7c0 53 API calls 118080->119805 118082 7ffdfaee6253 119806 7ffdfafbb210 167 API calls 118082->119806 118087 7ffdfaee66c4 118087->118078 118088 7ffdfaee66e0 118087->118088 118089 7ffdfaee6708 118087->118089 118088->118078 118093 7ffdfafa5620 34 API calls 118088->118093 119819 7ffdfafba7c0 53 API calls 118089->119819 118090->118078 118090->118087 118092 7ffdfafd0f20 28 API calls 118090->118092 118097 7ffdfafa5620 34 API calls 118090->118097 118099 7ffdfaee6591 118090->118099 119810 7ffdfafbfc30 memmove TlsGetValue 118090->119810 119811 7ffdfafb8e40 178 API calls 118090->119811 119812 7ffdfafd0c00 28 API calls 118090->119812 119813 7ffdfafbfe00 44 API calls 118090->119813 119814 7ffdfaf7fff0 167 API calls 118090->119814 119817 7ffdfafe1390 207 API calls 118090->119817 118092->118090 118094 7ffdfaee66ec 118093->118094 119818 7ffdfafba7c0 53 API calls 118094->119818 118097->118090 118099->118074 119815 7ffdfafa4170 53 API calls 118099->119815 118112 7ffdfaee5fdb 118103->118112 118104 7ffdfaee6283 118105 7ffdfaee6288 118104->118105 118110 7ffdfaee62bc 118104->118110 118107 7ffdfafb90e0 267 API calls 118105->118107 118106 7ffdfaee61de 118108 7ffdfafd0f20 28 API calls 118106->118108 118109 7ffdfaee6296 118107->118109 118119 7ffdfaee61e3 118108->118119 118114 7ffdfaee6195 118109->118114 119822 7ffdfafb9190 179 API calls 118109->119822 118111 7ffdfaee6317 118110->118111 118113 7ffdfaee62e6 118110->118113 119823 7ffdfafddd20 201 API calls 118110->119823 118116 7ffdfafb90e0 267 API calls 118111->118116 118112->118104 118112->118106 118112->118114 118121 7ffdfaee65b9 118112->118121 118113->118111 119824 7ffdfafa4170 53 API calls 118113->119824 118114->118121 119831 7ffdfafa4170 53 API calls 118114->119831 118127 7ffdfaee6331 118116->118127 118119->118121 119820 7ffdfafba7c0 53 API calls 118119->119820 118121->117287 118122 7ffdfaee6253 119821 7ffdfafbb210 167 API calls 118122->119821 118127->118121 118128 7ffdfaee66c4 118127->118128 118136 7ffdfafa5620 34 API calls 118127->118136 118138 7ffdfafd0f20 28 API calls 118127->118138 118139 7ffdfaee6591 118127->118139 119825 7ffdfafbfc30 memmove TlsGetValue 118127->119825 119826 7ffdfafb8e40 178 API calls 118127->119826 119827 7ffdfafd0c00 28 API calls 118127->119827 119828 7ffdfafbfe00 44 API calls 118127->119828 119829 7ffdfaf7fff0 167 API calls 118127->119829 119832 7ffdfafe1390 207 API calls 118127->119832 118128->118121 118129 7ffdfaee66e0 118128->118129 118130 7ffdfaee6708 118128->118130 118129->118121 118132 7ffdfafa5620 34 API calls 118129->118132 119834 7ffdfafba7c0 53 API calls 118130->119834 118133 7ffdfaee66ec 118132->118133 119833 7ffdfafba7c0 53 API calls 118133->119833 118136->118127 118138->118127 118139->118114 119830 7ffdfafa4170 53 API calls 118139->119830 118150 7ffdfaee680f 118143->118150 118144 7ffdfaee696d 118148 7ffdfaee6990 118144->118148 118149 7ffdfaee739a 118144->118149 118145 7ffdfaee6dca 118147 7ffdfafb90e0 267 API calls 118145->118147 118146 7ffdfaee7396 118146->117287 118153 7ffdfaee6dde 118147->118153 118151 7ffdfaee69ea 118148->118151 118154 7ffdfaee69b0 118148->118154 119837 7ffdfafddd20 201 API calls 118148->119837 118149->118146 119859 7ffdfafa4170 53 API calls 118149->119859 118150->118144 118150->118149 118155 7ffdfaee73e9 118150->118155 119835 7ffdfafddd20 201 API calls 118150->119835 119836 7ffdfafa4170 53 API calls 118150->119836 118151->118145 118152 7ffdfaee6a1e strpbrk 118151->118152 118152->118145 118157 7ffdfaee6a37 118152->118157 118153->118146 118162 7ffdfaee6e09 118153->118162 119847 7ffdfafa4370 29 API calls 118153->119847 118154->118151 119838 7ffdfafa4170 53 API calls 118154->119838 118159 7ffdfaee6a49 strpbrk 118157->118159 118159->118145 118166 7ffdfaee6a62 118159->118166 118163 7ffdfaee6e3b 118162->118163 119848 7ffdfafc33d0 memmove TlsGetValue 118162->119848 118171 7ffdfaee6e62 118163->118171 119849 7ffdfafa4370 29 API calls 118163->119849 118170 7ffdfaee6aae 118166->118170 119839 7ffdfafc33d0 memmove TlsGetValue 118166->119839 118175 7ffdfaee6aef 118170->118175 119840 7ffdfafc33d0 memmove TlsGetValue 118170->119840 118207 7ffdfaee6e9b 118171->118207 119850 7ffdfafc33d0 memmove TlsGetValue 118171->119850 118174 7ffdfaee6b34 118178 7ffdfaee6d04 118174->118178 118197 7ffdfaee6b4f 118174->118197 118175->118174 119841 7ffdfafc33d0 memmove TlsGetValue 118175->119841 118189 7ffdfaee6cc2 118178->118189 118181 7ffdfaee7296 118183 7ffdfaebd510 62 API calls 118183->118207 118187 7ffdfaee725f 118187->118189 118189->118181 118194 7ffdfafd0f20 28 API calls 118194->118207 118197->118189 118206 7ffdfafc0610 64 API calls 118206->118207 118207->118155 118207->118181 118207->118183 118207->118187 118207->118189 118207->118194 118207->118206 118208 7ffdfafc0870 30 API calls 118207->118208 118209 7ffdfafc36f0 56 API calls 118207->118209 119851 7ffdfafc33d0 memmove TlsGetValue 118207->119851 119852 7ffdfafc0340 29 API calls 118207->119852 118208->118207 118209->118207 118216 7ffdfaee680f 118210->118216 118211 7ffdfaee696d 118214 7ffdfaee6990 118211->118214 118215 7ffdfaee739a 118211->118215 118212 7ffdfaee6dca 118213 7ffdfafb90e0 267 API calls 118212->118213 118219 7ffdfaee6dde 118213->118219 118217 7ffdfaee69ea 118214->118217 118220 7ffdfaee69b0 118214->118220 119862 7ffdfafddd20 201 API calls 118214->119862 118256 7ffdfaee7396 118215->118256 119884 7ffdfafa4170 53 API calls 118215->119884 118216->118211 118216->118215 118221 7ffdfaee73e9 118216->118221 119860 7ffdfafddd20 201 API calls 118216->119860 119861 7ffdfafa4170 53 API calls 118216->119861 118217->118212 118218 7ffdfaee6a1e strpbrk 118217->118218 118218->118212 118223 7ffdfaee6a37 118218->118223 118228 7ffdfaee6e09 118219->118228 118219->118256 119872 7ffdfafa4370 29 API calls 118219->119872 118220->118217 119863 7ffdfafa4170 53 API calls 118220->119863 118225 7ffdfaee6a49 strpbrk 118223->118225 118225->118212 118232 7ffdfaee6a62 118225->118232 118229 7ffdfaee6e3b 118228->118229 119873 7ffdfafc33d0 memmove TlsGetValue 118228->119873 118238 7ffdfaee6e62 118229->118238 119874 7ffdfafa4370 29 API calls 118229->119874 118236 7ffdfaee6aae 118232->118236 119864 7ffdfafc33d0 memmove TlsGetValue 118232->119864 118237 7ffdfaee6aef 118236->118237 119865 7ffdfafc33d0 memmove TlsGetValue 118236->119865 118244 7ffdfaee6b34 118237->118244 119866 7ffdfafc33d0 memmove TlsGetValue 118237->119866 118274 7ffdfaee6e9b 118238->118274 119875 7ffdfafc33d0 memmove TlsGetValue 118238->119875 118243 7ffdfaee6d04 118255 7ffdfaee6cc2 118243->118255 118244->118243 118265 7ffdfaee6b4f 118244->118265 118247 7ffdfaee7296 118249 7ffdfaebd510 62 API calls 118249->118274 118253 7ffdfaee725f 118253->118255 118255->118247 118256->117287 118259 7ffdfafc0610 64 API calls 118259->118274 118262 7ffdfafd0f20 28 API calls 118262->118274 118265->118255 118274->118221 118274->118247 118274->118249 118274->118253 118274->118255 118274->118259 118274->118262 118275 7ffdfafc0870 30 API calls 118274->118275 118276 7ffdfafc36f0 56 API calls 118274->118276 119876 7ffdfafc33d0 memmove TlsGetValue 118274->119876 119877 7ffdfafc0340 29 API calls 118274->119877 118275->118274 118276->118274 118278 7ffdfaee6195 118277->118278 118279 7ffdfaee6175 118277->118279 118298 7ffdfaee65b9 118278->118298 119896 7ffdfafa4170 53 API calls 118278->119896 118279->118278 118280 7ffdfaee6283 118279->118280 118283 7ffdfaee61de 118279->118283 118281 7ffdfaee6288 118280->118281 118287 7ffdfaee62bc 118280->118287 118284 7ffdfafb90e0 267 API calls 118281->118284 118285 7ffdfafd0f20 28 API calls 118283->118285 118286 7ffdfaee6296 118284->118286 118293 7ffdfaee61e3 118285->118293 118286->118278 119887 7ffdfafb9190 179 API calls 118286->119887 118288 7ffdfaee6317 118287->118288 118289 7ffdfaee62e6 118287->118289 119888 7ffdfafddd20 201 API calls 118287->119888 118291 7ffdfafb90e0 267 API calls 118288->118291 118289->118288 119889 7ffdfafa4170 53 API calls 118289->119889 118299 7ffdfaee6331 118291->118299 118293->118298 119885 7ffdfafba7c0 53 API calls 118293->119885 118295 7ffdfaee6253 119886 7ffdfafbb210 167 API calls 118295->119886 118298->117287 118299->118298 118302 7ffdfaee66c4 118299->118302 118306 7ffdfafd0f20 28 API calls 118299->118306 118311 7ffdfafa5620 34 API calls 118299->118311 118313 7ffdfaee6591 118299->118313 119890 7ffdfafbfc30 memmove TlsGetValue 118299->119890 119891 7ffdfafb8e40 178 API calls 118299->119891 119892 7ffdfafd0c00 28 API calls 118299->119892 119893 7ffdfafbfe00 44 API calls 118299->119893 119894 7ffdfaf7fff0 167 API calls 118299->119894 119897 7ffdfafe1390 207 API calls 118299->119897 118302->118298 118303 7ffdfaee6708 118302->118303 118304 7ffdfaee66e0 118302->118304 119899 7ffdfafba7c0 53 API calls 118303->119899 118304->118298 118307 7ffdfafa5620 34 API calls 118304->118307 118306->118299 118308 7ffdfaee66ec 118307->118308 119898 7ffdfafba7c0 53 API calls 118308->119898 118311->118299 118313->118278 119895 7ffdfafa4170 53 API calls 118313->119895 118318 7ffdfaedc141 118317->118318 118319 7ffdfaedc123 118317->118319 118320 7ffdfafad720 105 API calls 118318->118320 118319->117287 118321 7ffdfaedcb0d 118320->118321 118322 7ffdfaf77420 183 API calls 118321->118322 118328 7ffdfaedcb11 118321->118328 118324 7ffdfaedcb1d 118322->118324 118323 7ffdfafa5620 34 API calls 118325 7ffdfaedcb52 118323->118325 118326 7ffdfaedcb35 _errno 118324->118326 118324->118328 119900 7ffdfafba7c0 53 API calls 118325->119900 118326->118328 118328->118323 118329 7ffdfaedcb5d 118329->117287 118331 7ffdfaee6112 118330->118331 118343 7ffdfaee5fe0 118330->118343 118332 7ffdfaee6132 118331->118332 119901 7ffdfafddd20 201 API calls 118331->119901 118332->118343 118344 7ffdfaee6195 118332->118344 119902 7ffdfafa4170 53 API calls 118332->119902 118334 7ffdfaee6283 118336 7ffdfaee6288 118334->118336 118341 7ffdfaee62bc 118334->118341 118338 7ffdfafb90e0 267 API calls 118336->118338 118337 7ffdfaee61de 118339 7ffdfafd0f20 28 API calls 118337->118339 118340 7ffdfaee6296 118338->118340 118350 7ffdfaee61e3 118339->118350 118340->118344 119905 7ffdfafb9190 179 API calls 118340->119905 118342 7ffdfaee6317 118341->118342 118345 7ffdfaee62e6 118341->118345 119906 7ffdfafddd20 201 API calls 118341->119906 118348 7ffdfafb90e0 267 API calls 118342->118348 118343->118334 118343->118337 118343->118344 118355 7ffdfaee65b9 118343->118355 118344->118355 119914 7ffdfafa4170 53 API calls 118344->119914 118345->118342 119907 7ffdfafa4170 53 API calls 118345->119907 118372 7ffdfaee6331 118348->118372 118350->118355 119903 7ffdfafba7c0 53 API calls 118350->119903 118352 7ffdfaee6253 119904 7ffdfafbb210 167 API calls 118352->119904 118355->117287 118358 7ffdfaee66c4 118358->118355 118359 7ffdfaee66e0 118358->118359 118360 7ffdfaee6708 118358->118360 118359->118355 118362 7ffdfafa5620 34 API calls 118359->118362 119917 7ffdfafba7c0 53 API calls 118360->119917 118363 7ffdfaee66ec 118362->118363 119916 7ffdfafba7c0 53 API calls 118363->119916 118366 7ffdfafa5620 34 API calls 118366->118372 118368 7ffdfafd0f20 28 API calls 118368->118372 118369 7ffdfaee6591 118369->118344 119913 7ffdfafa4170 53 API calls 118369->119913 118372->118355 118372->118358 118372->118366 118372->118368 118372->118369 119908 7ffdfafbfc30 memmove TlsGetValue 118372->119908 119909 7ffdfafb8e40 178 API calls 118372->119909 119910 7ffdfafd0c00 28 API calls 118372->119910 119911 7ffdfafbfe00 44 API calls 118372->119911 119912 7ffdfaf7fff0 167 API calls 118372->119912 119915 7ffdfafe1390 207 API calls 118372->119915 118375 7ffdfaedbd71 118374->118375 118376 7ffdfaedbd53 118374->118376 118377 7ffdfafad720 105 API calls 118375->118377 118376->117287 118378 7ffdfaedcb0d 118377->118378 118379 7ffdfaf77420 183 API calls 118378->118379 118385 7ffdfaedcb11 118378->118385 118381 7ffdfaedcb1d 118379->118381 118380 7ffdfafa5620 34 API calls 118382 7ffdfaedcb52 118380->118382 118383 7ffdfaedcb35 _errno 118381->118383 118381->118385 119918 7ffdfafba7c0 53 API calls 118382->119918 118383->118385 118385->118380 118386 7ffdfaedcb5d 118386->117287 118389 7ffdfaee5fe0 118387->118389 118388 7ffdfaee6195 118398 7ffdfaee65b9 118388->118398 119930 7ffdfafa4170 53 API calls 118388->119930 118389->118388 118390 7ffdfaee6283 118389->118390 118392 7ffdfaee61de 118389->118392 118389->118398 118391 7ffdfaee6288 118390->118391 118395 7ffdfaee62bc 118390->118395 118393 7ffdfafb90e0 267 API calls 118391->118393 118394 7ffdfafd0f20 28 API calls 118392->118394 118397 7ffdfaee6296 118393->118397 118404 7ffdfaee61e3 118394->118404 118396 7ffdfaee6317 118395->118396 118399 7ffdfaee62e6 118395->118399 119922 7ffdfafddd20 201 API calls 118395->119922 118401 7ffdfafb90e0 267 API calls 118396->118401 118397->118388 119921 7ffdfafb9190 179 API calls 118397->119921 118398->117287 118399->118396 119923 7ffdfafa4170 53 API calls 118399->119923 118425 7ffdfaee6331 118401->118425 118404->118398 119919 7ffdfafba7c0 53 API calls 118404->119919 118406 7ffdfaee6253 119920 7ffdfafbb210 167 API calls 118406->119920 118411 7ffdfaee66c4 118411->118398 118412 7ffdfaee66e0 118411->118412 118413 7ffdfaee6708 118411->118413 118412->118398 118416 7ffdfafa5620 34 API calls 118412->118416 119933 7ffdfafba7c0 53 API calls 118413->119933 118415 7ffdfafd0f20 28 API calls 118415->118425 118417 7ffdfaee66ec 118416->118417 119932 7ffdfafba7c0 53 API calls 118417->119932 118420 7ffdfafa5620 34 API calls 118420->118425 118422 7ffdfaee6591 118422->118388 119929 7ffdfafa4170 53 API calls 118422->119929 118425->118398 118425->118411 118425->118415 118425->118420 118425->118422 119924 7ffdfafbfc30 memmove TlsGetValue 118425->119924 119925 7ffdfafb8e40 178 API calls 118425->119925 119926 7ffdfafd0c00 28 API calls 118425->119926 119927 7ffdfafbfe00 44 API calls 118425->119927 119928 7ffdfaf7fff0 167 API calls 118425->119928 119931 7ffdfafe1390 207 API calls 118425->119931 118447 7ffdfaee680f 118427->118447 118428 7ffdfaee696d 118430 7ffdfaee6990 118428->118430 118432 7ffdfaee739a 118428->118432 118429 7ffdfaee6dca 118433 7ffdfafb90e0 267 API calls 118429->118433 118436 7ffdfaee69b0 118430->118436 118442 7ffdfaee69ea 118430->118442 119936 7ffdfafddd20 201 API calls 118430->119936 118431 7ffdfaee7396 118431->117287 118432->118431 119958 7ffdfafa4170 53 API calls 118432->119958 118435 7ffdfaee6dde 118433->118435 118434 7ffdfaee6a1e strpbrk 118434->118429 118438 7ffdfaee6a37 118434->118438 118435->118431 118445 7ffdfaee6e09 118435->118445 119946 7ffdfafa4370 29 API calls 118435->119946 118436->118442 119937 7ffdfafa4170 53 API calls 118436->119937 118441 7ffdfaee6a49 strpbrk 118438->118441 118440 7ffdfaee73e9 118441->118429 118450 7ffdfaee6a62 118441->118450 118442->118429 118442->118434 118446 7ffdfaee6e3b 118445->118446 119947 7ffdfafc33d0 memmove TlsGetValue 118445->119947 118455 7ffdfaee6e62 118446->118455 119948 7ffdfafa4370 29 API calls 118446->119948 118447->118428 118447->118432 118447->118440 119934 7ffdfafddd20 201 API calls 118447->119934 119935 7ffdfafa4170 53 API calls 118447->119935 118454 7ffdfaee6aae 118450->118454 119938 7ffdfafc33d0 memmove TlsGetValue 118450->119938 118459 7ffdfaee6aef 118454->118459 119939 7ffdfafc33d0 memmove TlsGetValue 118454->119939 118491 7ffdfaee6e9b 118455->118491 119949 7ffdfafc33d0 memmove TlsGetValue 118455->119949 118458 7ffdfaee6b34 118462 7ffdfaee6d04 118458->118462 118481 7ffdfaee6b4f 118458->118481 118459->118458 119940 7ffdfafc33d0 memmove TlsGetValue 118459->119940 118473 7ffdfaee6cc2 118462->118473 118465 7ffdfaee7296 118467 7ffdfaebd510 62 API calls 118467->118491 118471 7ffdfaee725f 118471->118473 118473->118465 118478 7ffdfafd0f20 28 API calls 118478->118491 118481->118473 118490 7ffdfafc0610 64 API calls 118490->118491 118491->118440 118491->118465 118491->118467 118491->118471 118491->118473 118491->118478 118491->118490 118492 7ffdfafc0870 30 API calls 118491->118492 118493 7ffdfafc36f0 56 API calls 118491->118493 119950 7ffdfafc33d0 memmove TlsGetValue 118491->119950 119951 7ffdfafc0340 29 API calls 118491->119951 118492->118491 118493->118491 118495 7ffdfaedbdc1 118494->118495 118496 7ffdfaedbda3 118494->118496 118497 7ffdfafad720 105 API calls 118495->118497 118496->117287 118498 7ffdfaedcb0d 118497->118498 118499 7ffdfaf77420 183 API calls 118498->118499 118505 7ffdfaedcb11 118498->118505 118501 7ffdfaedcb1d 118499->118501 118500 7ffdfafa5620 34 API calls 118502 7ffdfaedcb52 118500->118502 118503 7ffdfaedcb35 _errno 118501->118503 118501->118505 119959 7ffdfafba7c0 53 API calls 118502->119959 118503->118505 118505->118500 118506 7ffdfaedcb5d 118506->117287 118514 7ffdfaee680f 118507->118514 118508 7ffdfaee696d 118512 7ffdfaee6990 118508->118512 118513 7ffdfaee739a 118508->118513 118509 7ffdfaee6dca 118511 7ffdfafb90e0 267 API calls 118509->118511 118510 7ffdfaee7396 118510->117287 118517 7ffdfaee6dde 118511->118517 118515 7ffdfaee69ea 118512->118515 118518 7ffdfaee69b0 118512->118518 119962 7ffdfafddd20 201 API calls 118512->119962 118513->118510 119984 7ffdfafa4170 53 API calls 118513->119984 118514->118508 118514->118513 118519 7ffdfaee73e9 118514->118519 119960 7ffdfafddd20 201 API calls 118514->119960 119961 7ffdfafa4170 53 API calls 118514->119961 118515->118509 118516 7ffdfaee6a1e strpbrk 118515->118516 118516->118509 118521 7ffdfaee6a37 118516->118521 118517->118510 118526 7ffdfaee6e09 118517->118526 119972 7ffdfafa4370 29 API calls 118517->119972 118518->118515 119963 7ffdfafa4170 53 API calls 118518->119963 118523 7ffdfaee6a49 strpbrk 118521->118523 118523->118509 118530 7ffdfaee6a62 118523->118530 118527 7ffdfaee6e3b 118526->118527 119973 7ffdfafc33d0 memmove TlsGetValue 118526->119973 118535 7ffdfaee6e62 118527->118535 119974 7ffdfafa4370 29 API calls 118527->119974 118534 7ffdfaee6aae 118530->118534 119964 7ffdfafc33d0 memmove TlsGetValue 118530->119964 118539 7ffdfaee6aef 118534->118539 119965 7ffdfafc33d0 memmove TlsGetValue 118534->119965 118568 7ffdfaee6e9b 118535->118568 119975 7ffdfafc33d0 memmove TlsGetValue 118535->119975 118538 7ffdfaee6b34 118542 7ffdfaee6d04 118538->118542 118561 7ffdfaee6b4f 118538->118561 118539->118538 119966 7ffdfafc33d0 memmove TlsGetValue 118539->119966 118540 7ffdfaee72d3 118543 7ffdfaee6cc2 118542->118543 119968 7ffdfafbfac0 35 API calls 118542->119968 118546 7ffdfaee7296 118543->118546 119978 7ffdfafc0610 64 API calls 118543->119978 118546->118540 118549 7ffdfafa5620 34 API calls 118546->118549 118554 7ffdfaee72f7 118546->118554 118548 7ffdfaebd510 62 API calls 118548->118568 118549->118540 118552 7ffdfaee725f 118552->118543 118558 7ffdfafd0f20 28 API calls 118558->118568 118561->118543 118568->118519 118568->118543 118568->118546 118568->118548 118568->118552 118568->118558 118571 7ffdfafc0610 64 API calls 118568->118571 118572 7ffdfafc0870 30 API calls 118568->118572 118573 7ffdfafc36f0 56 API calls 118568->118573 119976 7ffdfafc33d0 memmove TlsGetValue 118568->119976 119977 7ffdfafc0340 29 API calls 118568->119977 118571->118568 118572->118568 118573->118568 118575 7ffdfaedc6b5 118574->118575 118576 7ffdfaedc6d4 118574->118576 118575->117287 118576->118575 119985 7ffdfafba7c0 53 API calls 118576->119985 118578 7ffdfaedc6ed 118578->117287 118579->117287 118581 7ffdfafb9114 118580->118581 118583 7ffdfafb913d 118581->118583 118627 7ffdfafb9450 TlsGetValue 118581->118627 118583->117374 118584->117371 118585->117364 118586->117364 118587->117362 118588->117361 118589->117374 118590->117374 118591->117374 118592->117374 118593->117374 118594->117364 118595->117363 118596->117374 118598 7ffdfafa5650 TlsGetValue 118597->118598 118599 7ffdfafa5631 TlsAlloc 118597->118599 118599->118598 118626->117363 118630 7ffdfafb949e 118627->118630 118628 7ffdfafb94e8 118633 7ffdfafb9518 118628->118633 119061 7ffdfaf3fff0 49 API calls 118628->119061 118630->118628 118631 7ffdfafb94c9 memset 118630->118631 118636 7ffdfafb9c01 118630->118636 119060 7ffdfafd1890 49 API calls 118631->119060 118635 7ffdfafb9592 118633->118635 118633->118636 118658 7ffdfafd7b90 118633->118658 118640 7ffdfb01ae00 8 API calls 118635->118640 118659 7ffdfafd7bc1 118658->118659 119060->118628 119061->118633 119279 7ffdfaebd56a 119278->119279 119315->117402 119316->117399 119317->117413 119318->117420 119319->117419 119320->117450 119321->117447 119325->117409 119326->117410 119327->117416 119328->117455 119329->117455 119330->117455 119331->117426 119337->117395 119350->117463 119351->117463 119352->117467 119353->117464 119354->117483 119355->117488 119356->117487 119357->117510 119362->117475 119363->117476 119364->117484 119365->117520 119366->117520 119367->117520 119374->117459 119375->117542 119376->117535 119377->117535 119378->117534 119379->117533 119380->117561 119381->117561 119382->117561 119383->117561 119384->117561 119385->117535 119386->117531 119387->117561 119388->117531 119389->117531 119390->117570 119391->117570 119392->117574 119393->117571 119394->117590 119395->117595 119396->117594 119402->117582 119403->117583 119404->117591 119405->117606 119406->117606 119407->117606 119414->117566 119416 7ffdfaf77435 119415->119416 119425 7ffdfaf77554 119415->119425 119417 7ffdfaf7743d 119416->119417 119416->119425 119456 7ffdfaf735a0 TlsGetValue 119417->119456 119421 7ffdfaf77459 119430 7ffdfaf77420 183 API calls 119425->119430 119433 7ffdfafae465 119425->119433 119440 7ffdfafae477 119425->119440 119488 7ffdfafaed50 105 API calls 119425->119488 119489 7ffdfafaeae0 53 API calls 119425->119489 119490 7ffdfafae5d0 182 API calls 119425->119490 119430->119425 119433->117636 119440->119433 119491 7ffdfaf73910 50 API calls 119440->119491 119498 7ffdfaf691f0 119448->119498 119458 7ffdfaf735c9 119456->119458 119457 7ffdfaf7364b TlsGetValue 119463 7ffdfaf73669 119457->119463 119460 7ffdfaf7362a 119458->119460 119461 7ffdfaf73606 119458->119461 119471 7ffdfaf737c2 119458->119471 119459 7ffdfaf7379c 119473 7ffdfaf737f0 TlsGetValue 119459->119473 119460->119457 119460->119459 119492 7ffdfafd1890 49 API calls 119461->119492 119464 7ffdfaf73692 119463->119464 119467 7ffdfaf736b5 119463->119467 119463->119471 119493 7ffdfafd1890 49 API calls 119464->119493 119466 7ffdfaf73749 LeaveCriticalSection 119468 7ffdfaf7376a 119466->119468 119469 7ffdfaf73788 119466->119469 119467->119466 119467->119471 119468->119469 119469->119459 119474 7ffdfaf73813 119473->119474 119475 7ffdfaf73838 119474->119475 119476 7ffdfaf7385b 119474->119476 119496 7ffdfafd1890 49 API calls 119475->119496 119476->119421 119488->119425 119489->119425 119491->119433 119492->119460 119493->119467 119496->119476 119554 7ffdfaf77420 183 API calls 119553->119554 119555 7ffdfaf77590 119554->119555 119556 7ffdfaf77598 119555->119556 119557 7ffdfafd0f20 28 API calls 119555->119557 119556->117679 119558 7ffdfaf775c4 119557->119558 119559 7ffdfaf77641 119558->119559 119560 7ffdfaf775e6 119558->119560 119561 7ffdfafd0f20 28 API calls 119559->119561 119563 7ffdfafd0f20 28 API calls 119560->119563 119562 7ffdfaf77646 119561->119562 119621 7ffdfaf7fff0 167 API calls 119562->119621 119566 7ffdfaf775fd 119563->119566 119565 7ffdfaf77691 119565->117679 119566->119562 119567 7ffdfaf77620 memmove 119566->119567 119568 7ffdfaf776bb 119566->119568 119567->119562 119569 7ffdfaf77670 119569->119565 119622 7ffdfaf7fff0 167 API calls 119569->119622 119572 7ffdfaface26 119571->119572 119610 7ffdfafacfa6 119572->119610 119623 7ffdfaf76b60 119572->119623 119610->119610 119617->117690 119619->117686 119621->119569 119622->119565 119668->117717 119669->117700 119670->117700 119671->117710 119672->117708 119673->117736 119674->117736 119675->117736 119676->117736 119677->117736 119678->117700 119679->117707 119680->117736 119681->117707 119682->117707 119683->117757 119684->117750 119685->117750 119686->117749 119687->117748 119688->117776 119689->117776 119690->117776 119691->117776 119692->117776 119693->117750 119694->117746 119695->117776 119696->117746 119697->117746 119698->117797 119699->117790 119700->117790 119701->117788 119702->117787 119703->117816 119704->117816 119705->117816 119706->117816 119707->117816 119708->117790 119709->117789 119710->117816 119711->117789 119712->117789 119713->117835 119714->117835 119715->117829 119716->117826 119717->117844 119718->117849 119719->117848 119720->117852 119725->117837 119726->117838 119727->117845 119728->117859 119729->117859 119730->117859 119731->117853 119737->117864 119738->117887 119739->117887 119740->117899 119741->117895 119742->117911 119743->117916 119744->117915 119745->117944 119750->117903 119751->117904 119752->117912 119753->117949 119754->117949 119755->117949 119756->117922 119762->117931 119763->117971 119764->117964 119765->117964 119766->117963 119767->117962 119768->117990 119769->117990 119770->117990 119771->117990 119772->117990 119773->117964 119774->117960 119775->117990 119776->117960 119777->117960 119779 7ffdfafad76a 119778->119779 119781 7ffdfafad73d 119778->119781 119780 7ffdfaedcb0d 119780->118015 119780->118021 119781->119780 119782 7ffdfafad762 119781->119782 119788 7ffdfafaed50 105 API calls 119781->119788 119789 7ffdfafaeae0 53 API calls 119782->119789 119785->117996 119786->118006 119788->119782 119789->119779 119790->118042 119791->118035 119792->118035 119793->118034 119794->118033 119795->118061 119796->118061 119797->118061 119798->118061 119799->118061 119800->118035 119801->118031 119802->118061 119803->118031 119804->118031 119805->118082 119806->118074 119807->118074 119808->118073 119809->118072 119810->118090 119811->118090 119812->118090 119813->118090 119814->118090 119815->118074 119816->118078 119817->118090 119818->118078 119819->118078 119820->118122 119821->118114 119822->118114 119823->118113 119824->118111 119825->118127 119826->118127 119827->118127 119828->118127 119829->118127 119830->118114 119831->118121 119832->118127 119833->118121 119834->118121 119835->118150 119836->118150 119837->118154 119838->118151 119839->118170 119840->118175 119841->118174 119847->118162 119848->118163 119849->118171 119850->118207 119851->118207 119852->118207 119859->118146 119860->118216 119861->118216 119862->118220 119863->118217 119864->118236 119865->118237 119866->118244 119872->118228 119873->118229 119874->118238 119875->118274 119876->118274 119877->118274 119884->118256 119885->118295 119886->118278 119887->118278 119888->118289 119889->118288 119890->118299 119891->118299 119892->118299 119893->118299 119894->118299 119895->118278 119896->118298 119897->118299 119898->118298 119899->118298 119900->118329 119901->118332 119902->118343 119903->118352 119904->118344 119905->118344 119906->118345 119907->118342 119908->118372 119909->118372 119910->118372 119911->118372 119912->118372 119913->118344 119914->118355 119915->118372 119916->118355 119917->118355 119918->118386 119919->118406 119920->118388 119921->118388 119922->118399 119923->118396 119924->118425 119925->118425 119926->118425 119927->118425 119928->118425 119929->118388 119930->118398 119931->118425 119932->118398 119933->118398 119934->118447 119935->118447 119936->118436 119937->118442 119938->118454 119939->118459 119940->118458 119946->118445 119947->118446 119948->118455 119949->118491 119950->118491 119951->118491 119958->118431 119959->118506 119960->118514 119961->118514 119962->118518 119963->118515 119964->118534 119965->118539 119966->118538 119972->118526 119973->118527 119974->118535 119975->118568 119976->118568 119977->118568 119978->118546 119984->118510 119985->118578 119986->117330 119987->117335 119988 7ff7e104b19c 120009 7ff7e104b36c 119988->120009 119991 7ff7e104b2e8 120105 7ff7e104b69c 7 API calls 2 library calls 119991->120105 119992 7ff7e104b1b8 __scrt_acquire_startup_lock 119994 7ff7e104b2f2 119992->119994 120001 7ff7e104b1d6 __scrt_release_startup_lock 119992->120001 120106 7ff7e104b69c 7 API calls 2 library calls 119994->120106 119996 7ff7e104b1fb 119997 7ff7e104b2fd ExFilterRethrow 119998 7ff7e104b281 120015 7ff7e104b7e8 119998->120015 120000 7ff7e104b286 120018 7ff7e1041000 120000->120018 120001->119996 120001->119998 120102 7ff7e1058984 45 API calls 120001->120102 120107 7ff7e104b96c 120009->120107 120012 7ff7e104b1b0 120012->119991 120012->119992 120013 7ff7e104b39b __scrt_initialize_crt 120013->120012 120109 7ff7e104cac8 7 API calls 2 library calls 120013->120109 120016 7ff7e104c210 __scrt_get_show_window_mode 120015->120016 120017 7ff7e104b7ff GetStartupInfoW 120016->120017 120017->120000 120019 7ff7e104100b 120018->120019 120110 7ff7e1047600 120019->120110 120021 7ff7e104101d 120117 7ff7e1054f14 120021->120117 120023 7ff7e104367b 120124 7ff7e1041af0 120023->120124 120093 7ff7e104379a 120102->119998 120105->119994 120106->119997 120108 7ff7e104b38e __scrt_dllmain_crt_thread_attach 120107->120108 120108->120012 120108->120013 120109->120012 120115 7ff7e104761f 120110->120115 120111 7ff7e1047670 WideCharToMultiByte 120113 7ff7e1047718 120111->120113 120111->120115 120280 7ff7e1042620 57 API calls 2 library calls 120113->120280 120114 7ff7e10476c6 WideCharToMultiByte 120114->120113 120114->120115 120115->120111 120115->120113 120115->120114 120116 7ff7e1047627 __std_exception_destroy 120115->120116 120116->120021 120118 7ff7e105ec40 120117->120118 120120 7ff7e105ece6 120118->120120 120122 7ff7e105ec93 120118->120122 120282 7ff7e105eb18 71 API calls _fread_nolock 120120->120282 120281 7ff7e1059ce4 37 API calls 2 library calls 120122->120281 120123 7ff7e105ecbc 120123->120023 120125 7ff7e1041b05 120124->120125 120126 7ff7e1041b20 120125->120126 120283 7ff7e10424d0 59 API calls 3 library calls 120125->120283 120126->120093 120128 7ff7e1043ba0 120126->120128 120280->120116 120281->120123 120282->120123 120283->120126 116366 7ffdfaf20040 116367 7ffdfaf20096 116366->116367 116382 7ffdfafa33a0 TlsGetValue 116367->116382 116369 7ffdfaf200dc 116396 7ffdfaf21df0 116369->116396 116371 7ffdfaf202aa 116419 7ffdfaf20c70 53 API calls 116371->116419 116373 7ffdfaf2011a 116373->116371 116375 7ffdfaf201c4 116373->116375 116376 7ffdfaf201c6 strncmp 116373->116376 116418 7ffdfaf20c70 53 API calls 116375->116418 116376->116375 116377 7ffdfaf2034c 116420 7ffdfb01ae00 116377->116420 116379 7ffdfaf20248 116381 7ffdfaf21df0 264 API calls 116379->116381 116381->116371 116384 7ffdfafa33c9 116382->116384 116383 7ffdfafa3482 116383->116369 116385 7ffdfafa33f2 116384->116385 116386 7ffdfafa3406 116384->116386 116390 7ffdfafa3490 116384->116390 116429 7ffdfafd1890 49 API calls 116385->116429 116386->116383 116388 7ffdfafa3421 116386->116388 116386->116390 116430 7ffdfaf3fff0 