Edit tour

Windows Analysis Report
AccoutChangersetup.exe

Overview

General Information

Sample name:	AccoutChangersetup.exe
Analysis ID:	1431269
MD5:	307639b090b992ebc59cf20903918d90
SHA1:	f88d0d80e62d3947c7c3dd5faeddb5eb18fc7cd8
SHA256:	fb489711e58eaa124bd751b53049964ba7e647e449c05feea4311feb77b2aacd
Tags:	exeStealer
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Found pyInstaller with non standard icon

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

AccoutChangersetup.exe (PID: 4324 cmdline: "C:\Users\user\Desktop\AccoutChangersetup.exe" MD5: 307639B090B992EBC59CF20903918D90)

AccoutChangersetup.tmp (PID: 6052 cmdline: "C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp" /SL5="$20470,18246292,90112,C:\Users\user\Desktop\AccoutChangersetup.exe" MD5: 71182B40469A9CAD1F21E451D7CF31BF)

AccountChanger.exe (PID: 1292 cmdline: "C:\AccountChanger\AccountChanger.exe" MD5: 874D9918AC068743FF1D236347FFA120)

AccountChanger.exe (PID: 1776 cmdline: "C:\AccountChanger\AccountChanger.exe" MD5: 874D9918AC068743FF1D236347FFA120)

cmd.exe (PID: 6976 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: AccoutChangersetup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3294398265.00007FF8B90B3000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F3F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3291690334.00007FF8B7EEC000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: AccountChanger.exe, 00000004.00000003.2347547959.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3295786417.00007FF8BA251000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: AccountChanger.exe, 00000005.00000002.3295463557.00007FF8B9F70000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3292741355.00007FF8B8B36000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3294825486.00007FF8B90FB000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3293271804.00007FF8B8CE7000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: AccountChanger.exe, 00000005.00000002.3292122162.00007FF8B8126000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: AccountChanger.exe, 00000005.00000002.3292122162.00007FF8B8126000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: AccountChanger.exe, 00000005.00000002.3294203045.00007FF8B9092000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3293914149.00007FF8B9063000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3294825486.00007FF8B90FB000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3293096753.00007FF8B8CD5000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3295065042.00007FF8B93CD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3292924630.00007FF8B8CB8000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3294593111.00007FF8B90C8000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3282303465.0000015D363C0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: AccountChanger.exe, 00000005.00000002.3290350063.00007FF8A8A61000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: AccountChanger.exe, 00000005.00000002.3293517963.00007FF8B8F7D000.00000002.00000001.01000000.00000015.sdmp

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00452A60 FindFirstFileA,GetLastError,	2_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00474F88 FindFirstFileA,FindNextFileA,FindClose,	2_2_00474F88
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004980A4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	2_2_004980A4
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	2_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00462750 FindFirstFileA,FindNextFileA,FindClose,	2_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	2_2_00463CDC
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF7589909B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00007FF7589909B4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758986714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	4_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758977820 FindFirstFileExW,FindClose,	4_2_00007FF758977820
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758986714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	4_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF7589909B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF7589909B4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758986714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	5_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758977820 FindFirstFileExW,FindClose,	5_2_00007FF758977820
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758986714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	5_2_00007FF758986714

Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat	Jump to behavior

Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38F82000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3287473971.0000015D3A5E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: AccountChanger.exe, 00000005.00000002.3284977658.0000015D395B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/vcpython27
Source: AccountChanger.exe, 00000005.00000002.3287163389.0000015D3A1C0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2470947110.0000015D3978E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2470947110.0000015D39799000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue23606)
Source: AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co8
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350222032.000001EDA3F43000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F41000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F41000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F3F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362884253.000001EDA3F44000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38CB0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2463841665.0000015D388AB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2463806655.0000015D38CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.dig
Source: AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/D
Source: AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/D8
Source: AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F3F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362884253.000001EDA3F44000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350222032.000001EDA3F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F41000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digk
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F41000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AccountChanger.exe, 00000005.00000002.3287473971.0000015D3A5E4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: AccountChanger.exe, 00000005.00000002.3286878095.0000015D39FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: AccountChanger.exe, 00000005.00000002.3286878095.0000015D39FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: AccountChanger.exe, 00000005.00000002.3284977658.0000015D395B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: AccountChanger.exe, 00000005.00000002.3283886903.0000015D38BB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://github.com/ActiveState/appdirs
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F41000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F41000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F3F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362884253.000001EDA3F44000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F3F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: AccountChanger.exe, 00000005.00000002.3283357072.0000015D386B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/19622133/
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tip.tcl.tk/48)
Source: AccountChanger.exe, 00000005.00000002.3287258878.0000015D3A2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354318470.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353152382.000001EDA3F41000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348540153.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2355015809.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2349886758.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: AccoutChangersetup.tmp, 00000002.00000003.2348304093.0000000002238000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: AccountChanger.exe, 00000004.00000003.2402793578.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402450812.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402292108.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402793578.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402292108.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402654445.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402654445.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402450812.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: AccoutChangersetup.tmp, AccoutChangersetup.tmp, 00000002.00000000.2039314837.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: AccoutChangersetup.exe, AccoutChangersetup.exe, 00000000.00000000.2035706447.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: AccoutChangersetup.exe, 00000000.00000000.2035706447.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: AccoutChangersetup.exe, 00000000.00000003.2038508264.0000000002370000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.exe, 00000000.00000003.2038741071.0000000002148000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.tmp, AccoutChangersetup.tmp, 00000002.00000000.2039314837.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: AccoutChangersetup.exe, 00000000.00000003.2038508264.0000000002370000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.exe, 00000000.00000003.2038741071.0000000002148000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.tmp, 00000002.00000000.2039314837.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: AccountChanger.exe, 00000004.00000003.2398290422.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2398290422.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html
Source: AccountChanger.exe, 00000005.00000002.3287028499.0000015D3A0B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botz
Source: AccountChanger.exe, 00000004.00000003.2380714897.000001EDA3F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.ghostscript.com/show_bug.cgi?id=698272)
Source: AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: AccountChanger.exe, 00000004.00000003.2380041326.000001EDA3F3B000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2363125113.000001EDA3F3A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2381574470.000001EDA3F3D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2381574470.000001EDA3F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/
Source: AccountChanger.exe, 00000004.00000003.2404575896.000001EDA3F3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2470832979.0000015D388ED000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2470832979.0000015D388