49 API calls 116388->116430 116391 7ffdfafa33a0 49 API calls 116390->116391 116392 7ffdfafa34e0 116391->116392 116393 7ffdfafa355a 116392->116393 116394 7ffdfafa351f memmove 116392->116394 116431 7ffdfafd0c00 28 API calls 116392->116431 116394->116369 116397 7ffdfaf21e2e 116396->116397 116400 7ffdfaf21f04 116396->116400 116398 7ffdfaf21e60 116397->116398 116416 7ffdfaf21f21 116397->116416 116467 7ffdfafd0f20 116398->116467 116400->116373 116401 7ffdfaf21e65 116401->116400 116481 7ffdfafba7c0 53 API calls 116401->116481 116403 7ffdfaf220e7 116486 7ffdfaf8c690 181 API calls 116403->116486 116404 7ffdfaf21ed7 116482 7ffdfafbb210 167 API calls 116404->116482 116407 7ffdfaf2210d 116487 7ffdfaf06300 183 API calls 116407->116487 116408 7ffdfaf21ef9 116483 7ffdfaf06300 183 API calls 116408->116483 116411 7ffdfaf22067 116485 7ffdfafd0c00 28 API calls 116411->116485 116413 7ffdfaf22118 116488 7ffdfafd0c00 28 API calls 116413->116488 116416->116400 116416->116403 116416->116411 116432 7ffdfaf21940 116416->116432 116484 7ffdfafd0c00 28 API calls 116416->116484 116418->116379 116419->116377 116421 7ffdfb01ae09 116420->116421 116422 7ffdfaf2035d 116421->116422 116423 7ffdfb01ae54 IsProcessorFeaturePresent 116421->116423 116424 7ffdfb01ae6c 116423->116424 117076 7ffdfb01b048 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 116424->117076 116426 7ffdfb01ae7f 117077 7ffdfb01ae20 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 116426->117077 116429->116386 116430->116383 116431->116394 116489 7ffdfafa3a00 116432->116489 116436 7ffdfaf21bd6 116438 7ffdfaf21be9 116436->116438 116505 7ffdfaf21130 116436->116505 116443 7ffdfaf21c5f 116438->116443 116513 7ffdfafa4170 53 API calls 116438->116513 116440 7ffdfaf21d50 116442 7ffdfaf21e60 116440->116442 116450 7ffdfaf21d76 116440->116450 116465 7ffdfaf21f21 116440->116465 116445 7ffdfafd0f20 28 API calls 116442->116445 116443->116440 116514 7ffdfafd0c00 28 API calls 116443->116514 116444 7ffdfaf21a0d 116444->116436 116444->116440 116499 7ffdfaf216b0 116444->116499 116448 7ffdfaf21e65 116445->116448 116447 7ffdfaf21d42 116515 7ffdfafd0c00 28 API calls 116447->116515 116448->116450 116516 7ffdfafba7c0 53 API calls 116448->116516 116450->116416 116452 7ffdfaf220e7 116521 7ffdfaf8c690 181 API calls 116452->116521 116453 7ffdfaf21ed7 116517 7ffdfafbb210 167 API calls 116453->116517 116456 7ffdfaf2210d 116522 7ffdfaf06300 183 API calls 116456->116522 116457 7ffdfaf21ef9 116518 7ffdfaf06300 183 API calls 116457->116518 116460 7ffdfaf22067 116520 7ffdfafd0c00 28 API calls 116460->116520 116461 7ffdfaf21940 264 API calls 116461->116465 116462 7ffdfaf22118 116523 7ffdfafd0c00 28 API calls 116462->116523 116465->116450 116465->116452 116465->116460 116465->116461 116519 7ffdfafd0c00 28 API calls 116465->116519 116468 7ffdfafd0f2d TlsAlloc 116467->116468 116469 7ffdfafd0f4c TlsGetValue 116467->116469 116468->116469 116471 7ffdfafd0f69 GetLastError 116469->116471 116472 7ffdfafd0f77 116469->116472 116471->116472 116473 7ffdfafd0f7c 116472->116473 116479 7ffdfafd0f84 116472->116479 117075 7ffdfafd08b0 22 API calls 116473->117075 116475 7ffdfafd107a 116475->116401 116476 7ffdfafd0f81 116476->116479 116477 7ffdfafd1001 LeaveCriticalSection 116477->116475 116478 7ffdfafd1018 GetProcessHeap HeapAlloc 116477->116478 116480 7ffdfafd103e 116478->116480 116479->116475 116479->116477 116480->116475 116481->116404 116482->116408 116483->116400 116484->116416 116485->116400 116486->116407 116487->116413 116488->116400 116490 7ffdfafa3a0d TlsAlloc 116489->116490 116491 7ffdfafa3a2c 116489->116491 116490->116491 116491->116489 116492 7ffdfafa3a34 TlsGetValue 116491->116492 116494 7ffdfafa3a5c 116491->116494 116496 7ffdfafa3ae1 LeaveCriticalSection 116491->116496 116498 7ffdfaf21970 116491->116498 116492->116491 116493 7ffdfafa3a49 GetLastError 116492->116493 116493->116491 116524 7ffdfafd08b0 22 API calls 116494->116524 116497 7ffdfafa3af8 GetProcessHeap RtlAllocateHeap 116496->116497 116496->116498 116497->116491 116497->116498 116498->116440 116498->116444 116512 7ffdfafd0d50 TlsGetValue 116498->116512 116500 7ffdfaf2171f 116499->116500 116525 7ffdfaf3d480 116500->116525 116502 7ffdfaf217f9 116503 7ffdfaf21907 116502->116503 116531 7ffdfafd0c00 28 API calls 116502->116531 116503->116436 116506 7ffdfaf2117d 116505->116506 116507 7ffdfaf2118b 116505->116507 117073 7ffdfaf20fe0 28 API calls 116506->117073 116509 7ffdfaf21313 116507->116509 116510 7ffdfaf22510 264 API calls 116507->116510 117074 7ffdfafa3570 52 API calls 116507->117074 116509->116438 116510->116507 116513->116443 116514->116447 116515->116440 116516->116453 116517->116457 116518->116450 116519->116465 116520->116450 116521->116456 116522->116462 116523->116450 116524->116491 116526 7ffdfaf3d4e7 116525->116526 116527 7ffdfaf3d4fb 116525->116527 116526->116502 116532 7ffdfaefd830 116527->116532 116582 7ffdfaef33d0 116527->116582 116528 7ffdfaf3d586 116528->116502 116531->116502 116563 7ffdfaefd8b5 116532->116563 116533 7ffdfaefd9d3 116535 7ffdfb01ae00 8 API calls 116533->116535 116534 7ffdfaefde55 116538 7ffdfaefde76 strncmp 116534->116538 116539 7ffdfaefde91 116534->116539 116549 7ffdfaefdf1f 116534->116549 116540 7ffdfaefe115 116535->116540 116536 7ffdfaefd940 strncmp 116536->116534 116536->116563 116537 7ffdfaefde4b 116541 7ffdfaefe0eb 116537->116541 116677 7ffdfafd0c00 28 API calls 116537->116677 116538->116539 116539->116537 116545 7ffdfaefdf21 116539->116545 116548 7ffdfaefdf0c 116539->116548 116539->116549 116540->116528 116541->116533 116678 7ffdfafd0c00 28 API calls 116541->116678 116546 7ffdfaf22510 259 API calls 116545->116546 116546->116549 116551 7ffdfaf21df0 259 API calls 116548->116551 116549->116537 116562 7ffdfaefe127 116549->116562 116676 7ffdfaf24510 memmove 116549->116676 116551->116549 116552 7ffdfaefdbd4 strncmp 116552->116563 116554 7ffdfaf21df0 259 API calls 116554->116563 116556 7ffdfafd0d50 TlsGetValue 116556->116563 116561 7ffdfaefdd0a memmove 116561->116563 116564 7ffdfaefe1a6 116562->116564 116679 7ffdfaefcf30 264 API calls 116562->116679 116563->116533 116563->116534 116563->116536 116563->116537 116563->116552 116563->116554 116563->116556 116563->116561 116563->116562 116565 7ffdfaefdae4 memmove 116563->116565 116624 7ffdfafbf9c0 116563->116624 116631 7ffdfafa4a40 116563->116631 116637 7ffdfaf22ee0 116563->116637 116645 7ffdfafa4170 53 API calls 116563->116645 116646 7ffdfafd0c00 28 API calls 116563->116646 116647 7ffdfafd10d0 24 API calls 116563->116647 116648 7ffdfaf22510 116563->116648 116675 7ffdfaf24510 memmove 116563->116675 116564->116528 116565->116563 116567 7ffdfaefe242 116568 7ffdfaefe275 116567->116568 116569 7ffdfaefe3d3 116567->116569 116577 7ffdfaefe2eb 116567->116577 116570 7ffdfafbf9c0 29 API calls 116568->116570 116571 7ffdfaf22510 259 API calls 116569->116571 116572 7ffdfaefe288 116570->116572 116571->116577 116575 7ffdfaefe29e 116572->116575 116680 7ffdfafa5c50 167 API calls 116572->116680 116575->116577 116577->116528 116583 7ffdfaef3413 116582->116583 116584 7ffdfaef3403 116582->116584 116585 7ffdfafa3a00 28 API calls 116583->116585 116584->116528 116607 7ffdfaef3442 116585->116607 116586 7ffdfafa3a00 28 API calls 116586->116607 116587 7ffdfaef3508 116589 7ffdfaef3e33 116587->116589 116600 7ffdfaef3cdd 116587->116600 116588 7ffdfaef3564 116594 7ffdfaef357a 116588->116594 117067 7ffdfafa4170 53 API calls 116588->117067 116593 7ffdfaef3f72 116589->116593 116605 7ffdfaef3eab 116589->116605 116610 7ffdfaef40ff 116589->116610 116592 7ffdfaef3c82 116619 7ffdfaef3b4e 116592->116619 117068 7ffdfaf3db40 264 API calls 116592->117068 116598 7ffdfaf22510 264 API calls 116593->116598 116623 7ffdfaef3f91 116593->116623 116594->116589 116594->116592 116599 7ffdfaef35a6 116594->116599 116596 7ffdfaef352b 116603 7ffdfaef353f 116596->116603 117065 7ffdfafa4170 53 API calls 116596->117065 116597 7ffdfaef4e9a 116597->116623 117071 7ffdfaf3db40 264 API calls 116597->117071 116598->116623 116599->116592 116620 7ffdfaef35e9 116599->116620 116600->116619 117069 7ffdfafa4170 53 API calls 116600->117069 116603->116588 117066 7ffdfafa4170 53 API calls 116603->117066 116605->116528 116607->116586 116607->116587 116607->116596 116607->116603 116609 7ffdfafa4170 53 API calls 116607->116609 117064 7ffdfaf29270 167 API calls 116607->117064 116608 7ffdfaef4edf 117072 7ffdfaef4f40 264 API calls 116608->117072 116609->116607 116610->116597 116610->116608 116613 7ffdfaef4173 116610->116613 116613->116608 116614 7ffdfaef417c 116613->116614 116619->116528 116620->116619 116623->116528 116629 7ffdfafbf9e3 116624->116629 116625 7ffdfafbfa1b 116627 7ffdfafd0f20 28 API calls 116625->116627 116626 7ffdfafd0f20 28 API calls 116626->116629 116628 7ffdfafbfa0e 116627->116628 116628->116563 116629->116624 116629->116625 116629->116626 116629->116628 116630 7ffdfafbfa4e memmove 116629->116630 116630->116628 116634 7ffdfafa4a83 116631->116634 116632 7ffdfafa4b02 116685 7ffdfafa5330 193 API calls 116632->116685 116634->116632 116635 7ffdfafa4af4 116634->116635 116684 7ffdfafa4d50 15 API calls 116634->116684 116635->116563 116638 7ffdfaf22eff 116637->116638 116644 7ffdfaf22f26 116637->116644 116639 7ffdfaf22f04 116638->116639 116638->116644 116686 7ffdfaf1e5a0 116639->116686 116642 7ffdfaf22510 264 API calls 116642->116644 116643 7ffdfaf23033 116643->116563 116644->116642 116644->116643 116645->116563 116646->116563 116647->116563 116664 7ffdfaf22593 116648->116664 116650 7ffdfaf22dd9 116653 7ffdfaf22e02 116650->116653 117063 7ffdfafd0c00 28 API calls 116650->117063 116655 7ffdfaf22e0f 116653->116655 116661 7ffdfaf22e36 116653->116661 116656 7ffdfb01ae00 8 API calls 116655->116656 116657 7ffdfaf21df0 262 API calls 116657->116664 116660 7ffdfaf229cb memmove 116660->116664 116663 7ffdfaf22510 262 API calls 116661->116663 116662 7ffdfaf22951 memmove 116662->116660 116669 7ffdfaf22ecb 116663->116669 116664->116657 116664->116660 116664->116661 116664->116662 116665 7ffdfaf22bd7 116664->116665 116666 7ffdfaf22b05 116664->116666 116667 7ffdfafd0c00 28 API calls 116664->116667 116668 7ffdfafd0d50 TlsGetValue 116664->116668 117056 7ffdfaf221e0 264 API calls 116664->117056 117057 7ffdfafa34c0 52 API calls 116664->117057 117058 7ffdfafa9940 16 API calls 116664->117058 117059 7ffdfafdce90 TlsGetValue memmove memmove 116664->117059 116665->116650 117062 7ffdfafd0c00 28 API calls 116665->117062 116666->116665 116671 7ffdfaf22bc5 116666->116671 116672 7ffdfaf22bd9 116666->116672 116667->116664 116668->116664 117060 7ffdfafa34c0 52 API calls 116671->117060 117061 7ffdfafa34c0 52 API calls 116672->117061 116675->116563 116676->116549 116677->116541 116678->116533 116679->116567 116680->116575 116684->116634 116685->116635 116687 7ffdfafa3a00 28 API calls 116686->116687 116688 7ffdfaf1e5ce 116687->116688 116689 7ffdfafa3a00 28 API calls 116688->116689 117057->116664 117058->116664 117059->116664 117060->116665 117061->116665 117062->116650 117063->116653 117064->116607 117065->116603 117066->116588 117067->116594 117068->116619 117069->116619 117071->116623 117073->116507 117074->116507 117075->116476 117076->116426 117078 7ffdfb019e90 117079 7ffdfb019fe1 117078->117079 117080 7ffdfb019ea1 117078->117080 117083 7ffdfb01a00b QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection 117079->117083 117086 7ffdfb01a04f 117079->117086 117081 7ffdfb019eaa InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 117080->117081 117082 7ffdfb019edb EnterCriticalSection 117080->117082 117081->117082 117084 7ffdfb019fd4 LeaveCriticalSection 117082->117084 117085 7ffdfb019ef5 QueryPerformanceFrequency 117082->117085 117083->117086 117084->117079 117087 7ffdfb019f24 7 API calls 117085->117087 117088 7ffdfb019fca 117085->117088 117090 7ffdfaf3fef0 117087->117090 117088->117084 117091 7ffdfaf3ff0f 117090->117091 117092 7ffdfaf3ff2a LeaveCriticalSection 117091->117092 117095 7ffdfaf3ff59 117091->117095 117092->117095 117093 7ffdfaf3ffd4 LeaveCriticalSection 117094 7ffdfaf3ffb7 117094->117093 117095->117093 117095->117094 117097 7ffdfafd0c00 28 API calls 117095->117097 117097->117093 120997 7ffdfaf67630 TlsGetValue 120998 7ffdfaf67653 120997->120998 120999 7ffdfaf67678 120998->120999 121000 7ffdfaf6769f 120998->121000 121003 7ffdfaf676c8 120998->121003 121009 7ffdfafd1890 49 API calls 120999->121009 121006 7ffdfaf676d1 121000->121006 121010 7ffdfaf3fff0 49 API calls 121000->121010 121004 7ffdfafc01b0 30 API calls 121003->121004 121003->121006 121007 7ffdfaf67a95 121003->121007 121011 7ffdfafc0070 30 API calls 121003->121011 121004->121003 121008 7ffdfaf67ab4 memmove 121007->121008 121008->121006 121009->121000 121010->121003 121011->121003 121012 7ffdfaf66270 121013 7ffdfaf662dc 121012->121013 121014 7ffdfaf662d7 121012->121014 121016 7ffdfaf662fb memchr 121013->121016 121044 7ffdfaf66310 121013->121044 121048 7ffdfaf66140 28 API calls 121014->121048 121016->121044 121017 7ffdfaf666f0 121018 7ffdfb01ae00 8 API calls 121017->121018 121020 7ffdfaf6674a 121018->121020 121019 7ffdfaf6638d memmove 121019->121044 121021 7ffdfafd0f20 28 API calls 121037 7ffdfaf667aa 121021->121037 121022 7ffdfaf6675d 121022->121021 121023 7ffdfaf666bd 121027 7ffdfaf666ca 121023->121027 121050 7ffdfafd0c00 28 API calls 121023->121050 121024 7ffdfaf66823 121025 7ffdfaf6687f 121024->121025 121030 7ffdfaf66859 121024->121030 121033 7ffdfaf6683f 121024->121033 121026 7ffdfaf66608 memmove 121026->121044 121027->121017 121032 7ffdfaf666d2 _errno 121027->121032 121028 7ffdfaf66817 121052 7ffdfafdce90 TlsGetValue memmove memmove 121028->121052 121034 7ffdfaf66870 121030->121034 121054 7ffdfafd0c00 28 API calls 121030->121054 121032->121017 121053 7ffdfafa4170 53 API calls 121033->121053 121055 7ffdfafd10d0 24 API calls 121034->121055 121037->121024 121037->121028 121040 7ffdfaf66891 121037->121040 121038 7ffdfaf66847 121046 7ffdfaf691f0 56 API calls 121040->121046 121042 7ffdfaf666e3 121042->121017 121051 7ffdfafd0c00 28 API calls 121042->121051 121043 7ffdfaf665b0 memchr 121043->121044 121044->121017 121044->121019 121044->121022 121044->121023 121044->121026 121044->121042 121044->121043 121049 7ffdfafd0c00 28 API calls 121044->121049 121047 7ffdfaf668f1 121046->121047 121048->121013 121049->121044 121050->121027 121051->121017 121052->121024 121053->121038 121054->121034 121055->121025 121056 7ffdfaecd9e8 121057 7ffdfaecda15 121056->121057 121058 7ffdfaecda28 121057->121058 121059 7ffdfafd0f20 28 API calls 121057->121059 121062 7ffdfaf42ec0 36 API calls 121058->121062 121059->121058 121061 7ffdfaecd9a0 121062->121061 117098 7ffdfaeb3acf 117100 7ffdfaeb3add 117098->117100 117099 7ffdfaeb3bb3 117101 7ffdfaeb3dbc 117099->117101 117102 7ffdfaeb3e00 117099->117102 117100->117099 117106 7ffdfaeb3cee 117100->117106 117113 7ffdfaeb3b1a 117100->117113 117101->117113 117131 7ffdfaeb50e0 28 API calls 117101->117131 117102->117113 117114 7ffdfaeb93c0 117102->117114 117105 7ffdfaeb3e68 117120 7ffdfaeb9060 117105->117120 117106->117113 117130 7ffdfaeb50e0 28 API calls 117106->117130 117109 7ffdfaeb3e7c 117110 7ffdfaeb93c0 29 API calls 117109->117110 117112 7ffdfaeb3f7c 117109->117112 117109->117113 117110->117112 117112->117113 117126 7ffdfaeb31e0 117112->117126 117115 7ffdfaeb93ef 117114->117115 117119 7ffdfaeb940f 117114->117119 117115->117119 117132 7ffdfaeb8f00 29 API calls 117115->117132 117117 7ffdfaeb9404 117133 7ffdfaeb8f00 29 API calls 117117->117133 117119->117105 117121 7ffdfaeb908f 117120->117121 117125 7ffdfaeb90af 117120->117125 117121->117125 117134 7ffdfaeb8da0 29 API calls 117121->117134 117123 7ffdfaeb90a4 117135 7ffdfaeb8da0 29 API calls 117123->117135 117125->117109 117128 7ffdfaeb3225 117126->117128 117127 7ffdfaeb32a3 117127->117113 117128->117127 117129 7ffdfaeb9060 29 API calls 117128->117129 117129->117128 117130->117113 117131->117113 117132->117117 117133->117119 117134->117123 117135->117125 117136 7ff7e1041f70 117137 7ff7e1041feb GetWindowLongPtrW 117136->117137 117138 7ff7e1041f85 117136->117138 117162 7ff7e1042030 GetDC 117137->117162 117140 7ff7e1041fba SetWindowLongPtrW 117138->117140 117141 7ff7e1041f92 117138->117141 117147 7ff7e1041b90 117140->117147 117142 7ff7e1041fa4 EndDialog 117141->117142 117144 7ff7e1041faa 117141->117144 117142->117144 117172 7ff7e1042470 117147->117172 117151 7ff7e1041c43 SystemParametersInfoW 117152 7ff7e1041c77 117151->117152 117153 7ff7e1041c67 CreateFontIndirectW 117151->117153 117154 7ff7e1041c7a 8 API calls 117152->117154 117153->117154 117155 7ff7e1041e6a SendMessageW SendMessageW SendMessageW SendMessageW 117154->117155 117156 7ff7e1041ed7 SendMessageW SendMessageW GetClientRect 117154->117156 117155->117156 117157 7ff7e1041f1a 117156->117157 117158 7ff7e1041f38 117156->117158 117159 7ff7e1042030 17 API calls 117157->117159 117178 7ff7e104ad80 117158->117178 117159->117158 117163 7ff7e10420fd 117162->117163 117164 7ff7e104206d 117162->117164 117167 7ff7e1042102 MoveWindow MoveWindow MoveWindow MoveWindow 117163->117167 117165 7ff7e10420ab DrawTextW 117164->117165 117166 7ff7e104209f SelectObject 117164->117166 117168 7ff7e10420e1 ReleaseDC 117165->117168 117169 7ff7e10420d5 SelectObject 117165->117169 117166->117165 117170 7ff7e104ad80 _wfindfirst32i64 8 API calls 117167->117170 117168->117167 117169->117168 117171 7ff7e1042008 InvalidateRect 117170->117171 117171->117144 117173 7ff7e1042495 117172->117173 117187 7ff7e1053e38 117173->117187 117176 7ff7e104c210 117177 7ff7e104c1f0 117176->117177 117177->117151 117177->117177 117179 7ff7e104ad89 117178->117179 117180 7ff7e1041f48 117179->117180 117181 7ff7e104ae40 IsProcessorFeaturePresent 117179->117181 117182 7ff7e104ae58 117181->117182 117210 7ff7e104b034 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 117182->117210 117184 7ff7e104ae6b 117211 7ff7e104ae00 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 117184->117211 117189 7ff7e1053e92 117187->117189 117188 7ff7e1053eb7 117205 7ff7e1059ce4 37 API calls 2 library calls 117188->117205 117189->117188 117190 7ff7e1053ef3 117189->117190 117206 7ff7e10521f0 48 API calls _invalid_parameter_noinfo 117190->117206 117193 7ff7e1053ee1 117195 7ff7e104ad80 _wfindfirst32i64 8 API calls 117193->117195 117194 7ff7e1053f8e 117197 7ff7e1053fd4 117194->117197 117199 7ff7e1053fa9 117194->117199 117200 7ff7e1053ffa 117194->117200 117201 7ff7e1053fa0 117194->117201 117198 7ff7e1041bde GetDialogBaseUnits MulDiv MulDiv 117195->117198 117209 7ff7e1059e18 11 API calls 2 library calls 117197->117209 117198->117176 117207 7ff7e1059e18 11 API calls 2 library calls 117199->117207 117200->117197 117202 7ff7e1054004 117200->117202 117201->117197 117201->117199 117208 7ff7e1059e18 11 API calls 2 library calls 117202->117208 117205->117193 117206->117194 117207->117193 117208->117193 117209->117193 117210->117184 121063 7ffdfb004b10 GetFileType 121064 7ffdfb004b39 121063->121064 121065 7ffdfb004b47 GetConsoleMode 121063->121065 121066 7ffdfb004b59 121064->121066 121067 7ffdfb004b3d GetLastError 121064->121067 121065->121066 121068 7ffdfb004b60 GetCommState 121065->121068 121069 7ffdfb01ae00 8 API calls 121066->121069 121067->121065 121067->121066 121068->121066 121070 7ffdfb004b8f 121069->121070 121071 7ffdfaeda5a0 121072 7ffdfaeda5cc 121071->121072 121073 7ffdfaeda5b3 121071->121073 121076 7ffdfaf33a60 121072->121076 121075 7ffdfaeda5d1 121077 7ffdfafa3a00 28 API calls 121076->121077 121085 7ffdfaf33a80 121077->121085 121078 7ffdfaf33c05 LeaveCriticalSection 121110 7ffdfaf32d10 121078->121110 121082 7ffdfaf33c23 121086 7ffdfaf33c3d 121082->121086 121158 7ffdfaf28820 167 API calls 121082->121158 121083 7ffdfafd0f20 28 API calls 121083->121085 121085->121078 121085->121083 121091 7ffdfaf33b73 memmove 121085->121091 121093 7ffdfaf33bfd 121085->121093 121097 7ffdfaf33d75 121085->121097 121088 7ffdfaf33ccd 121086->121088 121096 7ffdfaf33cab 121086->121096 121086->121097 121087 7ffdfaf33d3a 121161 7ffdfafba7c0 53 API calls 121087->121161 121088->121087 121160 7ffdfaf7fff0 167 API calls 121088->121160 121090 7ffdfaf33d45 121162 7ffdfaf58b60 121090->121162 121091->121085 121093->121078 121096->121088 121159 7ffdfaf281b0 53 API calls 121096->121159 121101 7ffdfaf33dd2 LeaveCriticalSection 121097->121101 121106 7ffdfaf33db0 121097->121106 121101->121106 121102 7ffdfaf33e4e LeaveCriticalSection 121104 7ffdfb0195c0 121102->121104 121103 7ffdfaf33dbd 121103->121075 121105 7ffdfaf33e6e LeaveCriticalSection 121104->121105 121105->121075 121106->121102 121106->121103 121107 7ffdfaf33e46 121106->121107 121177 7ffdfafd0c00 28 API calls 121106->121177 121178 7ffdfafd0c00 28 API calls 121107->121178 121111 7ffdfafde7f0 83 API calls 121110->121111 121112 7ffdfaf32d2c 121111->121112 121113 7ffdfaf32d5a 121112->121113 121220 7ffdfaf81760 167 API calls 121112->121220 121179 7ffdfaf298c0 34 API calls 121113->121179 121116 7ffdfaf33070 121119 7ffdfaf33084 121116->121119 121224 7ffdfafa4170 53 API calls 121116->121224 121117 7ffdfafa3a00 28 API calls 121131 7ffdfaf32d79 121117->121131 121120 7ffdfaf330aa 121119->121120 121225 7ffdfafa4170 53 API calls 121119->121225 121132 7ffdfafde7f0 121120->121132 121123 7ffdfaf81760 167 API calls 121123->121131 121125 7ffdfafa4170 53 API calls 121125->121131 121126 7ffdfaf550f0 strchr strrchr strrchr 121126->121131 121127 7ffdfaf330c7 121129 7ffdfafbf9c0 29 API calls 121129->121131 121131->121116 121131->121117 121131->121123 121131->121125 121131->121126 121131->121127 121131->121129 121180 7ffdfaf73d30 121131->121180 121221 7ffdfafac800 194 API calls 121131->121221 121222 7ffdfafad7e0 112 API calls 121131->121222 121223 7ffdfaf29270 167 API calls 121131->121223 121147 7ffdfafde630 121132->121147 121134 7ffdfafde9f6 121136 7ffdfb01ae00 8 API calls 121134->121136 121137 7ffdfafdea0a 121136->121137 121137->121082 121138 7ffdfafde9c6 121139 7ffdfafbf9c0 29 API calls 121138->121139 121140 7ffdfafde9d2 LeaveCriticalSection 121139->121140 121140->121134 121142 7ffdfafde9b7 121143 7ffdfaf3fef0 30 API calls 121142->121143 121143->121138 121145 7ffdfafde6f7 memmove 121146 7ffdfafde774 121145->121146 121145->121147 121347 7ffdfafde420 62 API calls 121146->121347 121147->121132 121147->121134 121147->121138 121147->121142 121147->121145 121154 7ffdfafde72a 121147->121154 121344 7ffdfafd0c00 28 API calls 121147->121344 121349 7ffdfafde420 62 API calls 121147->121349 121350 7ffdfafde380 53 API calls 121147->121350 121149 7ffdfafde783 121348 7ffdfafde380 53 API calls 121149->121348 121151 7ffdfafde78e LeaveCriticalSection 121151->121082 121152 7ffdfafde767 LeaveCriticalSection 121152->121146 121154->121152 121155 7ffdfafde75f 121154->121155 121345 7ffdfafd0c00 28 API calls 121154->121345 121346 7ffdfafd0c00 28 API calls 121155->121346 121158->121086 121160->121088 121161->121090 121163 7ffdfaf58b74 121162->121163 121177->121107 121178->121102 121179->121131 121181 7ffdfaf73d63 121180->121181 121182 7ffdfaf73dfa 121181->121182 121183 7ffdfaf73d68 121181->121183 121184 7ffdfaf77420 183 API calls 121181->121184 121226 7ffdfaf75b20 TlsGetValue 121182->121226 121183->121131 121186 7ffdfaf73d88 121184->121186 121188 7ffdfaf73de4 121186->121188 121189 7ffdfaf73d8d 121186->121189 121187 7ffdfaf73e01 121190 7ffdfaf73e9d 121187->121190 121191 7ffdfaf73e0d 121187->121191 121188->121182 121192 7ffdfaf73d96 _errno 121188->121192 121189->121192 121201 7ffdfaf73da7 121189->121201 121194 7ffdfaf77420 183 API calls 121190->121194 121193 7ffdfaf73e87 121191->121193 121196 7ffdfafd0f20 28 API calls 121191->121196 121195 7ffdfaf73ddf 121192->121195 121193->121131 121197 7ffdfaf73eaa 121194->121197 121195->121131 121203 7ffdfaf73e17 121196->121203 121198 7ffdfaf74051 121197->121198 121199 7ffdfafd0f20 28 API calls 121197->121199 121198->121195 121296 7ffdfafa4170 53 API calls 121198->121296 121202 7ffdfaf73ecb 121199->121202 121201->121195 121288 7ffdfaf740c0 180 API calls 121201->121288 121207 7ffdfaf74023 121202->121207 121290 7ffdfaf740c0 180 API calls 121202->121290 121204 7ffdfaf740ab 121203->121204 121289 7ffdfafba7c0 53 API calls 121203->121289 121207->121198 121210 7ffdfaf74053 121207->121210 121212 7ffdfaf74049 121207->121212 121209 7ffdfaf73f21 121217 7ffdfaf73f3b 121209->121217 121291 7ffdfaf81760 167 API calls 121209->121291 121211 7ffdfaf7406a 121210->121211 121294 7ffdfafd0c00 28 API calls 121210->121294 121295 7ffdfafd10d0 24 API calls 121211->121295 121293 7ffdfafa4170 53 API calls 121212->121293 121217->121207 121219 7ffdfafbf9c0 29 API calls 121217->121219 121292 7ffdfaf7fff0 167 API calls 121217->121292 121219->121217 121220->121113 121221->121131 121222->121131 121223->121131 121224->121119 121225->121120 121229 7ffdfaf75b4e 121226->121229 121227 7ffdfaf75b9e 121297 7ffdfaf733b0 TlsGetValue 121227->121297 121229->121227 121231 7ffdfaf75b78 121229->121231 121238 7ffdfaf75cd4 121229->121238 121320 7ffdfafd1890 49 API calls 121231->121320 121232 7ffdfaf75bc1 121235 7ffdfaf735a0 52 API calls 121232->121235 121233 7ffdfaf75d90 121236 7ffdfaf77420 183 API calls 121233->121236 121237 7ffdfaf75bc9 121235->121237 121240 7ffdfaf75d99 121236->121240 121239 7ffdfaf737f0 50 API calls 121237->121239 121238->121187 121240->121238 121246 7ffdfaf75dbf 121240->121246 121248 7ffdfaf75dd9 _errno 121240->121248 121246->121238 121288->121195 121289->121193 121290->121209 121291->121217 121292->121217 121293->121198 121294->121211 121295->121198 121296->121195 121298 7ffdfaf733e2 121297->121298 121299 7ffdfaf7358b 121298->121299 121300 7ffdfaf7340b 121298->121300 121301 7ffdfaf7342e 121298->121301 121337 7ffdfafd1890 49 API calls 121300->121337 121302 7ffdfaf73466 121301->121302 121303 7ffdfaf734b6 LeaveCriticalSection 121301->121303 121338 7ffdfafa4170 53 API calls 121301->121338 121304 7ffdfaf73474 121302->121304 121339 7ffdfafd0c00 28 API calls 121302->121339 121306 7ffdfaf734c7 121303->121306 121314 7ffdfaf734d6 121303->121314 121308 7ffdfaf73480 121304->121308 121340 7ffdfafa4370 29 API calls 121304->121340 121342 7ffdfaf3fff0 49 API calls 121306->121342 121312 7ffdfaf734a2 121308->121312 121313 7ffdfaf7349d 121308->121313 121341 7ffdfb00b280 9 API calls 121312->121341 121313->121303 121316 7ffdfaf734e5 121314->121316 121317 7ffdfaf73537 memcmp 121314->121317 121316->121232 121316->121233 121317->121316 121318 7ffdfaf7354a 121317->121318 121318->121316 121343 7ffdfafa4170 53 API calls 121318->121343 121320->121227 121337->121301 121338->121302 121339->121304 121340->121308 121341->121313 121342->121314 121343->121316 121344->121147 121345->121155 121346->121152 121347->121149 121348->121151 121349->121147 121350->121147 121354 7ffdfaec5c21 121356 7ffdfaec5c5f 121354->121356 121355 7ffdfaec5c71 121357 7ffdfaec5caa strstr 121355->121357 121360 7ffdfaec5db1 121355->121360 121356->121355 121791 7ffdfaec8970 116 API calls 121356->121791 121359 7ffdfaec5cc6 121357->121359 121361 7ffdfaec5d16 121359->121361 121792 7ffdfaec8970 116 API calls 121359->121792 121363 7ffdfaf87f10 455 API calls 121360->121363 121372 7ffdfaec5e36 121360->121372 121361->121360 121364 7ffdfaec5d45 strstr 121361->121364 121363->121372 121365 7ffdfaec5d61 121364->121365 121365->121360 121793 7ffdfaec8970 116 API calls 121365->121793 121367 7ffdfaec5f7b 121368 7ffdfaf87f10 455 API calls 121367->121368 121406 7ffdfaec6fbb 121367->121406 121382 7ffdfaec5fb1 121368->121382 121369 7ffdfaec5ec3 strstr 121369->121372 121371 7ffdfaec6120 121583 7ffdfaf5bcc0 121371->121583 121372->121367 121372->121369 121372->121406 121486 7ffdfaf87f10 121372->121486 121794 7ffdfaec8970 116 API calls 121372->121794 121380 7ffdfaec605f strstr 121380->121382 121382->121371 121382->121380 121382->121406 121795 7ffdfaec8970 116 API calls 121382->121795 121409 7ffdfafba870 36 API calls 121406->121409 121412 7ffdfaec711a 121409->121412 121415 7ffdfafba870 36 API calls 121412->121415 121417 7ffdfaec713a 121415->121417 121416 7ffdfaec715a 121420 7ffdfafba870 36 API calls 121417->121420 121420->121416 121487 7ffdfaf87f29 121486->121487 121488 7ffdfaf87f8e 121487->121488 121489 7ffdfaf87f9a 121487->121489 121816 7ffdfafd0c00 28 API calls 121487->121816 121817 7ffdfafd0c00 28 API calls 121488->121817 121490 7ffdfaf883d2 121489->121490 121498 7ffdfaf8803f 121489->121498 121821 7ffdfafc2d10 167 API calls 121490->121821 121494 7ffdfaf883e1 121822 7ffdfafba7c0 53 API calls 121494->121822 121496 7ffdfaf883ec 121823 7ffdfafbb210 167 API calls 121496->121823 121499 7ffdfaf880f0 TlsAlloc 121498->121499 121500 7ffdfaf8810f TlsGetValue 121498->121500 121507 7ffdfaf880e0 121498->121507 121513 7ffdfaf880d1 121498->121513 121499->121500 121526 7ffdfaf88415 121499->121526 121503 7ffdfaf88135 121500->121503 121504 7ffdfaf88127 GetLastError 121500->121504 121502 7ffdfaf88370 memmove 121502->121507 121505 7ffdfaf8813a 121503->121505 121510 7ffdfaf88142 121503->121510 121504->121503 121504->121526 121818 7ffdfafd08b0 22 API calls 121505->121818 121506 7ffdfaf881ec 121506->121502 121507->121372 121509 7ffdfaf8813f 121509->121510 121511 7ffdfaf881fa GetProcessHeap HeapReAlloc 121510->121511 121514 7ffdfaf88174 121510->121514 121510->121526 121511->121513 121512 7ffdfaf88595 121512->121372 121513->121502 121513->121506 121513->121526 121514->121513 121515 7ffdfaf88253 memmove 121514->121515 121517 7ffdfaf88293 TlsGetValue 121515->121517 121518 7ffdfaf88274 TlsAlloc 121515->121518 121516 7ffdfafd0f20 28 API calls 121516->121526 121520 7ffdfaf882b9 121517->121520 121521 7ffdfaf882ab GetLastError 121517->121521 121518->121517 121518->121526 121522 7ffdfaf882c6 121520->121522 121523 7ffdfaf882be 121520->121523 121521->121520 121521->121526 121522->121526 121528 7ffdfaf882e3 GetProcessHeap HeapFree 121522->121528 121530 7ffdfaf88316 121522->121530 121819 7ffdfafd08b0 22 API calls 121523->121819 121526->121512 121526->121516 121529 7ffdfaf88528 memmove 121526->121529 121532 7ffdfaf885ba 121526->121532 121824 7ffdfaf7fff0 167 API calls 121526->121824 121527 7ffdfaf882c3 121527->121522 121528->121513 121529->121526 121530->121513 121820 7ffdfafd13d0 LeaveCriticalSection 121530->121820 121825 7ffdfaf898b0 169 API calls 121532->121825 121534 7ffdfaf88629 121535 7ffdfafd0f20 28 API calls 121534->121535 121580 7ffdfaf88799 121534->121580 121541 7ffdfaf8863d 121535->121541 121536 7ffdfaf8883d 121539 7ffdfaf8888b 121536->121539 121540 7ffdfaf888d4 121536->121540 121537 7ffdfaf887bf 121538 7ffdfafd0f20 28 API calls 121537->121538 121549 7ffdfaf887c4 121538->121549 121830 7ffdfafc2d10 167 API calls 121539->121830 121545 7ffdfaf8892a 121540->121545 121550 7ffdfaf88909 121540->121550 121551 7ffdfaf888e3 121540->121551 121543 7ffdfaf886a8 121541->121543 121544 7ffdfaf88701 121541->121544 121554 7ffdfaf88a69 121541->121554 121562 7ffdfafd0f20 28 API calls 121543->121562 121546 7ffdfafd0f20 28 API calls 121544->121546 121548 7ffdfaf8893c strpbrk 121545->121548 121581 7ffdfaf8898f 121545->121581 121553 7ffdfaf88706 121546->121553 121547 7ffdfaf8889a 121831 7ffdfafba7c0 53 API calls 121547->121831 121556 7ffdfaf88951 121548->121556 121548->121581 121549->121554 121828 7ffdfafba7c0 53 API calls 121549->121828 121835 7ffdfafc2d10 167 API calls 121550->121835 121833 7ffdfafc2d10 167 API calls 121551->121833 121568 7ffdfaecaed0 28 API calls 121553->121568 121559 7ffdfaf88833 121556->121559 121837 7ffdfaf88aa0 187 API calls 121556->121837 121559->121372 121560 7ffdfaf8891f 121836 7ffdfafba7c0 53 API calls 121560->121836 121561 7ffdfaf888a5 121832 7ffdfafbb210 167 API calls 121561->121832 121574 7ffdfaf886be 121562->121574 121563 7ffdfaf88811 121829 7ffdfafbb210 167 API calls 121563->121829 121564 7ffdfaf888f6 121834 7ffdfafba7c0 53 API calls 121564->121834 121570 7ffdfaf8875e 121568->121570 121573 7ffdfaecb470 430 API calls 121570->121573 121575 7ffdfaf8876b 121573->121575 121574->121553 121574->121554 121576 7ffdfaf886e1 memmove 121574->121576 121577 7ffdfaf88783 121575->121577 121826 7ffdfafa4170 53 API calls 121575->121826 121576->121553 121577->121580 121827 7ffdfafa4170 53 API calls 121577->121827 121580->121536 121580->121537 121580->121559 121581->121559 121838 7ffdfafdc2b0 tolower tolower tolower tolower 121581->121838 121839 7ffdfaf88aa0 187 API calls 121581->121839 121584 7ffdfaf5bcd3 121583->121584 121585 7ffdfaf5bcdf 121584->121585 121589 7ffdfaf5bde7 121584->121589 121840 7ffdfaec88a0 117 API calls 121585->121840 121587 7ffdfaf5bdc2 121841 7ffdfaec7260 59 API calls 121587->121841 121591 7ffdfaf58b60 36 API calls 121589->121591 121593 7ffdfaf5be7c 121589->121593 121590 7ffdfaec6128 121601 7ffdfaf3dd50 121590->121601 121598 7ffdfaf5be18 121591->121598 121592 7ffdfaf5be48 121594 7ffdfaf5be67 121592->121594 121843 7ffdfaec9830 112 API calls 121592->121843 121844 7ffdfaed0120 28 API calls 121593->121844 121594->121593 121597 7ffdfaf58b60 36 API calls 121594->121597 121597->121593 121598->121592 121842 7ffdfaec9830 112 API calls 121598->121842 121845 7ffdfafd7320 121601->121845 121791->121355 121792->121361 121793->121360 121794->121372 121795->121382 121816->121487 121817->121489 121818->121509 121819->121527 121820->121513 121821->121494 121822->121496 121823->121507 121824->121526 121825->121534 121826->121577 121827->121580 121828->121563 121829->121559 121830->121547 121831->121561 121832->121559 121833->121564 121834->121563 121835->121560 121836->121545 121837->121559 121838->121581 121839->121581 121840->121587 121841->121590 121842->121598 121843->121594 121861 7ffdfafdf160 121845->121861 121847 7ffdfafd7475 121848 7ffdfafd73d6 121848->121847 121851 7ffdfafd7423 121852 7ffdfafd740c 121862 7ffdfafdf1ec 121861->121862 121863 7ffdfafdf18c 121861->121863 121864 7ffdfafd0f20 28 API calls 121862->121864 121866 7ffdfafd0f20 28 API calls 121863->121866 121865 7ffdfafdf1f1 121864->121865 121882 7ffdfafdf2e0 121865->121882 121870 7ffdfafdf1a1 121866->121870 121868 7ffdfafdf25d 121871 7ffdfafd735d 121868->121871 121873 7ffdfafdf289 121868->121873 121875 7ffdfafdf27f 121868->121875 121869 7ffdfafdf1c8 memmove 121869->121865 121870->121865 121870->121869 121872 7ffdfafdf2cd 121870->121872 121871->121847 121871->121848 121871->121851 121871->121852 121874 7ffdfafdf2a0 121873->121874 121934 7ffdfafd0c00 28 API calls 121873->121934 121933 7ffdfafa4170 53 API calls 121875->121933 121883 7ffdfafdf31c 121882->121883 121886 7ffdfafdf33a 121882->121886 121885 7ffdfafd0f20 28 API calls 121883->121885 121884 7ffdfafdf3ef 121884->121868 121888 7ffdfafdf331 121885->121888 121886->121884 121953 7ffdfafa4170 53 API calls 121886->121953 121888->121886 121889 7ffdfafdf360 memmove 121888->121889 121890 7ffdfafdf410 121888->121890 121889->121886 121891 7ffdfafdf52f 121890->121891 121893 7ffdfafdf5b4 121890->121893 121897 7ffdfafdf4af 121890->121897 121899 7ffdfafdf545 121890->121899 121891->121899 121899->121893 121933->121871 121934->121874 121953->121884
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$Alloc$ProcessValue$ErrorLast$Free$fprintf$__acrt_iob_funcfflushmemset$AllocateCriticalLeaveSection
                                                                                                                                                                                      • String ID: ========= LA%d ==========$========= RAW ==========$========= SEARCH ==========$========= TREE FIXED ==========$TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage$e$null tree$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 1367412602-3696316794
                                                                                                                                                                                      • Opcode ID: 448348c26c59761b61ae5f20aead4e551f81dacf39cdb88d235045127f0a533d
                                                                                                                                                                                      • Instruction ID: c5c068bc8d5c2eb48eca56127d6d7d8913ac74225586b1e406bf6af48cb0cab2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 448348c26c59761b61ae5f20aead4e551f81dacf39cdb88d235045127f0a533d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0703C132B096428AEB59AF259564A7C33A1FF01BE4F144276DA2E47BDCDF3EE4518700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32 ref: 00007FFDFAEC4CA0
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsAlloc.KERNEL32 ref: 00007FFDFAFD0F2D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0F5B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetLastError.KERNEL32 ref: 00007FFDFAFD0F69
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: LeaveCriticalSection.KERNEL32 ref: 00007FFDFAFD100B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetProcessHeap.KERNEL32 ref: 00007FFDFAFD101F
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: HeapAlloc.KERNEL32 ref: 00007FFDFAFD1030
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • _wgetenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFDFAEC5257
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: TlsAlloc.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3A0D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: TlsGetValue.KERNEL32 ref: 00007FFDFAFA3A3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: GetLastError.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3A49
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: LeaveCriticalSection.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3AEB
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: GetProcessHeap.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3AFF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: RtlAllocateHeap.NTDLL(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3B10
                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00007FFDFAEC5310
                                                                                                                                                                                      • _wgetenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFDFAEC5326
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32 ref: 00007FFDFAEC5563
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocCriticalLeaveSection$ErrorLastProcessValue$Allocate_wgetenv$CurrentThread
                                                                                                                                                                                      • String ID: 1.1.0$1.2.11$2.0.1$8.6.12$::tcl$::tcl::Bgerror$::tcl::mathfunc$::tcl::mathop$::tcl::prefix$::tcl::unsupported$::tcl::unsupported::assemble$::tcl::unsupported::corotype$::tcl::unsupported::disassemble$::tcl::unsupported::getbytecode$::tcl::unsupported::representation$::tcl::unsupported::timerate$Can't create math function namespace$INNER$TCL_INTERP_DEBUG_FRAME$TCL_PKG_PREFER_LATEST$Tcl$TclOO$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$array$athop::$binary$binary decode$binary encode$builtin command with NULL object command proc and a NULL compile proc$can't create math operator namespace$cp1252$dian$dict$encoding$engine$failed to create math operator %s$file$form$hLevel$info$iso8859-1$namespace$namespace eval ::tcl::zlib {variable cmdcounter 0}$package ifneeded TclOO 1.1.0 {# Already present, OK?};namespace eval ::oo { variable version 1.1.0 };namespace eval ::oo { variable patchlevel 1.1.0 };$prefix$set$string$tcl$tcl::tommath$tcl_precision$threaded$unable to alloc %u bytes$wordSize$zlib$zlibVersion$%
                                                                                                                                                                                      • API String ID: 884990073-2957008561
                                                                                                                                                                                      • Opcode ID: 3fbbc2f405c584b97999043107d699864dbdad8187059dba32344acd556174c1
                                                                                                                                                                                      • Instruction ID: 00560948df3e8a8057aa75bbe8949b5f5e3e6c9bbd7e28e561310c7f071cc4a7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3fbbc2f405c584b97999043107d699864dbdad8187059dba32344acd556174c1
                                                                                                                                                                                      • Instruction Fuzzy Hash: B223BD36B09B8285EB19DF10E460AAA37A4FF45B98F044176DE6E0B7A9DF3DE154D300
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsAlloc.KERNEL32 ref: 00007FFDFAFD0F2D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0F5B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetLastError.KERNEL32 ref: 00007FFDFAFD0F69
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: LeaveCriticalSection.KERNEL32 ref: 00007FFDFAFD100B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetProcessHeap.KERNEL32 ref: 00007FFDFAFD101F
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: HeapAlloc.KERNEL32 ref: 00007FFDFAFD1030
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF1D7B5
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFC0A10: memmove.VCRUNTIME140(00000000,00000000,00000000,00007FFDFAFC083A,?,?,00000000,00007FFDFAF20F76,?,?,?,?,?,00007FFDFAF23B51), ref: 00007FFDFAFC0ACD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA4170: TlsGetValue.KERNEL32 ref: 00007FFDFAFA41CD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA4170: TlsGetValue.KERNEL32 ref: 00007FFDFAFA42A9
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF1D8B5
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF1D8F5
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF1D9B3
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF1DA10
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF1DB28
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: TlsAlloc.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3A0D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: TlsGetValue.KERNEL32 ref: 00007FFDFAFA3A3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: GetLastError.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3A49
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: LeaveCriticalSection.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3AEB
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: GetProcessHeap.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3AFF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: RtlAllocateHeap.NTDLL(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3B10
                                                                                                                                                                                      • TlsAlloc.KERNEL32 ref: 00007FFDFAF1DED8
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAF1DF01
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00007FFDFAF1DF0F
                                                                                                                                                                                      • GetProcessHeap.KERNEL32 ref: 00007FFDFAF1DF52
                                                                                                                                                                                      • HeapFree.KERNEL32 ref: 00007FFDFAF1DF60
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$memmove$Value$Alloc$ErrorLastProcess$AllocateCriticalLeaveSection$Free
                                                                                                                                                                                      • String ID: (parsing expression "%.*s%s")$in expression "%s%.*s%.*s%s%s%.*s%s"$ $ (invalid binary number?)$ (invalid octal number?)$ list$ or "%.*s%s(...)" or ...$ paren$%s called with shared object$...$BADCHAR$BADNUMBER$BAREWORD$BINARY$EMPTY$EXPR$MISSING$NOMEM$OCTAL$PARSE$PARTOP$SURPRISE$TCL$Tcl_AppendLimitedToObj$TlsGetValue failed from TclpGetAllocCache$UNBALANCED$_@_$acket$alloc: invalid block: %p: %x %x$could not allocate thread local storage$empty subexpression at %s$g "?"$incomplete operator "%.*s"$invalid bareword "%.*s%s"$invalid character "%.*s"$max # of tokens for a Tcl parse (%d) exceeded$missing function argument at %s$missing operand at %s$missing operator ":" at %s$missing operator at %s$paren$r "$"$should be "$%.*s%s" or "{%.*s%s}"$ssion$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 2421680649-577965725
                                                                                                                                                                                      • Opcode ID: 77b4da9a1e9c691406b13bb5946bb73e8d8d4276b8fdfdfd90f55416a113dad3
                                                                                                                                                                                      • Instruction ID: 5cfd9d6fdca1ad3527204456ca6d8d27cc81b93dab3f59e5cfabfb3adab4394b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 77b4da9a1e9c691406b13bb5946bb73e8d8d4276b8fdfdfd90f55416a113dad3
                                                                                                                                                                                      • Instruction Fuzzy Hash: E423E172B097829AE7288F15D464AA977B0FF847A0F144275EAAE4B7D9DF3CE441C700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: strstr
                                                                                                                                                                                      • String ID: 1.1.0$1.2.11$2.0.1$8.6.12$::tcl::mathfunc$::tcl::mathop$::tcl::unsupported$::tcl::unsupported::corotype$::tcl::unsupported::timerate$Tcl$TclOO$athop::$cp1252$dian$engine$form$hLevel$iso8859-1$namespace eval ::tcl::zlib {variable cmdcounter 0}$package ifneeded TclOO 1.1.0 {# Already present, OK?};namespace eval ::oo { variable version 1.1.0 };namespace eval ::oo { variable patchlevel 1.1.0 };$set$tcl$tcl::tommath$tcl_precision$threaded$wordSize$zlib$zlibVersion
                                                                                                                                                                                      • API String ID: 1392478783-3286498808
                                                                                                                                                                                      • Opcode ID: 871e43a98408413421b43261315b7018c20140580594fd19b213bbbd465795dc
                                                                                                                                                                                      • Instruction ID: 994d6c92ea1b580fa0f3444bde62a4cd02a1ed59004b13049e136026898f24a8
                                                                                                                                                                                      • Opcode Fuzzy Hash: 871e43a98408413421b43261315b7018c20140580594fd19b213bbbd465795dc
                                                                                                                                                                                      • Instruction Fuzzy Hash: E0A2F236B0978285EB29DF11E460AAA37A4FF45794F058175DA6E0B7E9EF3DE050C700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                                                                                      • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                      • API String ID: 2446303242-1601438679
                                                                                                                                                                                      • Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
                                                                                                                                                                                      • Instruction ID: fd96fa4c3bead2f91e2a7f975329ef243dbc4c3bd30437466efc052ce52748eb
                                                                                                                                                                                      • Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 27A13936318B81C6E714AF11E99579AB760F788B94F90413AEB8D03B24CFBDE165CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsAlloc.KERNEL32 ref: 00007FFDFAFD0F2D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0F5B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetLastError.KERNEL32 ref: 00007FFDFAFD0F69
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: LeaveCriticalSection.KERNEL32 ref: 00007FFDFAFD100B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetProcessHeap.KERNEL32 ref: 00007FFDFAFD101F
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: HeapAlloc.KERNEL32 ref: 00007FFDFAFD1030
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • GetModuleHandleW.KERNEL32 ref: 00007FFDFB00BFF9
                                                                                                                                                                                      • GetProcAddress.KERNEL32 ref: 00007FFDFB00C009
                                                                                                                                                                                      • GetVersionExW.KERNEL32 ref: 00007FFDFB00C032
                                                                                                                                                                                      • wsprintfA.USER32 ref: 00007FFDFB00C2D9
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFB00C344
                                                                                                                                                                                      • GetSystemInfo.KERNEL32 ref: 00007FFDFB00C047
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA4170: TlsGetValue.KERNEL32 ref: 00007FFDFAFA41CD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA4170: TlsGetValue.KERNEL32 ref: 00007FFDFAFA42A9
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: HeapValue$Alloc$ErrorLastProcess$AddressAllocateCriticalHandleInfoLeaveModuleProcSectionSystemVersionmemmovewsprintf
                                                                                                                                                                                      • String ID: %d.%d$HOME$HOMEPATH$NTDLL$RtlGetVersion$env$machine$platform$rator$tcl_platform$unable to alloc %u bytes$user$windows
                                                                                                                                                                                      • API String ID: 2342614320-3862273396
                                                                                                                                                                                      • Opcode ID: b0b0f28ce94256234b5ee012d7c755b3a141898aaaba70434e4f0f0b86167dc2
                                                                                                                                                                                      • Instruction ID: 6d0ebde0d84c3705903f4d09ba442f6117b3dfa37bffc58ef857454cc3f5b315
                                                                                                                                                                                      • Opcode Fuzzy Hash: b0b0f28ce94256234b5ee012d7c755b3a141898aaaba70434e4f0f0b86167dc2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3872A232B0A7838AE7199F11D460A6D77A0EF46B94F088135DA6E0B7EADF3CE550D740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$Initialize$Create$EnterEventLeavePerformanceQueryThread$CloseCounterFrequencyHandleObjectPrioritySingleWait
                                                                                                                                                                                      • String ID: gfffffff
                                                                                                                                                                                      • API String ID: 1584168963-1523873471
                                                                                                                                                                                      • Opcode ID: adc0f5351e5d77d2adf13962fef3e8524e85feb7c124935a7597a8cd33b13f5f
                                                                                                                                                                                      • Instruction ID: 4bdc2201ed3dc44a9550a05ed252279cc7055cdd5374a570cfc6ae62796c3227
                                                                                                                                                                                      • Opcode Fuzzy Hash: adc0f5351e5d77d2adf13962fef3e8524e85feb7c124935a7597a8cd33b13f5f
                                                                                                                                                                                      • Instruction Fuzzy Hash: CA515D70B0AA47A6EB14CB55F861A6563A2FB87744F545031D92E86AFCDF3CE048EB00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: strchr
                                                                                                                                                                                      • String ID: %s called with shared object$/$Tcl_SetObjLength$Tcl_SetObjLength: negative length requested: %d (integer overflow?)$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$max length for a Tcl unicode value (%d chars) exceeded$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 2830005266-3012010624
                                                                                                                                                                                      • Opcode ID: 4773d16a128783620066284ca8d54e88e5920f01cc11611b62bb0bde3de34d5d
                                                                                                                                                                                      • Instruction ID: c42e89b626a7402becc525a8e1c999700953944ff4ae68cbc2a7be320c32a7fa
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4773d16a128783620066284ca8d54e88e5920f01cc11611b62bb0bde3de34d5d
                                                                                                                                                                                      • Instruction Fuzzy Hash: AA529061B0964686EF6C9F15D170BB963A0EF81BA4F084275EA6E0F7DDDF2CE8518300
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: strpbrk
                                                                                                                                                                                      • String ID: %s called with shared object$*+?{}()[].\|^$$?-option ...? exp string subSpec ?varName?$Tcl_AppendUnicodeToObj$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$error while matching regular expression: $option
                                                                                                                                                                                      • API String ID: 3024680390-3371276473
                                                                                                                                                                                      • Opcode ID: 5641a16487d937ba2b6eb0806f40be8fa0af835b655aa67844479a023c4179e4
                                                                                                                                                                                      • Instruction ID: 424d0d139354507d46a547e4e7a8e34ba852368d8fba647ec0d57656ed0011d7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5641a16487d937ba2b6eb0806f40be8fa0af835b655aa67844479a023c4179e4
                                                                                                                                                                                      • Instruction Fuzzy Hash: C972B172B0864286DB28AF15E4A0A7E77A0FB44B84F054175EE5E47BD9DF3EE851CB00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heapmemchrmemmove$AllocErrorFreeLastProcessValue_errno
                                                                                                                                                                                      • String ID: Reuse of ChannelBuffer! %p$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$unable to alloc %u bytes$unknown output translation requested
                                                                                                                                                                                      • API String ID: 3069104407-1795497851
                                                                                                                                                                                      • Opcode ID: 3d1d4e5f22c81dee2221bb38f1ca7cbed82ba5eb6f14640df8fc2fa05dd74ae9
                                                                                                                                                                                      • Instruction ID: f7528f35427f158434b3f7a8be86a1adbf2b2cc0e93693f225045d24aef742b1
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3d1d4e5f22c81dee2221bb38f1ca7cbed82ba5eb6f14640df8fc2fa05dd74ae9
                                                                                                                                                                                      • Instruction Fuzzy Hash: DA129672B0868186EB68CF25E560B6AB7A1FF447A4F144235EA6D4B7D8DF3CE454CB00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEFD951
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAEFDAEE
                                                                                                                                                                                      • strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEFDBE5
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAEFDD15
                                                                                                                                                                                      • strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEFDE87
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: strncmp$Heapmemmove$AllocAllocateErrorLastProcessValue
                                                                                                                                                                                      • String ID: TclCompileIfCmd: unexpected opcode "%d" updating ifFalse jump$else$elseif$then$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 801516894-4224617882
                                                                                                                                                                                      • Opcode ID: d7ca882f586a4a72bcbcea64ef8949fb5145de1963c94b29c3b74bdcad4c27c7
                                                                                                                                                                                      • Instruction ID: 58811245bc20dfafcd91ee515f9dcf1905d994387aeac59479a6ba0730aba5ea
                                                                                                                                                                                      • Opcode Fuzzy Hash: d7ca882f586a4a72bcbcea64ef8949fb5145de1963c94b29c3b74bdcad4c27c7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A92A172B0868186EB24DF29D460B7D37A1FB84B98F044276DE5E47799DF39E841CB40
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1617910340-0
                                                                                                                                                                                      • Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
                                                                                                                                                                                      • Instruction ID: 6f04ec5f2802caac0a5287471991ba07b9a2719eb9f055022da73d4c7e3117b0
                                                                                                                                                                                      • Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 85C1D472B28A4285EB10EF64C4927AC7761FB48B98B814236DE2E9BBD5DF78D051C311
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove
                                                                                                                                                                                      • String ID: $Unexpected token type in TclCompileTokens: %d; %.*s$bad stack depth computations: is %i, should be %i$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 2162964266-2435792223
                                                                                                                                                                                      • Opcode ID: b039c1283823afac5f0830ea646f58badbb777625960477a56f6adf9aeb7a036
                                                                                                                                                                                      • Instruction ID: b04f8feb4ac1e4e4ea38ecba4a3774bbc1209a2907ea4568b0117aafb041f6eb
                                                                                                                                                                                      • Opcode Fuzzy Hash: b039c1283823afac5f0830ea646f58badbb777625960477a56f6adf9aeb7a036
                                                                                                                                                                                      • Instruction Fuzzy Hash: 03527032B0868186EB148F29D46066D77E0FB85BA8F544276EE5E8B7ADDF3CD441CB40
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocValue$Processmemmove$ErrorLast$AllocateCriticalFreeLeaveSection
                                                                                                                                                                                      • String ID: *[?\$EMPTY$EXPORT$IMPORT$INVALID$LOOKUP$NAMESPACE$ORIGIN$SELF$TCL$TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$auto_import$could not allocate thread local storage$import pattern "%s" tries to import from namespace "%s" into itself$invalid export pattern "%s": pattern can't specify a namespace$no namespace specified in import pattern "%s"$prefix$tern$unable to alloc %u bytes$unable to realloc %u bytes$unknown namespace in import pattern "%s"
                                                                                                                                                                                      • API String ID: 889677805-1655418526
                                                                                                                                                                                      • Opcode ID: da29e04b9e287efd8c54bfc4dd52f2f9883ee6bc00e2065b6e0eede7692e3de4
                                                                                                                                                                                      • Instruction ID: 4c102594484d125738bb89a6d652ab62a01332e160785776010b07d842d327f1
                                                                                                                                                                                      • Opcode Fuzzy Hash: da29e04b9e287efd8c54bfc4dd52f2f9883ee6bc00e2065b6e0eede7692e3de4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1C62B232B19B8286EB589B11E460AA973A0FF45BE4F148275EA6D4F7D9DF3CE401C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF0FA
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAFBF123
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF131
                                                                                                                                                                                      • memmove.VCRUNTIME140(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF1CB
                                                                                                                                                                                      • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF1D9
                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF20C
                                                                                                                                                                                      • HeapReAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF21D
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAFBF24C
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF25A
                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF298
                                                                                                                                                                                      • HeapFree.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF2A6
                                                                                                                                                                                      • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF367
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAFBF390
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF39E
                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF46E
                                                                                                                                                                                      • memmove.VCRUNTIME140(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF4CF
                                                                                                                                                                                      • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF4DD
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAFBF506
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF514
                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF552
                                                                                                                                                                                      • HeapFree.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF560
                                                                                                                                                                                      • TlsAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF5FC
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAFBF625
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF633
                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF6D2
                                                                                                                                                                                      • HeapReAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF6E3
                                                                                                                                                                                      • HeapReAlloc.KERNEL32(?,?,?,?,?,00000000,00007FFDFAFC37F5,?,00000000,00000000,?,?,?,00000000,00007FFDFAFC077E), ref: 00007FFDFAFBF47F
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$Alloc$ErrorLastProcessValue$Freememmove$Allocate
                                                                                                                                                                                      • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 1274204426-2645962790
                                                                                                                                                                                      • Opcode ID: d790fbe7e2b24364c75ffd1f0388ab286e1143e8569b825e312a06a0f4d8e2f6
                                                                                                                                                                                      • Instruction ID: ef92efe0c810e3b353e19a3cb6b7d5517def409d911ca8c8edf596da877e17de
                                                                                                                                                                                      • Opcode Fuzzy Hash: d790fbe7e2b24364c75ffd1f0388ab286e1143e8569b825e312a06a0f4d8e2f6
                                                                                                                                                                                      • Instruction Fuzzy Hash: F242D331B096439AEB188B25E42097877A1BF05BB4F148276EB2D4B7E9DF3DE415CB10
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$Initialize$malloc$AllocHeapLeaveValue$CurrentErrorLastProcessThreadmemset
                                                                                                                                                                                      • String ID: TlsGetValue failed from TclpGetAllocCache$TlsSetValue failed from TclpSetAllocCache$alloc: could not allocate new cache$could not allocate lock$could not allocate thread local storage
                                                                                                                                                                                      • API String ID: 2510295087-2583951768
                                                                                                                                                                                      • Opcode ID: 7739486442db3a8f0720ca2a92c364d070dea4b4dea3eb3c19542412d3bcd4d7
                                                                                                                                                                                      • Instruction ID: a17c807f446498ff2d074bc3097e4f05190b092e1551edd5f06b1237e1aaa348
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7739486442db3a8f0720ca2a92c364d070dea4b4dea3eb3c19542412d3bcd4d7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 53817E31B0AB0396FB198B25E874A7923A1AF86B54F544135E56E4B7FCEE3CE841D700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _fread_nolock$Message_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                      • API String ID: 2153230061-4158440160
                                                                                                                                                                                      • Opcode ID: e1a5486386f25456c49ba50dd24390edecf622e2ac0903947d63f3e706db3470
                                                                                                                                                                                      • Instruction ID: ed365d079f68785e9157c03fbba709a9125809c394d8adf7e5a5dbc66c30480c
                                                                                                                                                                                      • Opcode Fuzzy Hash: e1a5486386f25456c49ba50dd24390edecf622e2ac0903947d63f3e706db3470
                                                                                                                                                                                      • Instruction Fuzzy Hash: F2514171B1960686EB54EF28E492378B3A0FF48B44B918137DA0D87795DFBCE940C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: -encoding$-eofchar$?-encoding name? fileName$POSIX$couldn't read file "%s": %s$option
                                                                                                                                                                                      • API String ID: 0-807068319
                                                                                                                                                                                      • Opcode ID: 6b940c715999926e2b864402136a0c184218c1f10fcbf1095effc154d43f384f
                                                                                                                                                                                      • Instruction ID: 7ac86940a449f01af0f655aecf1b62569bc6cf8bd884315439e51596d737dab7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b940c715999926e2b864402136a0c184218c1f10fcbf1095effc154d43f384f
                                                                                                                                                                                      • Instruction Fuzzy Hash: FCA1C171B0874381EB189B12E560ABA6360BF45BE4F544276EE2E4BBDEDF3CE5058341
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                      • String ID: P%
                                                                                                                                                                                      • API String ID: 2147705588-2959514604
                                                                                                                                                                                      • Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
                                                                                                                                                                                      • Instruction ID: c7532c6cca579d1a8a28cfc9c1894c78bab0eb7d791f73b1d30807309c66f47a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
                                                                                                                                                                                      • Instruction Fuzzy Hash: FA5106266047A186D734AF22B4182BAF7A1FB98B61F004132EBCF43A84DF7CD045DB20
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: TlsAlloc.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3A0D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: TlsGetValue.KERNEL32 ref: 00007FFDFAFA3A3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: GetLastError.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3A49
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: LeaveCriticalSection.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3AEB
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: GetProcessHeap.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3AFF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: RtlAllocateHeap.NTDLL(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3B10
                                                                                                                                                                                      • TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFAEC1E21), ref: 00007FFDFAF1E7B4
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAF1E7DD
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFAEC1E21), ref: 00007FFDFAF1E7EB
                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFAEC1E21), ref: 00007FFDFAF1E82E
                                                                                                                                                                                      • HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFAEC1E21), ref: 00007FFDFAF1E83C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocErrorLastProcessValue$AllocateCriticalFreeLeaveSection
                                                                                                                                                                                      • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 519642381-3913693111
                                                                                                                                                                                      • Opcode ID: d4f4efd606878a837a1cb56768e42886ffffac27ee27ad45497e17d13588c971
                                                                                                                                                                                      • Instruction ID: c6b882bc7f1ed00b1865fa92d48f0bf8bb887104b2798cea2ffec70a48862e3c
                                                                                                                                                                                      • Opcode Fuzzy Hash: d4f4efd606878a837a1cb56768e42886ffffac27ee27ad45497e17d13588c971
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3BA1F032B0964296EB28CB15E464E7973A1FF45BA4F540271EA6E4FBD9DF3CE4418B00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocAllocateCriticalErrorLastLeaveProcessSectionValue
                                                                                                                                                                                      • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: could not allocate %d new objects$could not allocate thread local storage
                                                                                                                                                                                      • API String ID: 2943704024-3925149219
                                                                                                                                                                                      • Opcode ID: 7aec2fb2242547dcc9a6b30558387b8944e57ca54e7e0f7cd7b0a2c2b25e9dea
                                                                                                                                                                                      • Instruction ID: e3ca566a534f94e026196844ce5d9921603a47f3c2f8f7610201336575e2745c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7aec2fb2242547dcc9a6b30558387b8944e57ca54e7e0f7cd7b0a2c2b25e9dea
                                                                                                                                                                                      • Instruction Fuzzy Hash: C851697AB09B0287EB18CF25D4609A833A1FF95B54F144235DA2E8B7E9DF38E5518780
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAED6A4A
                                                                                                                                                                                      • fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAED6A53
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocAllocateErrorLastProcessValue__acrt_iob_funcfflush
                                                                                                                                                                                      • String ID: unable to alloc %u bytes$unable to alloc %u bytes, %s line %d
                                                                                                                                                                                      • API String ID: 2194035668-1299489142
                                                                                                                                                                                      • Opcode ID: 909d7bea4a36fe5167398167e1db79b72208cee326409ecad4e48291922882e3
                                                                                                                                                                                      • Instruction ID: 3ad25c73e8afefe0485bc5f16c809ccab56f1ad0440b9091622d54db111d780f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 909d7bea4a36fe5167398167e1db79b72208cee326409ecad4e48291922882e3
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1941EB31F1D74382FB2D9B15A460A792290EF457A4F145174EA6F4BBEDEE3DE4428B00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                      • API String ID: 2030045667-3659356012
                                                                                                                                                                                      • Opcode ID: 0eaa34c77096e12273ed78fe60ec8ab731058c7168a99290584786e0a7b6b8f4
                                                                                                                                                                                      • Instruction ID: 1305c5f6c87e22688e824d04bdb0865e4b7d6aeac403cd64f3b1ea1d2060a0b7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0eaa34c77096e12273ed78fe60ec8ab731058c7168a99290584786e0a7b6b8f4
                                                                                                                                                                                      • Instruction Fuzzy Hash: C8415D61B0864286EB24FB15F4823AAE3A0FF84794FD48433DE4D47A55EEBCF5428721
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAF75B36
                                                                                                                                                                                      • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000001,00000000,?,00007FFDFAF7731C,00000000,?,?,00007FFDFAF52735), ref: 00007FFDFAF75C0F
                                                                                                                                                                                      • memmove.VCRUNTIME140(?,?,00000001,00000000,?,00007FFDFAF7731C,00000000,?,?,00007FFDFAF52735), ref: 00007FFDFAF75D54
                                                                                                                                                                                      • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000001,00000000,?,00007FFDFAF7731C,00000000,?,?,00007FFDFAF52735), ref: 00007FFDFAF75DD9
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFB4950: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFAFB4954
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _errno$Valuememmove
                                                                                                                                                                                      • String ID: POSIX$error getting working directory name: %s$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2618899499-1593058708
                                                                                                                                                                                      • Opcode ID: b56d6be22c9ce7303e7f6caff70c558c1632cde223bed172cfd817977b61afa0
                                                                                                                                                                                      • Instruction ID: 081bfef1ac7a469f60f1496ba3a193da087db3bcb4678c51f7306840ca196a07
                                                                                                                                                                                      • Opcode Fuzzy Hash: b56d6be22c9ce7303e7f6caff70c558c1632cde223bed172cfd817977b61afa0
                                                                                                                                                                                      • Instruction Fuzzy Hash: 04C19231B0964346EB5DEB21A4749BD63A5AF44BA0F484675FE2E0F7DAEF2CE4408300
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF7E1043BA0: GetModuleFileNameW.KERNEL32(?,00007FF7E1043699), ref: 00007FF7E1043BD1
                                                                                                                                                                                      • SetDllDirectoryW.KERNEL32 ref: 00007FF7E10438A5
                                                                                                                                                                                        • Part of subcall function 00007FF7E1046990: GetEnvironmentVariableW.KERNEL32(00007FF7E10436E7), ref: 00007FF7E10469CA
                                                                                                                                                                                        • Part of subcall function 00007FF7E1046990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E10469E7
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                      • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                      • API String ID: 2344891160-3602715111
                                                                                                                                                                                      • Opcode ID: d72d6755e91ec0805e4d7ff0197ad9096bdc3b0d5469cfc577bc8114446ed841
                                                                                                                                                                                      • Instruction ID: 1f6a89982292649c280a3ee8668f3ecec52b9260dca59b53bf0c39dd87dc68a6
                                                                                                                                                                                      • Opcode Fuzzy Hash: d72d6755e91ec0805e4d7ff0197ad9096bdc3b0d5469cfc577bc8114446ed841
                                                                                                                                                                                      • Instruction Fuzzy Hash: 58B1A061A1C69395FB60FB2194933FDE290BF84784FC05137EA4D4B696EEBCE5048322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                      • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                      • API String ID: 2030045667-1655038675
                                                                                                                                                                                      • Opcode ID: e74d3391d67fdbaf81e95cb02dd5b8d88121a53d77a6aa5c6a00e76e1d529523
                                                                                                                                                                                      • Instruction ID: 140204831273d19b7894a7cad1ff581cd6d6c4549363e33ec01712c7c1df2fea
                                                                                                                                                                                      • Opcode Fuzzy Hash: e74d3391d67fdbaf81e95cb02dd5b8d88121a53d77a6aa5c6a00e76e1d529523
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4F51F362B0C68285EB20BB51E4823BAA290FB84794FC44133EE4D83795EFBCF555C312
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: TlsAlloc.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3A0D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: TlsGetValue.KERNEL32 ref: 00007FFDFAFA3A3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: GetLastError.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3A49
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: LeaveCriticalSection.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3AEB
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: GetProcessHeap.KERNEL32(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3AFF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA3A00: RtlAllocateHeap.NTDLL(?,?,?,?,00007FFDFAED3181), ref: 00007FFDFAFA3B10
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF33B84
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32 ref: 00007FFDFAF33C0C
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32 ref: 00007FFDFAF33E5C
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32 ref: 00007FFDFAF33E90
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalLeaveSection$Heap$AllocAllocateErrorLastProcessValuememmove
                                                                                                                                                                                      • String ID: FreeEncoding: refcount problem !!!$concurrent dictionary modification and search$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 4154961887-687981174
                                                                                                                                                                                      • Opcode ID: cb614876748cc00ebb1898b03cefbe9e013d7fda847beb972cac26f41e7e16c8
                                                                                                                                                                                      • Instruction ID: 7e9aeecda4831d1a5d6281953a4aa8bf03938f016b0bfadf5b51aa1863628afb
                                                                                                                                                                                      • Opcode Fuzzy Hash: cb614876748cc00ebb1898b03cefbe9e013d7fda847beb972cac26f41e7e16c8
                                                                                                                                                                                      • Instruction Fuzzy Hash: DFD18F32B09B4286EB18DB15D460AB923A1FF45BA4F4402B5EE6D4B7E8DF3CE4959340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 6f2067f9e2b798d7e4aa60285487f192dd8020c4dcad372bd04a148e1f9d7242
                                                                                                                                                                                      • Instruction ID: 4e0aa0140a3ff1cd725df88fd325c3d6fcb413c85be68b7f0ad2635046e9a9e7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f2067f9e2b798d7e4aa60285487f192dd8020c4dcad372bd04a148e1f9d7242
                                                                                                                                                                                      • Instruction Fuzzy Hash: CEC1D72290C68691EB70BB1594623BDBBA6FB80B80FD54132D94D07792DEFCF445C726
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalLeaveSection
                                                                                                                                                                                      • String ID: FreeEncoding: refcount problem !!!$PGV Initializer did not initialize$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 3988221542-1397560407
                                                                                                                                                                                      • Opcode ID: 285ec14e6a5189e0cdc2c3bcbfd95aaa3d34e38ff996c1b9878bc8f847608d4d
                                                                                                                                                                                      • Instruction ID: 65e9fc771bd27d410191a1b82c853f1ad1f1836dc7a8e8198a8e2672ea1d288c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 285ec14e6a5189e0cdc2c3bcbfd95aaa3d34e38ff996c1b9878bc8f847608d4d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3E817F32B09A4696EB5DDB21E460AB96360FF84B90F044575EE2E4BBDADF3CE451C340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                      • String ID: Unhandled exception in script
                                                                                                                                                                                      • API String ID: 3081866767-2699770090
                                                                                                                                                                                      • Opcode ID: fcf731bf2ceca6e070dbdbaa780c49a73cf052ed135755c936a54f607c2ce467
                                                                                                                                                                                      • Instruction ID: 221038b6d76983a0d2bfe3c046beaad839c71ae57e59333d2e5c3c2b5f29f770
                                                                                                                                                                                      • Opcode Fuzzy Hash: fcf731bf2ceca6e070dbdbaa780c49a73cf052ed135755c936a54f607c2ce467
                                                                                                                                                                                      • Instruction Fuzzy Hash: EC316372A08682C9EB24FF61E8562F9A360FF88794F840136EA4D4BB55DFBCD145C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Valuememset
                                                                                                                                                                                      • String ID: couldn't compile regular expression pattern: $unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2002874474-2728520199
                                                                                                                                                                                      • Opcode ID: d8d4fc421051624fdb666bffac6d28abc4984de05218feaa4a551a8e902f582c
                                                                                                                                                                                      • Instruction ID: de8c5ef32623fd40e8efef0232002bb87c3384599da7547c9140ff2dc6ba9b88
                                                                                                                                                                                      • Opcode Fuzzy Hash: d8d4fc421051624fdb666bffac6d28abc4984de05218feaa4a551a8e902f582c
                                                                                                                                                                                      • Instruction Fuzzy Hash: D832DF76605B868ADB94CF29D4907D933E4FB48B98F184236DE9C8B798EF34D450C760
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Valuememmove
                                                                                                                                                                                      • String ID: binary encoding is not available$iso8859-1$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 3450688660-1438692910
                                                                                                                                                                                      • Opcode ID: f5fa89a94d0f4bd546dd96de41f0e241f4b796b5ff879ba8bf79583666322753
                                                                                                                                                                                      • Instruction ID: db3ba840fabb07550e133c5ad39615be0773fb89e2d368fd52fd8cc41ca30fbd
                                                                                                                                                                                      • Opcode Fuzzy Hash: f5fa89a94d0f4bd546dd96de41f0e241f4b796b5ff879ba8bf79583666322753
                                                                                                                                                                                      • Instruction Fuzzy Hash: 66E19032B08B81C6D764CF15E464AAA73A4FB88B94F558235EE9D87798DF38D484CB40
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAEBD554
                                                                                                                                                                                      • memset.VCRUNTIME140 ref: 00007FFDFAEBD5A0
                                                                                                                                                                                      • memset.VCRUNTIME140 ref: 00007FFDFAEBD71B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAEBD8E8
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: HeapValuememset$AllocAllocateErrorLastProcessmemmove
                                                                                                                                                                                      • String ID: unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 756910810-2759121943
                                                                                                                                                                                      • Opcode ID: 386dfdbf1cf5f5abddfdadca6cd0bf3ebf13af2fc154fbdfeb8c208e86a25b97
                                                                                                                                                                                      • Instruction ID: db4cbdd087313d14f1fbeefa3f46ee3ba346c70afca26f43e6f7acc2d12a248c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 386dfdbf1cf5f5abddfdadca6cd0bf3ebf13af2fc154fbdfeb8c208e86a25b97
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0AC18F22B09A4686EB2CEF15D0A8AB963A4FB84B98F044172DE6E077DDDF39D441C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1452418845-0
                                                                                                                                                                                      • Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
                                                                                                                                                                                      • Instruction ID: 0c94d8f64f68ef283eeae1628e4ab55070aed244e9b9a728d5eee199a439df65
                                                                                                                                                                                      • Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 90312821E0C10345FB64BB65A5A33B9A291BF95384FC44037E90D8B6D3DEFCA8458273
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1279662727-0
                                                                                                                                                                                      • Opcode ID: 8a464286a4aee93ad09e46d96520f5fa22b2a313ca22bba1db5411dbdbef7e96
                                                                                                                                                                                      • Instruction ID: bb0e42dae40344a5bd18e309500fb0e9ac2171529744744d95ba623db277db9d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8a464286a4aee93ad09e46d96520f5fa22b2a313ca22bba1db5411dbdbef7e96
                                                                                                                                                                                      • Instruction Fuzzy Hash: F441D622E1878183F764AB2095213B9B2A0FF95774F509336E65C43AD1EFBCA1E08721
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1956198572-0
                                                                                                                                                                                      • Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                      • Instruction ID: 544960a468427fb05dc0d735dc098ec5587fcdaa55b85dd410e8450e4b0db253
                                                                                                                                                                                      • Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
                                                                                                                                                                                      • Instruction Fuzzy Hash: F211A921F1815282F754B769F5863B99292EF997C0FC48032FA4D06B9ECEBCE4C58211
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CommConsoleErrorFileLastModeStateType
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3984557487-0
                                                                                                                                                                                      • Opcode ID: df3899ba5c7bcf4194486d8c598b4dcc5bcbbffe54da283f66fc9673edaa1001
                                                                                                                                                                                      • Instruction ID: 6c2e89e5aa74bf67abcb95eb93e2959eb4ebeae186ba081f64d5975b58d19f8e
                                                                                                                                                                                      • Opcode Fuzzy Hash: df3899ba5c7bcf4194486d8c598b4dcc5bcbbffe54da283f66fc9673edaa1001
                                                                                                                                                                                      • Instruction Fuzzy Hash: A201752070D70395F7249B15A56073A62A9EF8ABD4F540134DA6E876FCDF2CD544D604
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _errno
                                                                                                                                                                                      • String ID: ctory$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2918714741-474272330
                                                                                                                                                                                      • Opcode ID: 370588595685c10ba0b25484e0deb38f5c9b1b4295ab6409faf2ff0ebc1e40a1
                                                                                                                                                                                      • Instruction ID: 27ce6588136c6d226897091b04b0ef2850ad7c41bf348e533597865e89bd9466
                                                                                                                                                                                      • Opcode Fuzzy Hash: 370588595685c10ba0b25484e0deb38f5c9b1b4295ab6409faf2ff0ebc1e40a1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 52A10322B09B4286EB198F25E460A7967A0FF44BA4F044375EE6D4B7E9DF3CE4858340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: strncmp
                                                                                                                                                                                      • String ID: ::tcl$::tcl::
                                                                                                                                                                                      • API String ID: 1114863663-1364682314
                                                                                                                                                                                      • Opcode ID: 8631ea1786f3035ca7ea24656db5dec360d6437ea2838b6ee3c0b2898ff992c4
                                                                                                                                                                                      • Instruction ID: 1e7e487a2e3fcb803f2f0deade6b77c34172b1b0b6296444cdfec78275085d5f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8631ea1786f3035ca7ea24656db5dec360d6437ea2838b6ee3c0b2898ff992c4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C915A32B09B8186DB68CF25E450AAD77A0FB89B94F540176EE5D4BB98DF38D941CB00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: name
                                                                                                                                                                                      • API String ID: 0-1579384326
                                                                                                                                                                                      • Opcode ID: 0ff29cf7af045aba3352e728221fb159f4cf0e13e58a0aeee67cd01ed567dbb8
                                                                                                                                                                                      • Instruction ID: 4fa5cc09c1c71a8bf3f81ecd5f096eb9602b381e87fae21074cad16f18f24000
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0ff29cf7af045aba3352e728221fb159f4cf0e13e58a0aeee67cd01ed567dbb8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 52110661F1C64381EB5CAB37A861ABA12909F89BD0F845170ED2F4B7C9EE2DD4824340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: Buffer Underflow, BUFFER_PADDING not enough
                                                                                                                                                                                      • API String ID: 0-3280121635
                                                                                                                                                                                      • Opcode ID: 8dd504d38ad0c54b9cea606a11ef04abcbdd2436c230b80057357f16f8e18235
                                                                                                                                                                                      • Instruction ID: dc949ba679131a982ef880acdb9f2d0aff43f6b743941d716ea72485b1fdf4b9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8dd504d38ad0c54b9cea606a11ef04abcbdd2436c230b80057357f16f8e18235
                                                                                                                                                                                      • Instruction Fuzzy Hash: CE817D76B14A418BEB14CFA9D450BAD33B1FB447A8F104239EE5D9BB98DB38E415CB40
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
                                                                                                                                                                                      • Instruction ID: e158ef74f5031020fdd0e038f848754a93a145f39f897a024e2cf382f2ab8a5a
                                                                                                                                                                                      • Opcode Fuzzy Hash: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F510C71B0924245EB64BE2994427F6F181BF84BB5F944732DE6D437C5CFBCD4018662
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • memmove.VCRUNTIME140(00000000,00000000,00000000,00007FFDFAFC083A,?,?,00000000,00007FFDFAF20F76,?,?,?,?,?,00007FFDFAF23B51), ref: 00007FFDFAFC0ACD
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove
                                                                                                                                                                                      • String ID: max size for a Tcl value (%d bytes) exceeded
                                                                                                                                                                                      • API String ID: 2162964266-746697796
                                                                                                                                                                                      • Opcode ID: 3d54c99d1ee26e2d90630fa92c230f6e633da87b05812106973fc2f82085c46d
                                                                                                                                                                                      • Instruction ID: 4259b30439a127beea84d4d3ca681c77446c6e8d010d16b6cfd7fc8a5782d530
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3d54c99d1ee26e2d90630fa92c230f6e633da87b05812106973fc2f82085c46d
                                                                                                                                                                                      • Instruction Fuzzy Hash: B021BD32B1865282EB288F56D564A39B721EF41FE0F158231EE6C1B7C9DF78E9428740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove
                                                                                                                                                                                      • String ID: unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2162964266-2759121943
                                                                                                                                                                                      • Opcode ID: fa50d15f4f4990d4f8c1d28e5dd00cd25684b0d147fca333fa93f7836b13eeb3
                                                                                                                                                                                      • Instruction ID: 0aef7a0ee143d7afe15ffa5c692bc373ba8e851560356b33537420e288351a1a
                                                                                                                                                                                      • Opcode Fuzzy Hash: fa50d15f4f4990d4f8c1d28e5dd00cd25684b0d147fca333fa93f7836b13eeb3
                                                                                                                                                                                      • Instruction Fuzzy Hash: D8219122B0AB4245E7088B51E8A073966A5EF84BF0F159275EB7E4B7D9DF3CE4418300
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindCloseChangeNotification.KERNEL32(?,?,?,00007FF7E1059EA5,?,?,00000000,00007FF7E1059F5A), ref: 00007FF7E105A096
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E1059EA5,?,?,00000000,00007FF7E1059F5A), ref: 00007FF7E105A0A0
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1687624791-0
                                                                                                                                                                                      • Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
                                                                                                                                                                                      • Instruction ID: d300ddf34335dc54b639d836822a31a2638d7dc61b0d76f08b1ff0ebee44762f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5321A411B2C68281FFB07765A4A637DD691AF447A4FC45237EA2E477C1CEFCA4458322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetFilePointerEx.KERNEL32(?,?,?,?,00000000,00007FF7E105B79D), ref: 00007FF7E105B650
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7E105B79D), ref: 00007FF7E105B65A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFileLastPointer
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2976181284-0
                                                                                                                                                                                      • Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
                                                                                                                                                                                      • Instruction ID: 1b9d6a4de71296517bd20ad02a00f11b7fad6c7c5002dd99e7f75402266e77ea
                                                                                                                                                                                      • Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C11B261718B8181DB20AB25A465269E762BB44BF4F944332EA7D0BBD9CFBCE0518711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
                                                                                                                                                                                      • Instruction ID: 9f735d6a5ad93de1760542cc329970f4376e3826f57aab0f4387e8e80554c8ba
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3241E33290860183EB34EB15A56237DB7A1FB95B40F901136DA8E876D1DFBCF402CB62
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _fread_nolock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 840049012-0
                                                                                                                                                                                      • Opcode ID: 13e4d2fea27d6b99e819d0dbea813c7653ff9bf5f38a0b5f5e3f51adb0c4691b
                                                                                                                                                                                      • Instruction ID: ffab27d8876b02eed598edc0378f20c81832e1a91ded142e423199c4c2a8e718
                                                                                                                                                                                      • Opcode Fuzzy Hash: 13e4d2fea27d6b99e819d0dbea813c7653ff9bf5f38a0b5f5e3f51adb0c4691b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8821E721B0829146FB22BB1265463FAE751BF45BD4FC84432EE4D07786CEBCE101C321
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
                                                                                                                                                                                      • Instruction ID: 868b2a69eb6fcdf5522e2d4934680969409dee25ef32672a26af9d6ecdb8595e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
                                                                                                                                                                                      • Instruction Fuzzy Hash: 39316021A1865285EB61BB55D8623B8AA90AF40B65FC10237EA1D473D2DFFCE4419733
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
                                                                                                                                                                                      • Instruction ID: 896287432fef2af73ca1a621a7c4b1a61c9a58435e4464493cdd5a978b1ced13
                                                                                                                                                                                      • Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 94115461B1C64181EF70BF5194223BDE6A0AF85B84FC44432EA4C57B96DFBCD4408F22
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
                                                                                                                                                                                      • Instruction ID: c71041890b31a645d177438231cd914c973ac1704b716ea7dfcb31b94a44ec97
                                                                                                                                                                                      • Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5721F672B18A8287DB70AF18E442379B7A0FB84B94F944236EB5D47AD9DF7CD4018B11
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
                                                                                                                                                                                      • Instruction ID: 0d773f157ec7c4d093b7622986e2811f76d90184e0c4ec486e54900c8a7883c0
                                                                                                                                                                                      • Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A010821A0874240EB10FB6699422B9E695FF45FE4F888632DE5C43BD6DEBCD4014711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7E105A8B6,?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E), ref: 00007FF7E105DD95
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                      • Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
                                                                                                                                                                                      • Instruction ID: 03345c39296eed3b4412e0237a7a1243b2303ca8f1a12edeccc303a9bb551631
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
                                                                                                                                                                                      • Instruction Fuzzy Hash: C6F06D64B1920280FFB4766299233B5D6845F88B90FCC9433C90E866C2EDBCE4808332
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(?,?,?,00007FF7E104FE44,?,?,?,00007FF7E1051356,?,?,?,?,?,00007FF7E1052949), ref: 00007FF7E105CB0A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                      • Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
                                                                                                                                                                                      • Instruction ID: a1ae283995eae3767b42e28753a0ba84da614203444b7cd764b8713a95d28732
                                                                                                                                                                                      • Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 83F05E10B0D34240FFB476B15A2377591984F487A0FC80632DC2E866C2EDFCA8809232
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF7E1047A30: MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047A6A
                                                                                                                                                                                      • LoadLibraryW.KERNEL32(?,?,00000000,00007FF7E10430BE), ref: 00007FF7E10471D3
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2592636585-0
                                                                                                                                                                                      • Opcode ID: 63080640ee8bd5a5197bc5957a639ee791a00d05320db4a40cef4a6e5ab977c0
                                                                                                                                                                                      • Instruction ID: 0b304261ae6ec1116b5574e0810fae94535db4e2d69b717ba54581a318e5400e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 63080640ee8bd5a5197bc5957a639ee791a00d05320db4a40cef4a6e5ab977c0
                                                                                                                                                                                      • Instruction Fuzzy Hash: 18E0CD11B1814582DF18B7B7F55757AE251AF8CFC0B989036EF0D47B56DD3CD4904A00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove$strpbrk
                                                                                                                                                                                      • String ID: *[?\$IMPORT$LOOKUP$LOOP$NAMESPACE$OVERWRITE$TCL$can't import command "%s": already exists$import pattern "%s" would create a loop containing command "%s"$unable to alloc %u bytes$unknown namespace in namespace forget pattern "%s"
                                                                                                                                                                                      • API String ID: 3827832660-877001382
                                                                                                                                                                                      • Opcode ID: effa4271a723d1a5984e840ba7d0a0657bbb071f1ce63c1add47c34f7285c39b
                                                                                                                                                                                      • Instruction ID: 53f6276a5246168096bc3c2f4e7d080ea49f5a11e12164b9f1e72b8477e4d9ff
                                                                                                                                                                                      • Opcode Fuzzy Hash: effa4271a723d1a5984e840ba7d0a0657bbb071f1ce63c1add47c34f7285c39b
                                                                                                                                                                                      • Instruction Fuzzy Hash: B1F1B266719A8285DB28CF11E460AAAA3A1FF45BE4F448271EA6D4F7DCDF3CE441C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTempPathW.KERNEL32(?,00000000,?,00007FF7E104674D), ref: 00007FF7E104681A
                                                                                                                                                                                        • Part of subcall function 00007FF7E1046990: GetEnvironmentVariableW.KERNEL32(00007FF7E10436E7), ref: 00007FF7E10469CA
                                                                                                                                                                                        • Part of subcall function 00007FF7E1046990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E10469E7
                                                                                                                                                                                        • Part of subcall function 00007FF7E10566B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E10566CD
                                                                                                                                                                                      • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7E10468D1
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042770: MessageBoxW.USER32 ref: 00007FF7E1042841
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                      • API String ID: 3752271684-1116378104
                                                                                                                                                                                      • Opcode ID: b4ad522e37175ac7074a900ecec4c645a4870e05ba81b0992846085732047fb7
                                                                                                                                                                                      • Instruction ID: 04c5c7397e8fd5fb0995f40bb918583899d2084b31a3fd2114145c6b74d61802
                                                                                                                                                                                      • Opcode Fuzzy Hash: b4ad522e37175ac7074a900ecec4c645a4870e05ba81b0992846085732047fb7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A519E11B1D64280FB64B76295A73FAD2615F89BE0FC41437ED0E87B97EDBCE4018222
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3140674995-0
                                                                                                                                                                                      • Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
                                                                                                                                                                                      • Instruction ID: 36a833de8078d959b7860b08c0cd357406b1f71f4961ee5dbd8d5c634de6d465
                                                                                                                                                                                      • Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
                                                                                                                                                                                      • Instruction Fuzzy Hash: 93311D72709A81C6EB60AF64E8813EDB365FB84744F84443ADA4E47A98DF7CD648C721
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E1064E65
                                                                                                                                                                                        • Part of subcall function 00007FF7E10647B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E10647CC
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: HeapFree.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E2E
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: GetLastError.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E38
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E1059DAF,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E1059DD9
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E1059DAF,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E1059DFE
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E1064E54
                                                                                                                                                                                        • Part of subcall function 00007FF7E1064818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E106482C
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650CA
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650DB
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650EC
                                                                                                                                                                                      • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E106532C), ref: 00007FF7E1065113
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4070488512-0
                                                                                                                                                                                      • Opcode ID: a9f1dad40c5644c1829df854b35cf2cff202b4769108a1d535aac39d904cb9be
                                                                                                                                                                                      • Instruction ID: a00442f71666b9808c62b0ed5741b5a187ff532359de14e5efa8142ff2930e2e
                                                                                                                                                                                      • Opcode Fuzzy Hash: a9f1dad40c5644c1829df854b35cf2cff202b4769108a1d535aac39d904cb9be
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6BD1C266B0825286E720BF21D9527B9A391FF447E4FC44137EA0D87A85DFBCE441C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1239891234-0
                                                                                                                                                                                      • Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
                                                                                                                                                                                      • Instruction ID: 79eb8c4da3f7d1fea9dba07eba6db3d05943b7ed9529bd979fdc85879e19d49e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
                                                                                                                                                                                      • Instruction Fuzzy Hash: 43318632618B81C6EB60EF25E8413AEB3A4FB88794F900136EA8D47B55DF7CC545C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2227656907-0
                                                                                                                                                                                      • Opcode ID: 0bdd7a8416f1e28eb8c09c6b5c037a8b7871395a979be626bc7410ef92a9cb5d
                                                                                                                                                                                      • Instruction ID: e07e0660dbfb4adddaefe29b9de8ae4fbf240d975e546b9f59092308f7356525
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0bdd7a8416f1e28eb8c09c6b5c037a8b7871395a979be626bc7410ef92a9cb5d
                                                                                                                                                                                      • Instruction Fuzzy Hash: B7B1B422B5869681EB61BB21D4123BDE391EB44BE4F845133E95E07F8DDEBCE541C322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650CA
                                                                                                                                                                                        • Part of subcall function 00007FF7E1064818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E106482C
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650DB
                                                                                                                                                                                        • Part of subcall function 00007FF7E10647B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E10647CC
                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF7E10650EC
                                                                                                                                                                                        • Part of subcall function 00007FF7E10647E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E10647FC
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: HeapFree.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E2E
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: GetLastError.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E38
                                                                                                                                                                                      • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E106532C), ref: 00007FF7E1065113
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3458911817-0
                                                                                                                                                                                      • Opcode ID: 8dda7e1bb43cce3069c61b2343a9d469707a009ccb87a98b23344d3931a91aef
                                                                                                                                                                                      • Instruction ID: 455dd86d165b7a9c4d7f528c6f387292a9727fa14431834dcc3f285330702228
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8dda7e1bb43cce3069c61b2343a9d469707a009ccb87a98b23344d3931a91aef
                                                                                                                                                                                      • Instruction Fuzzy Hash: A4519172B1864286E710FF21E9926B9E360FB48794FC44137EA4D87A95DFBCE4018761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                      • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                                                      • API String ID: 190572456-3109299426
                                                                                                                                                                                      • Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
                                                                                                                                                                                      • Instruction ID: e98b570a3872d988a2b578128e0772add45f41fc06d8b657578c12b967432d4a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
                                                                                                                                                                                      • Instruction Fuzzy Hash: 924276A4B0EB0791FB55FB05A892374A3A1BF44794BC46137D80E066A4EFFCE5588363
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                      • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                      • API String ID: 2238633743-1453502826
                                                                                                                                                                                      • Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
                                                                                                                                                                                      • Instruction ID: 814c9f532e1e004f61dc6bc73f265fdbb72e26aeb2a0cd16368cf7b664dad8c7
                                                                                                                                                                                      • Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
                                                                                                                                                                                      • Instruction Fuzzy Hash: C5E177A4B0DB43D0FB95FB54A992374A3A5AF04790BD45037D81E06AA4EFFCB5588233
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCD9E4
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDA02
                                                                                                                                                                                      • floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDA0F
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • frexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDA86
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDAD0
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDAE9
                                                                                                                                                                                      • memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDBB8
                                                                                                                                                                                      • memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDCA6
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDD32
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDD47
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDD60
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDD78
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDD8D
                                                                                                                                                                                      • floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDD9A
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDDAE
                                                                                                                                                                                      • log.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDDC3
                                                                                                                                                                                      • floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF403E3), ref: 00007FFDFAFCDDD0
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFFD700: memset.VCRUNTIME140 ref: 00007FFDFAFFD772
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFFD700: memset.VCRUNTIME140 ref: 00007FFDFAFFD7C7
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFFD700: memset.VCRUNTIME140 ref: 00007FFDFAFFD81C
                                                                                                                                                                                      • _finite.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,00000000,00007FFDFAECE3D4), ref: 00007FFDFAFCDE70
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memset$floor$Heap$AllocAllocateErrorLastProcessValue_finitefrexp
                                                                                                                                                                                      • String ID: $$ARITH$IOVERFLOW$This code doesn't work on a decimal machine!$integer value too large to represent$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 3499833082-1380351556
                                                                                                                                                                                      • Opcode ID: 4ad156a5fcbe808608cc6899c661ebd416b8fb9873c0f066ee60fc4c7652d06a
                                                                                                                                                                                      • Instruction ID: e3bdb95470e88a5a096b7b7fa97f8af94e1f7f7957663dd63144275d7e25c2bc
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ad156a5fcbe808608cc6899c661ebd416b8fb9873c0f066ee60fc4c7652d06a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 23F1DF20F19B4385F7068F24E8219F9A3A4AFA6754F158332E52D5A2F9EF7CE1819740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocHeap$CriticalErrorLastLeaveProcessSectionValue
                                                                                                                                                                                      • String ID: ?returnValue?$Adding a callback without an objProc?!$COROUTINE$ILLEGAL_YIELD$TCL$TlsGetValue failed from TclpGetAllocCache$YIELDTO_IN_DELETED$alloc: could not allocate %d new objects$command ?arg ...?$could not allocate thread local storage$routine$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 3042485339-3667751179
                                                                                                                                                                                      • Opcode ID: 80b921b93f77e484be61ab6f8e03bf50b637b4d704641d5b43511cf328c4ca61
                                                                                                                                                                                      • Instruction ID: 3ead0086b1f912b76fabf6637d98eb0a966dcabb5919bcc5863d7d6664dd863c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 80b921b93f77e484be61ab6f8e03bf50b637b4d704641d5b43511cf328c4ca61
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3022A172B09B4286E718DF15E8609A933B0FF49B84F184235EA6E477A9DF3DE591C340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _errno$CriticalLeaveSection$CreateCurrentDirectoryErrorLastPathProcessTempwsprintf
                                                                                                                                                                                      • String ID: %08x$POSIX$couldn't create temporary directory: %s$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 3574048100-965721635
                                                                                                                                                                                      • Opcode ID: 48737e653021d03f957c4ae68a7cef94f7384789ca8e46073c25dcfebec52895
                                                                                                                                                                                      • Instruction ID: da760703ba4b8f747fa3522ceb21e00b8241974aaf0750372c7f49faf501a263
                                                                                                                                                                                      • Opcode Fuzzy Hash: 48737e653021d03f957c4ae68a7cef94f7384789ca8e46073c25dcfebec52895
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2461F321B0A64396E7259B20E874BB92360BF86BC0F545231ED6E4B6FDDE3CE144A710
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: HeapValue$Alloc$ErrorLastProcess$CriticalFreeLeaveSectionmemmove
                                                                                                                                                                                      • String ID: in assembly code between lines $ and $%s called with shared object$Tcl_SetIntObj$TlsGetValue failed from TclpGetAllocCache$UpdateStringProc for type '%s' failed to create a valid string rep$alloc: invalid block: %p: %x %x$could not allocate thread local storage$end of assembly code
                                                                                                                                                                                      • API String ID: 1529791790-3490405775
                                                                                                                                                                                      • Opcode ID: 9f697b05aa562e8d796c46c3623b7c7422404320bc98c9960632f08aa60d61b7
                                                                                                                                                                                      • Instruction ID: 2db5eff96e6b9eed9ff6c2e0a103930b2b9a8ae160b1aafb82d43897b32d6b0c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9f697b05aa562e8d796c46c3623b7c7422404320bc98c9960632f08aa60d61b7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9991BE72B096428AEB18AF25D464A7873A0BF42B98F144171DA2E477EDDF3EE445C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFB00CB80: memmove.VCRUNTIME140(-000002E3,00007FFDFAF3E883), ref: 00007FFDFB00CBFE
                                                                                                                                                                                        • Part of subcall function 00007FFDFB00CB80: __p__wenviron.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFDFB00CC2B
                                                                                                                                                                                        • Part of subcall function 00007FFDFB00CB80: strchr.VCRUNTIME140 ref: 00007FFDFB00CC95
                                                                                                                                                                                        • Part of subcall function 00007FFDFB00CB80: memmove.VCRUNTIME140 ref: 00007FFDFB00CD02
                                                                                                                                                                                      • __p__wenviron.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFDFAF3E45E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __p__wenvironmemmove$strchr
                                                                                                                                                                                      • String ID: HOME$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 2527932689-1955587315
                                                                                                                                                                                      • Opcode ID: 1b17b8678858784d422a89cc9fa9f5d856f5fd62a4580f52aff073b9c2421a35
                                                                                                                                                                                      • Instruction ID: 5560e31767878d4748e518eafa15bf6f69c88dbc718ad01cf701bdfe55388d9f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1b17b8678858784d422a89cc9fa9f5d856f5fd62a4580f52aff073b9c2421a35
                                                                                                                                                                                      • Instruction Fuzzy Hash: A0A1B731B19B8255EB659B11E460BA967A0FF857A4F401271EA6E077ECDF3CD445CB00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                      • API String ID: 0-666925554
                                                                                                                                                                                      • Opcode ID: d688a316cc292031dcc73621609fcf7656465c7aec45e09d4687e66ef4bc8685
                                                                                                                                                                                      • Instruction ID: fbe836bd1c251a61c87332898b6cd0d0f7707ea5b51441b343d144707e3315fd
                                                                                                                                                                                      • Opcode Fuzzy Hash: d688a316cc292031dcc73621609fcf7656465c7aec45e09d4687e66ef4bc8685
                                                                                                                                                                                      • Instruction Fuzzy Hash: 59518D61B0864285EB10FB11A4967B9E3A0BF89BD4FC44133DE1D47B96EEBCF5458322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                                                      • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                      • API String ID: 4998090-2855260032
                                                                                                                                                                                      • Opcode ID: afe0335f483835bfa1af9566c6f92c9ab844b0dac3d7a31af4488caa6720d321
                                                                                                                                                                                      • Instruction ID: 84abd6dbd312e7b3e39acff3583d9a61d08a735408b669ba151228a984e10289
                                                                                                                                                                                      • Opcode Fuzzy Hash: afe0335f483835bfa1af9566c6f92c9ab844b0dac3d7a31af4488caa6720d321
                                                                                                                                                                                      • Instruction Fuzzy Hash: C841633161C682C2EB50BF60E4857AAB361FB84794F841232FA9E47AD5DFBCD444C761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocErrorFreeLastProcessValue
                                                                                                                                                                                      • String ID: %lu %ld %ld %ld %ld %ld %ld$TlsGetValue failed from TclpGetAllocCache$alloc: could not allocate %d new objects$alloc: invalid block: %p: %x %x$could not allocate thread local storage$shared$thread%p
                                                                                                                                                                                      • API String ID: 3216287067-481911188
                                                                                                                                                                                      • Opcode ID: e2dc0e0fc3bad6eae0e4b7e834c524aff7cd0846022070a7e4669c82e16029ef
                                                                                                                                                                                      • Instruction ID: 5677f35a7c8967a5e6f41831f0d3dae769c85e0d82fc228e74f4055554e3e3be
                                                                                                                                                                                      • Opcode Fuzzy Hash: e2dc0e0fc3bad6eae0e4b7e834c524aff7cd0846022070a7e4669c82e16029ef
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7B41D531F196438AEB298B29E46097873A1FF05B64F144271E96E4B7ECDE3DE442CB00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _errno
                                                                                                                                                                                      • String ID: POSIX$could not get modification time for file "%s"$could not read "%s": %s$could not set modification time for file "%s": %s$name ?time?
                                                                                                                                                                                      • API String ID: 2918714741-59889625
                                                                                                                                                                                      • Opcode ID: 8b4b377e1a8a83f422aeb42d449de3d573e8256209736df2a86833735bb96699
                                                                                                                                                                                      • Instruction ID: 30b1450fcffbbc2c52d6e4471406f239ff34283abe1b9f53f7a75bd72e57de7d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b4b377e1a8a83f422aeb42d449de3d573e8256209736df2a86833735bb96699
                                                                                                                                                                                      • Instruction Fuzzy Hash: D5716E21B0974341EB18BB11E421BBA63A1AF85FD0F484175EE2E4BBDEEF2DE4418340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _errno
                                                                                                                                                                                      • String ID: POSIX$could not get access time for file "%s"$could not read "%s": %s$could not set access time for file "%s": %s$name ?time?
                                                                                                                                                                                      • API String ID: 2918714741-2699740299
                                                                                                                                                                                      • Opcode ID: 15fb74685d6d64ee17a1c9e78ade161f086e53eb8a13873703fac48d773f5423
                                                                                                                                                                                      • Instruction ID: 6e9e17c8037159f6cb5846f158ec67fcb177f2d71a97dbd08a3fcbf23a51c85d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 15fb74685d6d64ee17a1c9e78ade161f086e53eb8a13873703fac48d773f5423
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5E716D21B0974341EB18AB52E461BBD63A0AF85BD0F484175EE6E4BBDEEF2DE4019340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$FreeProcess$AllocErrorLastValue
                                                                                                                                                                                      • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage
                                                                                                                                                                                      • API String ID: 157107479-4238949377
                                                                                                                                                                                      • Opcode ID: cef21fb2209174933050c63b88135c5fab54e939db4d621f4654072e209bbc38
                                                                                                                                                                                      • Instruction ID: c2af83238093f0ef861874520219ff01e5e805d9f32cd86983ea5ebbc489a80e
                                                                                                                                                                                      • Opcode Fuzzy Hash: cef21fb2209174933050c63b88135c5fab54e939db4d621f4654072e209bbc38
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8571C032B1DA4699EB288B15E42487873A4FF05BA4F180275EA6D4BBE8DF3CF441D740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocErrorFreeLastProcessValue
                                                                                                                                                                                      • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage$unable to alloc %u bytes$unknown type of resource limit
                                                                                                                                                                                      • API String ID: 3216287067-39447996
                                                                                                                                                                                      • Opcode ID: 4b3b57ff22dc69de1145238fbe2ddc67ca690c3b3bc31cfef8ce287bacb762e7
                                                                                                                                                                                      • Instruction ID: 69235204123147651c99a064d67a80fc79b19e891fc589fac55ee39aa6b8d47b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4b3b57ff22dc69de1145238fbe2ddc67ca690c3b3bc31cfef8ce287bacb762e7
                                                                                                                                                                                      • Instruction Fuzzy Hash: A771A432B09B4286E7288F25E46492873A4FF45BA4F244275EA6D4BBECDF3DE451C700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAFA5F5D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsAlloc.KERNEL32 ref: 00007FFDFAFD0F2D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0F5B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetLastError.KERNEL32 ref: 00007FFDFAFD0F69
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: LeaveCriticalSection.KERNEL32 ref: 00007FFDFAFD100B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetProcessHeap.KERNEL32 ref: 00007FFDFAFD101F
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: HeapAlloc.KERNEL32 ref: 00007FFDFAFD1030
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$Alloc$ErrorLastProcessValue$AllocateCriticalLeaveSectionmemmove
                                                                                                                                                                                      • String ID: %I64d$ARITH$INTEGER$IOVERFLOW$TCL$VALUE$expected integer but got "%s"$integer$integer value too large to represent$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2848724332-507667852
                                                                                                                                                                                      • Opcode ID: 66a301f35bfd6080a5f1f5e207581ccc3bff4b415b1d58fcac1b26a9ba169fc4
                                                                                                                                                                                      • Instruction ID: ca1607b8ffaf4abf4e57cf32915969e2909f7dc5b64c3a4fe112656f8b3855f0
                                                                                                                                                                                      • Opcode Fuzzy Hash: 66a301f35bfd6080a5f1f5e207581ccc3bff4b415b1d58fcac1b26a9ba169fc4
                                                                                                                                                                                      • Instruction Fuzzy Hash: CA91A032B0D74296EB288B11E8609B973A4FF867A0F444375EA6D4B7E9DF3CE5458700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsAlloc.KERNEL32 ref: 00007FFDFAFD0F2D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0F5B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetLastError.KERNEL32 ref: 00007FFDFAFD0F69
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: LeaveCriticalSection.KERNEL32 ref: 00007FFDFAFD100B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: GetProcessHeap.KERNEL32 ref: 00007FFDFAFD101F
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD0F20: HeapAlloc.KERNEL32 ref: 00007FFDFAFD1030
                                                                                                                                                                                      • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001B6), ref: 00007FFDFAF6BF62
                                                                                                                                                                                      • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001B6), ref: 00007FFDFAF6C008
                                                                                                                                                                                      • _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001B6), ref: 00007FFDFAF6C086
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _errno$AllocHeap$CriticalErrorLastLeaveProcessSectionValue
                                                                                                                                                                                      • String ID: ": $POSIX$UpdateStringProc for type '%s' failed to create a valid string rep$UpdateStringProc should not be invoked for type %s$error reading "$error writing "
                                                                                                                                                                                      • API String ID: 415169622-2859088037
                                                                                                                                                                                      • Opcode ID: 7023cd9f370e81c7512b10f6368770d57fc03541c6ea6aed27ba2336e46d06c6
                                                                                                                                                                                      • Instruction ID: 8e285e89a76ad7b241adb0ef4dea75da15de3cf6fcd941edefd48c97210c2374
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7023cd9f370e81c7512b10f6368770d57fc03541c6ea6aed27ba2336e46d06c6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 70229122B0978685EB689F52D160A7963A0FF85BE0F444276EE6E4F7D9DF3CE4418700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • TlsAlloc.KERNEL32(?,?,00000000,00007FFDFAF8BB57,?,?,?,00007FFDFAF8F300,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFAF8BC31
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAF8BC5F
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,00000000,00007FFDFAF8BB57,?,?,?,00007FFDFAF8F300,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFAF8BC6D
                                                                                                                                                                                      • GetProcessHeap.KERNEL32(?,?,00000000,00007FFDFAF8BB57,?,?,?,00007FFDFAF8F300,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFAF8BCB0
                                                                                                                                                                                      • HeapFree.KERNEL32(?,?,00000000,00007FFDFAF8BB57,?,?,?,00007FFDFAF8F300,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFAF8BCBE
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocErrorFreeLastProcessValue
                                                                                                                                                                                      • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: invalid block: %p: %x %x$could not allocate thread local storage$string
                                                                                                                                                                                      • API String ID: 3216287067-3987360097
                                                                                                                                                                                      • Opcode ID: 9cea75686b32982a063ee6af074b3da12c0a9bbc142104b61dd902e3f44a5a49
                                                                                                                                                                                      • Instruction ID: db9830106b10905873f2d3cbee1932a762cc5f9a6fefcc7f38607592d0b5fcc1
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9cea75686b32982a063ee6af074b3da12c0a9bbc142104b61dd902e3f44a5a49
                                                                                                                                                                                      • Instruction Fuzzy Hash: E5711632F4A64689EB588B25D474A7C2390EF05B64F948271E96D0F7EDDF2DE482C700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocHeap$CriticalErrorLastLeaveProcessSectionValue
                                                                                                                                                                                      • String ID: TlsGetValue failed from TclpGetAllocCache$alloc: could not allocate %d new objects$could not allocate thread local storage
                                                                                                                                                                                      • API String ID: 3042485339-3925149219
                                                                                                                                                                                      • Opcode ID: 4ecf4f56c6ddc563957e3acdb1f16a59e37e5d89c3276cf5e8853c3374b52e46
                                                                                                                                                                                      • Instruction ID: a8fec08048e448a2f9565cd563f8c28af23441085c8cb4f86b7e2ba028417cbe
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ecf4f56c6ddc563957e3acdb1f16a59e37e5d89c3276cf5e8853c3374b52e46
                                                                                                                                                                                      • Instruction Fuzzy Hash: A2818172B06B02C6EB58DF29E460A6D37A4FB49B84F240139DA6E873D8DF39D551C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00007FF7E10426A0), ref: 00007FF7E10474D7
                                                                                                                                                                                      • FormatMessageW.KERNEL32(00000000,00007FF7E10426A0), ref: 00007FF7E1047506
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32 ref: 00007FF7E104755C
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                      • API String ID: 2920928814-2573406579
                                                                                                                                                                                      • Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
                                                                                                                                                                                      • Instruction ID: c0865a6e1b20f85190cdb29f5d6ebbde017f0b25d7d39d182f4bcbdd9a959a87
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7D214431B18A8282F760BB11E882365B361FF48384FC40037E54D86A95DFFCE115C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAF42C07), ref: 00007FFDFAFA6CA3
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memset
                                                                                                                                                                                      • String ID: INTEGER$MEMORY$TCL$VALUE$expected integer but got "%s"$gnum$initialization failure in TclBNInitBignumFromWideUInt$integer$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2221118986-1120165249
                                                                                                                                                                                      • Opcode ID: b4ae9f55f56b05c9045b023cab8bf8a6030a28e9bfbb29fe916fe18a3db1e6a5
                                                                                                                                                                                      • Instruction ID: 04fe078b5bc4334c882984b48a14b642fa77d543921d8c0b908965152d0d2b91
                                                                                                                                                                                      • Opcode Fuzzy Hash: b4ae9f55f56b05c9045b023cab8bf8a6030a28e9bfbb29fe916fe18a3db1e6a5
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6FB19D72B0874282EB689F21D5209B973A0FF84BA4F148775EA6D4F6D9DF3CE5908340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: f$f$p$p$f
                                                                                                                                                                                      • API String ID: 3215553584-1325933183
                                                                                                                                                                                      • Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
                                                                                                                                                                                      • Instruction ID: 893050cba977d8074dd8c689e3a7c6833496573c73f10f3753ac75d7b1610a56
                                                                                                                                                                                      • Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9F125276E0C14386FB347A14A06677EF6A1FB80754FD44036D699466CCDBBCEA808B62
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: fprintf$__stdio_common_vfprintf
                                                                                                                                                                                      • String ID: constraints:$empties:$final cleanup:$initial cleanup:
                                                                                                                                                                                      • API String ID: 1660322318-4175063448
                                                                                                                                                                                      • Opcode ID: b3f18189a48317afbe1c421409d248b6ce03e0cf19461207ca95daa5661e2560
                                                                                                                                                                                      • Instruction ID: a627e09a9ed5b462ac77354216f0ebf738e5c8a140e045f91a5c2affdaba8679
                                                                                                                                                                                      • Opcode Fuzzy Hash: b3f18189a48317afbe1c421409d248b6ce03e0cf19461207ca95daa5661e2560
                                                                                                                                                                                      • Instruction Fuzzy Hash: 50A15C6AB09B4282EF6CAA16916893967A1FB45FC0F144472DE6E077DCCF3EE851C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _isnan.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFDFAFA545D
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFCDFF0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFAFA543D), ref: 00007FFDFAFCE049
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _errno_isnan
                                                                                                                                                                                      • String ID: DOUBLE$NAN$TCL$VALUE$floating-point number$mber$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 68835812-3797933468
                                                                                                                                                                                      • Opcode ID: e3da6b1240021f1425ddd3fe4ad5dcea381b660991eb5940c483d9c8cebbae1e
                                                                                                                                                                                      • Instruction ID: 6aa985d11b5fc109d7efaee972e301153ab50ab9d524ee5a5150bdab3e077b83
                                                                                                                                                                                      • Opcode Fuzzy Hash: e3da6b1240021f1425ddd3fe4ad5dcea381b660991eb5940c483d9c8cebbae1e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 82519D72B18B4286E7249F20E8209AA73A4FF85764F544375EE6D4B7E9DF3CE5848700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                      • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                      • API String ID: 2895956056-3524285272
                                                                                                                                                                                      • Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
                                                                                                                                                                                      • Instruction ID: c0779bcd39692deb3cd3dd7fe70fb270a02538bc22212b6946bba7ee1e08cf2c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9F411531A0878282DB20BB64E4563AAF364FB95364F900736E5AD47BD5DFBCD0448751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                      • API String ID: 849930591-393685449
                                                                                                                                                                                      • Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
                                                                                                                                                                                      • Instruction ID: 09834ffc68168695cc735180b486482c3eb6f3c2f5ab3b2887ea07adc0dc0c04
                                                                                                                                                                                      • Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 33E18172A087418AEB60EF65D4823ADB7A0FB55798F900136EE8D47B95CF7CE490C712
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAFD5BE5
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocAllocateErrorLastProcessValuememmove
                                                                                                                                                                                      • String ID: unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2400752958-2759121943
                                                                                                                                                                                      • Opcode ID: 87cfc95bd1181656f46faf5e08cd9fe413961ef4f5f7b60a812dfea5ea6799c7
                                                                                                                                                                                      • Instruction ID: 6679c080a7ff50fa1b42ddf3d9a1bb6e420f20b066f43178bbf45fa4d9fceb26
                                                                                                                                                                                      • Opcode Fuzzy Hash: 87cfc95bd1181656f46faf5e08cd9fe413961ef4f5f7b60a812dfea5ea6799c7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7FB19F32B0978286EB698F259460B7973A5FF44BA4F144275EEAE4B7DCDF38E4418700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,00000000,?,00007FF7E105E152,?,?,000001ADD1688BF8,00007FF7E105A223,?,?,?,00007FF7E105A11A,?,?,?,00007FF7E1055472), ref: 00007FF7E105DF34
                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00000000,?,00007FF7E105E152,?,?,000001ADD1688BF8,00007FF7E105A223,?,?,?,00007FF7E105A11A,?,?,?,00007FF7E1055472), ref: 00007FF7E105DF40
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressFreeLibraryProc
                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                      • API String ID: 3013587201-537541572
                                                                                                                                                                                      • Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
                                                                                                                                                                                      • Instruction ID: 7c8d539c82131e40031f9bce504c3e5eb0f3c319f33ed4018f21a0ba40da07a9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 42412821B1961281FB66FB129822775A391BF14BD0F884137DD0D47788EFBCE845D362
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • memmove.VCRUNTIME140(?,?,00000000,00007FFDFAF734A7,?,?,00000000,00007FFDFAF75BB9,?,?,00000001,00000000,?,00007FFDFAF7731C,00000000), ref: 00007FFDFB00B2E0
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove
                                                                                                                                                                                      • String ID: unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2162964266-2759121943
                                                                                                                                                                                      • Opcode ID: 7c692db06df052a48fd4cae3f11f071a8f39f782db376b643d8a22be39e496a1
                                                                                                                                                                                      • Instruction ID: 9f0cb11bb0dd36255a45d9ce119bca43d7d2d9ea5919e6e69f5954b1586b0e78
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c692db06df052a48fd4cae3f11f071a8f39f782db376b643d8a22be39e496a1
                                                                                                                                                                                      • Instruction Fuzzy Hash: B341D621B0974282EB149B69A46466A63A1FFC5BF4F185335E9BE47BF8DF3CD4428700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalFreeHeapLeaveSection$ProcessValue
                                                                                                                                                                                      • String ID: TlsFree failed from TclpFreeAllocCache$TlsSetValue failed from TclpFreeAllocCache
                                                                                                                                                                                      • API String ID: 3646568635-656207173
                                                                                                                                                                                      • Opcode ID: 55c436d2b59e5fdcf8b3a375b5c39f86846bdb702d290075fb9c33818ed5568b
                                                                                                                                                                                      • Instruction ID: 53ae714ef502b3bd45d650c065885c7740341c9bddee213352ecd416aa605bb3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 55c436d2b59e5fdcf8b3a375b5c39f86846bdb702d290075fb9c33818ed5568b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5C417421F1A60795EB189B16E9B1A752361BF86B84F409031D92E477FCDE2CF446D700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E104769F
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E10476EF
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                      • API String ID: 626452242-27947307
                                                                                                                                                                                      • Opcode ID: 5ee005bfa68d1885b58e359274b30c32f06a59b13ecab7989fa04de9f3a47bd2
                                                                                                                                                                                      • Instruction ID: f14d254c8659790c7c00a1e197210349e1ce57043d1d9b819e1fe8a701437e80
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5ee005bfa68d1885b58e359274b30c32f06a59b13ecab7989fa04de9f3a47bd2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3341A032A08B82C2D761EF11B88126AF7A5FB847A0FD84136DA8D47B95EFBCD051C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,00007FF7E1043699), ref: 00007FF7E1047B81
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,00007FF7E1043699), ref: 00007FF7E1047BF5
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                      • API String ID: 3723044601-27947307
                                                                                                                                                                                      • Opcode ID: 8b53d79f468dfdec202439f2cfc50ec12b2c6f4620d2deddc649c41771dd01b7
                                                                                                                                                                                      • Instruction ID: 207e492fc41a9bede0b49a861d64449fa16bd111322a4431bf80a12cb1cb1807
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b53d79f468dfdec202439f2cfc50ec12b2c6f4620d2deddc649c41771dd01b7
                                                                                                                                                                                      • Instruction Fuzzy Hash: CE21A031B08B4285EB50BF12E982279B361EB84B80FD44137CA0D43B55EFBCE441C321
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: strcmp
                                                                                                                                                                                      • String ID: DictUpdateInfo$ForeachInfo$JumptableInfo$NewForeachInfo
                                                                                                                                                                                      • API String ID: 1004003707-3419751045
                                                                                                                                                                                      • Opcode ID: 40789bdb1c2d8a5ceb0a258a9efeeaae4ead014685cc337e45a27c3e2aed49bc
                                                                                                                                                                                      • Instruction ID: f0bb4bc8ebc4f80a334e844abaf1abe092a45cdabcb87e672ea4c648c373ab13
                                                                                                                                                                                      • Opcode Fuzzy Hash: 40789bdb1c2d8a5ceb0a258a9efeeaae4ead014685cc337e45a27c3e2aed49bc
                                                                                                                                                                                      • Instruction Fuzzy Hash: 35014491F0A70355FB18AB56A8A18B012555F4A755F8820B2CD3E452FDFF2CE9E8E314
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: f$p$p
                                                                                                                                                                                      • API String ID: 3215553584-1995029353
                                                                                                                                                                                      • Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
                                                                                                                                                                                      • Instruction ID: 3d2ade6ff8a918f3573c39b17c1a0dc7bf344576015ad3dd97febfdf94c67470
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E127E62A0C14386FB34BB15D1667B9B6A5EB80750FC84037D68B466C4DBBCE984CB32
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF80855
                                                                                                                                                                                      • memmove.VCRUNTIME140(?,?,?,?,?,?,00000000,?,?,?,00007FFDFAF8C8BB,?,?,?,?,00000001), ref: 00007FFDFAF8068C
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA4170: TlsGetValue.KERNEL32 ref: 00007FFDFAFA41CD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFA4170: TlsGetValue.KERNEL32 ref: 00007FFDFAFA42A9
                                                                                                                                                                                      • memmove.VCRUNTIME140 ref: 00007FFDFAF808FB
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Valuememmove$Heap$AllocAllocateErrorLastProcess
                                                                                                                                                                                      • String ID: %s called with shared object$NewListInternalRep: expects postive element count$Tcl_ListObjReplace$max length of a Tcl list (%d elements) exceeded
                                                                                                                                                                                      • API String ID: 1686244845-2033594915
                                                                                                                                                                                      • Opcode ID: 6f5dc92299be0b52b90d4d8ee39ffb834766b2b5f02f7d6cb692b6ce7b028a4c
                                                                                                                                                                                      • Instruction ID: d7b0251d37e35bf01d4eaf27f33b97f9083fa64bb5a91d661e77ed5367891fb8
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f5dc92299be0b52b90d4d8ee39ffb834766b2b5f02f7d6cb692b6ce7b028a4c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0BF1B17274864286EB288F14D064A7973A1FF84B94F958235EA6D4F7D8DF3CE841C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                      • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                      • API String ID: 626452242-876015163
                                                                                                                                                                                      • Opcode ID: 8c8fc94a3a316f0b24509029cbef28a73f2b5ac174edd18fa299f3805d42354e
                                                                                                                                                                                      • Instruction ID: 8b5ded07451aa43928c5c79f6224e3f368dd122916388be3371d652fbdf06e65
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c8fc94a3a316f0b24509029cbef28a73f2b5ac174edd18fa299f3805d42354e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2741C032A18B42C2E761FF25A882279E7B5FB44790F945136EA8D47BA4EF7CD012C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF7E1047A30: MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047A6A
                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7E10467CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7E10464DF
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042770: MessageBoxW.USER32 ref: 00007FF7E1042841
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7E10464B6
                                                                                                                                                                                      • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7E104653A
                                                                                                                                                                                      • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7E10464F3
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                      • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                      • API String ID: 1662231829-3498232454
                                                                                                                                                                                      • Opcode ID: 2dc19ef5ba30c1755b370eb24f27a07330b7d4ecbeaa7c6206d14ea3a4c7ebc1
                                                                                                                                                                                      • Instruction ID: 27cc9412e4fcf0e71d94d9da5276501850687326ac1f3746fcc8f2dbb2ba6a72
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2dc19ef5ba30c1755b370eb24f27a07330b7d4ecbeaa7c6206d14ea3a4c7ebc1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3C316851B1C78281FB61F761A5973B9D251AF987C0FC44433DA4E4269AFEBCE5048722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CF6D
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CF7B
                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CFA5
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CFEB
                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF7E104D19A,?,?,?,00007FF7E104CE8C,?,?,00000001,00007FF7E104CAA9), ref: 00007FF7E104CFF7
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                      • API String ID: 2559590344-2084034818
                                                                                                                                                                                      • Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
                                                                                                                                                                                      • Instruction ID: d57573de2d56351a26f58fb7495b36cdc65d0e663194a6bbfe825ad0595f683b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7231E421B0A64291FF51BB02A542778A394FF08BA0FC94537ED1D0B784EFBCE4458722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047A6A
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047AF0
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                      • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                      • API String ID: 3723044601-876015163
                                                                                                                                                                                      • Opcode ID: 13c7105583b4bafff51af941118006f09f2c49fe6ed44ac5ad13a55b88dd0971
                                                                                                                                                                                      • Instruction ID: a1ffeb8dad59d1add64487a1fbb773f6b31f9e4f8bad584b91e48a0f096b711c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 13c7105583b4bafff51af941118006f09f2c49fe6ed44ac5ad13a55b88dd0971
                                                                                                                                                                                      • Instruction Fuzzy Hash: A0219622B08A4281EB50EB25F941269E361FF887C4FD84533DB4C83B69EFBCD5518711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A62F
                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A644
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A665
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A692
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A6A3
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A6B4
                                                                                                                                                                                      • SetLastError.KERNEL32(?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F,?,?,?,00007FF7E1059313), ref: 00007FF7E105A6CF
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                      • Opcode ID: 6b14f4b34ada3312421ba959f39f9715d9be68c8868fa5de67aefdf45a5e0ce4
                                                                                                                                                                                      • Instruction ID: cc7d78e6064134ee8d494b4c52fb6b11e8b8dc3ea93953257f3ff73fda862956
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b14f4b34ada3312421ba959f39f9715d9be68c8868fa5de67aefdf45a5e0ce4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2621ED20A0C64281FB7877215667379E2515F88BB0F944636D97E076D6DEBCA4418732
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                      • String ID: CONOUT$
                                                                                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                                                                                      • Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
                                                                                                                                                                                      • Instruction ID: 990f302916d4bc9d83845b5ad6e1a37c38457b4a9299fdccc76a3b9a8a9e4946
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 79116321B18A41C6F751BB56E856339B3A0FB88FE4F844236EA5E87B94CFBCD4048751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalLeaveSection$Valuememmove
                                                                                                                                                                                      • String ID: unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 286433870-2759121943
                                                                                                                                                                                      • Opcode ID: 3366eae35baf3794b6526b786fa2a7b0df7f123530f49ac93350af3bd4d9f808
                                                                                                                                                                                      • Instruction ID: a381fc6990d2f46c151a89879568d535f8c96449768b71d4c97bc90de37811f7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3366eae35baf3794b6526b786fa2a7b0df7f123530f49ac93350af3bd4d9f808
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0EA19D31B0AB4396EB09CB15E861A7833A1FF44BA0F144275EA6E4B7E9DF3CE4519340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove
                                                                                                                                                                                      • String ID: PACKAGE$TCL$VERSIONCONFLICT$conflicting versions provided for package "%s": %s, then %s$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2162964266-790331870
                                                                                                                                                                                      • Opcode ID: e9e03b9e19e99926658463ece1f2a09300b67473b22a79153f2f3d2374923d87
                                                                                                                                                                                      • Instruction ID: c85f39c168b02e1475f6f413cda97c619d2e2d96135c17ad84e5343c87198a4b
                                                                                                                                                                                      • Opcode Fuzzy Hash: e9e03b9e19e99926658463ece1f2a09300b67473b22a79153f2f3d2374923d87
                                                                                                                                                                                      • Instruction Fuzzy Hash: CF51C761B0964385EB589F11E420ABA6660FF84BE4F544672FE6E4B7DEDF3CD1018700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A7A7
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A7DD
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A80A
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A81B
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A82C
                                                                                                                                                                                      • SetLastError.KERNEL32(?,?,?,00007FF7E105444D,?,?,?,?,00007FF7E105DDA7,?,?,00000000,00007FF7E105A8B6,?,?,?), ref: 00007FF7E105A847
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                      • Opcode ID: de2209737f62c3ef05340c1457763ccac6bfd4de9bf3f87891e85fc6fda23dbb
                                                                                                                                                                                      • Instruction ID: 9110cb9d43fa90bf26f0c4225ed0c23171e4fffe7257860f02807169b14bf579
                                                                                                                                                                                      • Opcode Fuzzy Hash: de2209737f62c3ef05340c1457763ccac6bfd4de9bf3f87891e85fc6fda23dbb
                                                                                                                                                                                      • Instruction Fuzzy Hash: C3111D20E0C64282FB7877215A67379E1925F48BB0F944736E92E076D6DEBCE4428722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseHandle$MessageObjectPostSingleValueWait
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 799209308-0
                                                                                                                                                                                      • Opcode ID: c4e75f3bdfc47d41b308cb9dc0320f52b9791ed4f57f8219dea288ee6165fd1a
                                                                                                                                                                                      • Instruction ID: cdb4dbd98fdfbc6eb5a1addc4a5b776c7caabb69328043a5e07439706e5933f7
                                                                                                                                                                                      • Opcode Fuzzy Hash: c4e75f3bdfc47d41b308cb9dc0320f52b9791ed4f57f8219dea288ee6165fd1a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5D21FB35B0AA4292EB28CF11E4A1A382364FF85B49B545135CA5E1BBBCCF3CD440D750
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                      • String ID: csm$f
                                                                                                                                                                                      • API String ID: 2395640692-629598281
                                                                                                                                                                                      • Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
                                                                                                                                                                                      • Instruction ID: 8c4d3cb1481ec4a292faf98c3e9915f5e3983f22cd06e34d2a076dc43dc2872d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
                                                                                                                                                                                      • Instruction Fuzzy Hash: C251F232B0A60286DB94EF15E585B39B395FB44B88FD08132DE4A43788DFB8ED41C715
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _errno
                                                                                                                                                                                      • String ID: ?dirName?$POSIX$couldn't change working directory to "%s": %s$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2918714741-3219823474
                                                                                                                                                                                      • Opcode ID: d9244ce48333efdb07401c38c55561c40eb9cebfd85bd110e4532edf32de1292
                                                                                                                                                                                      • Instruction ID: d0e7bdd85d4b1e2c1e2f4f70e064f1c482347cbdbb5f890d34c4385016a02f2f
                                                                                                                                                                                      • Opcode Fuzzy Hash: d9244ce48333efdb07401c38c55561c40eb9cebfd85bd110e4532edf32de1292
                                                                                                                                                                                      • Instruction Fuzzy Hash: D041E625B0C64285EB18AB21E825BB963A0EF45BD4F184071EE6E4FBDEDF3DD4418740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: POSIX$could not read "%s": %s$name
                                                                                                                                                                                      • API String ID: 0-1677466472
                                                                                                                                                                                      • Opcode ID: 06cc34b37d7bff18a3db992db1dc8f8481133b72aac80bb876b750b7b01251c1
                                                                                                                                                                                      • Instruction ID: 11c9d251e69247c1b26c59d04d5277451cae16d37ebaaf86006baa1f04c4a71d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 06cc34b37d7bff18a3db992db1dc8f8481133b72aac80bb876b750b7b01251c1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 55318661B0864341EB18EB12E421AB973A1EF89FD0F444071ED6E4B7DEEE2DE4418340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E10474B0: GetLastError.KERNEL32(00000000,00007FF7E10426A0), ref: 00007FF7E10474D7
                                                                                                                                                                                        • Part of subcall function 00007FF7E10474B0: FormatMessageW.KERNEL32(00000000,00007FF7E10426A0), ref: 00007FF7E1047506
                                                                                                                                                                                        • Part of subcall function 00007FF7E1047A30: MultiByteToWideChar.KERNEL32 ref: 00007FF7E1047A6A
                                                                                                                                                                                      • MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      • MessageBoxA.USER32 ref: 00007FF7E1042748
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                                                                                      • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                      • API String ID: 2806210788-2410924014
                                                                                                                                                                                      • Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
                                                                                                                                                                                      • Instruction ID: efa7e181a82984fa4fbc1e8e33f8b426d20a7d67907f12ef4b9c76ef823cc612
                                                                                                                                                                                      • Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7531037272868191E720FB50E4927EAA364FB84784FC05037EA8D07A99DFBCD645CB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                      • Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
                                                                                                                                                                                      • Instruction ID: 1ec82e94c70e57324290006cc0de4c0b7ecf7c5d1c08bc329898e5e0c4cd7855
                                                                                                                                                                                      • Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
                                                                                                                                                                                      • Instruction Fuzzy Hash: C4F06261B1960281EB20BB25E457379A370EF897A1FD80637DA6D456F4CFBCD489C322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalLeaveSection$Value
                                                                                                                                                                                      • String ID: unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 3998971413-2759121943
                                                                                                                                                                                      • Opcode ID: 33eea7fc2408508d1587fa8f99e2aaca0098701af3cfd6a12b1192ce3552fd28
                                                                                                                                                                                      • Instruction ID: 75aafbe2088d22929ed9a2ebedf6daec24387eca2b775940cb8aaff2d3a44fe9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 33eea7fc2408508d1587fa8f99e2aaca0098701af3cfd6a12b1192ce3552fd28
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D318B22B09B4296EB189F11D56496873A0FB94B84F158031DF2E07BEDEF3DE8A4C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _set_statfp
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1156100317-0
                                                                                                                                                                                      • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                      • Instruction ID: b7e265ab75e35932adf61afb21d9aff4207f132402890ff4cea304cc4555cef2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9C11BF72F18B1706F794B224F45337594416F583A4F840233EA6E06ED6CEBCADC141A2
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A87F
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A89E
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A8C6
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A8D7
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF7E1059A73,?,?,00000000,00007FF7E1059D0E,?,?,?,?,?,00007FF7E10521EC), ref: 00007FF7E105A8E8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                      • Opcode ID: daef540501b22c12116ffc374b0892d30f9c5b790841e2ef32b7e795c096c5e6
                                                                                                                                                                                      • Instruction ID: 4e05def6f3cd5b2b266f23f9e6117f28049a5c3a8599d37b47945c6c1ed87bad
                                                                                                                                                                                      • Opcode Fuzzy Hash: daef540501b22c12116ffc374b0892d30f9c5b790841e2ef32b7e795c096c5e6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D113A20E0C24281FB78B325696737AE1916F447B0F844336E97E066D6DEBCE8428732
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A705
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A724
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A74C
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A75D
                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E1062433,?,?,?,00007FF7E105CB8C,?,?,00000000,00007FF7E1053A5F), ref: 00007FF7E105A76E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                      • Opcode ID: 73fca214f1e943932ff67b95d9a940e5d6c6a0bd2e4835b222ff28ae142fb13c
                                                                                                                                                                                      • Instruction ID: ac551a065b830b550dfce25c81ace21a910c7194cd705075c5a156b09b00b218
                                                                                                                                                                                      • Opcode Fuzzy Hash: 73fca214f1e943932ff67b95d9a940e5d6c6a0bd2e4835b222ff28ae142fb13c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3011D624E0820782FB78B62158373BAE2925F45770F944737E93E0A2D2DDBCB4419233
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: strpbrk
                                                                                                                                                                                      • String ID: *+?{}()[].\|^$$option
                                                                                                                                                                                      • API String ID: 3024680390-3479007431
                                                                                                                                                                                      • Opcode ID: 51891e65170d4cd63980b5184f7d55d085b2bacb1920e04d5d1d79dba0d3afbb
                                                                                                                                                                                      • Instruction ID: 2d6fdef6667f9a82cc36c5e2987418077957a8b9312bdb3697359f28f52511c8
                                                                                                                                                                                      • Opcode Fuzzy Hash: 51891e65170d4cd63980b5184f7d55d085b2bacb1920e04d5d1d79dba0d3afbb
                                                                                                                                                                                      • Instruction Fuzzy Hash: D2F1A032B0864686EB68EF15E4A0A7D77A0FB44B84F464175DE6E47798DF3EE841C700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                      • API String ID: 3215553584-1196891531
                                                                                                                                                                                      • Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
                                                                                                                                                                                      • Instruction ID: adebee2020230fe1e16de74801ae4b1aaa847facf62756bf1977417e6712d778
                                                                                                                                                                                      • Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 56819676E0D20287F7747E2581223F8BB90AB11B88FD58037CA4997696DFBDE5019723
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                                                                                      • Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
                                                                                                                                                                                      • Instruction ID: fd5ee2b284d1de3ec6a13d0e21df4cc1bd082bb31733233e610f358e93b21a64
                                                                                                                                                                                      • Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
                                                                                                                                                                                      • Instruction Fuzzy Hash: D1615A32A08B458AE710AF65D4813ADB7A0FB44B88F544236EF4D17B98CBBCE155C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                      • String ID: csm$csm
                                                                                                                                                                                      • API String ID: 3896166516-3733052814
                                                                                                                                                                                      • Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
                                                                                                                                                                                      • Instruction ID: fdb8ecf6dff1b6299dc37f3b29885f68c9655a1b7a75060e5af4ba9da59be0de
                                                                                                                                                                                      • Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
                                                                                                                                                                                      • Instruction Fuzzy Hash: CC51C47290834286EB74AF159185378B7A1FB58B88F944137EA8C47BD5DFBCE450CB22
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                      • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                      • API String ID: 1878133881-2410924014
                                                                                                                                                                                      • Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
                                                                                                                                                                                      • Instruction ID: bbafb996333b03628a94466efdfc3d0bb7db2290c24b9199a6e48fbbfa58f02e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D31327272868191E720FB50E4527EAA365FB84784FC04037EA8D47A99DFBCD345CB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __acrt_iob_funcfflush
                                                                                                                                                                                      • String ID: unable to realloc %u bytes$unable to realloc %u bytes, %s line %d
                                                                                                                                                                                      • API String ID: 1524832935-2415941218
                                                                                                                                                                                      • Opcode ID: eb339de1b40c2c36bb59a86b117425dba87444261a3546fb3f9a245d88d3eeb0
                                                                                                                                                                                      • Instruction ID: 10ce53af287686572399647553ff90f36e02c27fa879c85ea4716d7f870c1c57
                                                                                                                                                                                      • Opcode Fuzzy Hash: eb339de1b40c2c36bb59a86b117425dba87444261a3546fb3f9a245d88d3eeb0
                                                                                                                                                                                      • Instruction Fuzzy Hash: 19014C21F2830352FB2C679174A487915808F98390F185471EF2F0BBDEEE3CF8829600
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,00007FF7E1043699), ref: 00007FF7E1043BD1
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E1047744,?,?,?,?,?,?,?,?,?,?,?,00007FF7E104101D), ref: 00007FF7E1042654
                                                                                                                                                                                        • Part of subcall function 00007FF7E1042620: MessageBoxW.USER32 ref: 00007FF7E104272C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFileLastMessageModuleName
                                                                                                                                                                                      • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                      • API String ID: 2581892565-1977442011
                                                                                                                                                                                      • Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
                                                                                                                                                                                      • Instruction ID: c1f5c144d17d1ab88ef6418fac51fbd60d8f2056facc858d1333968207ec2272
                                                                                                                                                                                      • Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 19018421B1C652C5FB21B721E8873B99251AF48384FC01033D94E8A682EEFCE1448732
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAF8F51B
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAF8F5F9
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value$Heap$AllocAllocateErrorLastProcess
                                                                                                                                                                                      • String ID: ::oo::Obj%d$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 1174234723-2182450095
                                                                                                                                                                                      • Opcode ID: 842b2e917a2c09fb856af2543ad4d321fd7b5f85a4e3a876a49f1e24183e6ebe
                                                                                                                                                                                      • Instruction ID: 32488d7fde655026b863f5b69c828362788da50367238891228ed371063cb377
                                                                                                                                                                                      • Opcode Fuzzy Hash: 842b2e917a2c09fb856af2543ad4d321fd7b5f85a4e3a876a49f1e24183e6ebe
                                                                                                                                                                                      • Instruction Fuzzy Hash: B3E16F32B09B4289EB18DF15D460BA933A0FF84BA4F548275EA5E4B7A9DF3CE451C350
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2718003287-0
                                                                                                                                                                                      • Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
                                                                                                                                                                                      • Instruction ID: 2b71122a381e2bd1ae5bae1ce07fcaef6a5d526db142abc6ab7fa58eccbbe4df
                                                                                                                                                                                      • Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 22D10232B18A8489E720DF75D4513AC77B2FB04B98B848236DF4E97B99DE78E406C311
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E105C41B), ref: 00007FF7E105C54C
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E105C41B), ref: 00007FF7E105C5D7
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConsoleErrorLastMode
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 953036326-0
                                                                                                                                                                                      • Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
                                                                                                                                                                                      • Instruction ID: 9fbdd96ac681d9992da8d4d938099312ee08e9bcb19976300c0886d2f8502bbd
                                                                                                                                                                                      • Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
                                                                                                                                                                                      • Instruction Fuzzy Hash: C991F622F0865185F7B0AF6595613BDABA8FB04788FD45137DE0E56AC4CFB8E441C722
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • memmove.VCRUNTIME140(?,?,?,?,?,?,?,00007FFDFAFC09D8,?,?,...,00007FFDFAFC05A6,00000000,?,00000000,00007FFDFAFC0B50), ref: 00007FFDFAFC358C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocAllocateErrorLastProcessValuememmove
                                                                                                                                                                                      • String ID: ...$max length for a Tcl unicode value (%d chars) exceeded$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 2400752958-2201900064
                                                                                                                                                                                      • Opcode ID: 2832d9667087458240e3ecdf276886ac237c47e210b478f24938a7e461237683
                                                                                                                                                                                      • Instruction ID: ce68fa2995a433ed2cbed32eb1772f37c65e12b91db35f9e7bd939ad962ea5df
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2832d9667087458240e3ecdf276886ac237c47e210b478f24938a7e461237683
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5D61CF32B0864287E7298F16E054A79B7A0FF487A0F458275EB6E4B7D9DF3CE9518700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight$_isindst
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4170891091-0
                                                                                                                                                                                      • Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
                                                                                                                                                                                      • Instruction ID: 682776e61ada55a9617c3928bbe602820cea8a4fb0f03825a5feecc05ce00168
                                                                                                                                                                                      • Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 12510772F046114AFB24EF7499627BCE7A1BB00358FA44236ED5E52AD5DB7CB802C711
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                      • String ID: ::tcl::unsupported::inject$Assoc Data Key #%d$unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 3702945584-2847563002
                                                                                                                                                                                      • Opcode ID: 0e25a5c78041fea44e145f223f53175307c2c50c607c180526650f561f67ebbf
                                                                                                                                                                                      • Instruction ID: d3a9f70e0a7d8f8e463edf3e1cf6dfc57f32aba91458dc858758280a723fdaba
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e25a5c78041fea44e145f223f53175307c2c50c607c180526650f561f67ebbf
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B61DE32B09B4285EB58EB15E460AB933A4FF44B84F194071DA6E4B7E9DF3DE452C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • TlsGetValue.KERNEL32 ref: 00007FFDFAF733CC
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,00000000,00007FFDFAF75BB9,?,?,00000001,00000000,?,00007FFDFAF7731C,00000000,?,?,00007FFDFAF52735), ref: 00007FFDFAF734BD
                                                                                                                                                                                      • memcmp.VCRUNTIME140(?,?,00000000,00007FFDFAF75BB9,?,?,00000001,00000000,?,00007FFDFAF7731C,00000000,?,?,00007FFDFAF52735), ref: 00007FFDFAF73541
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalLeaveSectionValuememcmp
                                                                                                                                                                                      • String ID: unable to alloc %u bytes
                                                                                                                                                                                      • API String ID: 3882641495-2759121943
                                                                                                                                                                                      • Opcode ID: 5afe1a6b8c839204d1fbef5a6ec6508cfade4cfe7831a83a3e351aa3b621dd65
                                                                                                                                                                                      • Instruction ID: 63e3ce1006e08019408418bca8837f64cec46106c4d384b1a5df8875fe35f2b2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5afe1a6b8c839204d1fbef5a6ec6508cfade4cfe7831a83a3e351aa3b621dd65
                                                                                                                                                                                      • Instruction Fuzzy Hash: 49519E22B09A1396EB69DF25E461A7D2361EF44BA4F144371EA6E4B7EDDF3CE4408340
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • memmove.VCRUNTIME140(00000000,00000000,?,00007FFDFAEC4301), ref: 00007FFDFAF23CDA
                                                                                                                                                                                      • memmove.VCRUNTIME140(00000000,00000000,?,00007FFDFAEC4301), ref: 00007FFDFAF23CEC
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove
                                                                                                                                                                                      • String ID: unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 2162964266-3519456369
                                                                                                                                                                                      • Opcode ID: 5b4c40147b40ffe276e07f16ffea3d8669daf43d16e0590329613d1a8b4e6163
                                                                                                                                                                                      • Instruction ID: 2045c172573ea580dcbe3d52e8a357d1fa342a9566aead203b44523f5aaf6c07
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5b4c40147b40ffe276e07f16ffea3d8669daf43d16e0590329613d1a8b4e6163
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0651B1B2B09B4186D758DF14E4606A932A1FB84BA4F144336EE6D4B3E9DF38E441C740
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2780335769-0
                                                                                                                                                                                      • Opcode ID: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
                                                                                                                                                                                      • Instruction ID: 427e6230c297a7fcd97fccdb129c7e9e4670472a349d2480824769d22e208983
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F517022E186428AFB20EF64D4623BD73B1AF48768F504136DE0D97689EF78D445C762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove
                                                                                                                                                                                      • String ID: unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 2162964266-3519456369
                                                                                                                                                                                      • Opcode ID: f53c982b88076048340f8de0a51ec154e68386bdc3f055b548bf8595cecbdcad
                                                                                                                                                                                      • Instruction ID: 421f0f88c8d6ec0a192267bf769a505044bc305a041a391c980602c4a23fecc4
                                                                                                                                                                                      • Opcode Fuzzy Hash: f53c982b88076048340f8de0a51ec154e68386bdc3f055b548bf8595cecbdcad
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9731B332B04A4287EB15DF25E494AAAE3A1FB54B84F098135DB5E0B7A9DF3CE445C300
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AC1
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: TlsGetValue.KERNEL32 ref: 00007FFDFAFD0AEF
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0AFD
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFDFAFC00D6,?,?,00000000,00007FFDFAFC23CD), ref: 00007FFDFAFD0B3B
                                                                                                                                                                                        • Part of subcall function 00007FFDFAFD08B0: RtlAllocateHeap.NTDLL ref: 00007FFDFAFD0B49
                                                                                                                                                                                      • memmove.VCRUNTIME140(?,?,00000000,00007FFDFAF821A4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFDFAF82415
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$AllocAllocateErrorLastProcessValuememmove
                                                                                                                                                                                      • String ID: max size of Tcl literal array (%d literals) exceeded$unable to alloc %u bytes$unable to realloc %u bytes
                                                                                                                                                                                      • API String ID: 2400752958-186258196
                                                                                                                                                                                      • Opcode ID: 189047b6c04cb9e12bfb6b723c5c8e05ec6bb4d99d8c1302868816dae98ee10c
                                                                                                                                                                                      • Instruction ID: 8625b02d36732f87079f2a8526de45799c0b5d3ee74f8358e54e3ce483593cb7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 189047b6c04cb9e12bfb6b723c5c8e05ec6bb4d99d8c1302868816dae98ee10c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A317F72F0964286EB698F1594216B92391AF81BB4F184775EE3D4E7DEDF3CF8428210
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: atoistrncpy
                                                                                                                                                                                      • String ID: *** unknown regex error code 0x%x ***$REG_%u
                                                                                                                                                                                      • API String ID: 279862266-954403335
                                                                                                                                                                                      • Opcode ID: 12c228195ae0135e56650a04525358bd40e89772ce4808303ee0a6497af744a7
                                                                                                                                                                                      • Instruction ID: 9fa33e895a76618e1a77b06639c85063790bda46f51884540008469d05f6b776
                                                                                                                                                                                      • Opcode Fuzzy Hash: 12c228195ae0135e56650a04525358bd40e89772ce4808303ee0a6497af744a7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4941E4A1B0868385EB2C5B15D4A8BBD27A0BF01BD4F44A1B2C92E476DDDF2DF4448700
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: ?
                                                                                                                                                                                      • API String ID: 1286766494-1684325040
                                                                                                                                                                                      • Opcode ID: 8b5d587ec6f6b7eed71ba39116b338de031c50ce5c8dd23bba2b14458f06a6e4
                                                                                                                                                                                      • Instruction ID: 57fe290d97e32099b002e067e6475cba0f765b326356dc1fcb04aea0299d0aa1
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b5d587ec6f6b7eed71ba39116b338de031c50ce5c8dd23bba2b14458f06a6e4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7F41F612F0C28246FB60BB25941237AA690EF90BB4F944236EE5C46ED9DE7CD4518712
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E1057E9E
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: HeapFree.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E2E
                                                                                                                                                                                        • Part of subcall function 00007FF7E1059E18: GetLastError.KERNEL32(?,?,?,00007FF7E1061E42,?,?,?,00007FF7E1061E7F,?,?,00000000,00007FF7E1062345,?,?,?,00007FF7E1062277), ref: 00007FF7E1059E38
                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E104B105), ref: 00007FF7E1057EBC
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: C:\Users\user\Desktop\AccountChanger.exe
                                                                                                                                                                                      • API String ID: 3580290477-4189964347
                                                                                                                                                                                      • Opcode ID: 7be78eb059dea3495cc358456d23a898a8a026444ba3d0a56d0d7994263981b4
                                                                                                                                                                                      • Instruction ID: 0c699488ec86dad6203cb404ba39430607e02e8dd616a155af412b1364390228
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7be78eb059dea3495cc358456d23a898a8a026444ba3d0a56d0d7994263981b4
                                                                                                                                                                                      • Instruction Fuzzy Hash: DD419032A08B5285EB25FF2195622FCA7A4FB44780BD44037E90E47B85DF7CE841D322
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                      • String ID: U
                                                                                                                                                                                      • API String ID: 442123175-4171548499
                                                                                                                                                                                      • Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
                                                                                                                                                                                      • Instruction ID: 9c00c37599600af74c3c2e29d961efc69dd9fa040068affc255538df5b71ee02
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B41B432718A8182DB60EF65E4553A9B7A5FB88784FC04036EE4D87794DF7CD441C751
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentDirectory
                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                      • API String ID: 1611563598-336475711
                                                                                                                                                                                      • Opcode ID: 89ffee479c464830a404f371819462673addff3e4a0adbddceaf6599ad198d2e
                                                                                                                                                                                      • Instruction ID: 641d4aa8831fc045b598fb4019b01a388a3e2f3c1fc80c7c6e7b63e201f098e9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 89ffee479c464830a404f371819462673addff3e4a0adbddceaf6599ad198d2e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0621A562A0864181FB30AB15D46636DF3A1FB84B88FC54036D68D43684EFBCE9458762
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                      • String ID: Error detected
                                                                                                                                                                                      • API String ID: 1878133881-3513342764
                                                                                                                                                                                      • Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
                                                                                                                                                                                      • Instruction ID: 10a4c9e9767edb0b1bd89b155d9f50fb8a1ffc07309f1bb0736d6a93818f678b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B21747272868291FB21BB10F4927EAA354FB84788FC05137EA8D47A95DFBCD205C761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                      • String ID: Fatal error detected
                                                                                                                                                                                      • API String ID: 1878133881-4025702859
                                                                                                                                                                                      • Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
                                                                                                                                                                                      • Instruction ID: 5c1bcd0a3bcd35285378503e243c047af77d28bd405a0f1e1b048941f4b98dfc
                                                                                                                                                                                      • Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
                                                                                                                                                                                      • Instruction Fuzzy Hash: DC21627272868291FB20BB50F4927EAA354FB84788FC05136EA8D47A95DFBCD205C761
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                      • API String ID: 2573137834-1018135373
                                                                                                                                                                                      • Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
                                                                                                                                                                                      • Instruction ID: f72965a12610cc07d2e318d93197db78eb1aa9975ed957d0dc45d3f4e31fe81a
                                                                                                                                                                                      • Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
                                                                                                                                                                                      • Instruction Fuzzy Hash: FA115E32608B8182EB219F19F540369B7A4FB88B94F584232EF8C07B68DF7DD551CB00
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075079133.00007FF7E1041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1040000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075058994.00007FF7E1040000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075106604.00007FF7E106A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E107D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E1080000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075132784.00007FF7E108C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E108E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E1094000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075199439.00007FF7E109B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff7e1040000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                      • API String ID: 2595371189-336475711
                                                                                                                                                                                      • Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
                                                                                                                                                                                      • Instruction ID: 53c40a3d0911439521d1c3e37856dccac92930accf0daa8759a149ff65235325
                                                                                                                                                                                      • Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A01712191820286FB31BB6094633BEA3A0EF44704FC42037E64D82691DEBCD5449A26
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.3075695161.00007FFDFAEB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFDFAEB0000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.3075673104.00007FFDFAEB0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075805497.00007FFDFB01C000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075843591.00007FFDFB065000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.3075867362.00007FFDFB068000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffdfaeb0000_AccountChanger.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: memmove$memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3790616698-0
                                                                                                                                                                                      • Opcode ID: 93d9f196ad126b16907709f429de0acb1977784a31c51acbf9ff230a544787c4
                                                                                                                                                                                      • Instruction ID: 2d2526233b08c1039e48d93d879bae496893f9be1d5baf938300de5c499ecda3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 93d9f196ad126b16907709f429de0acb1977784a31c51acbf9ff230a544787c4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1841E122F0DB8689EB19DB68D4A02BC67A1AB11B84F554175CE2E63BEDDF3DD406C300
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%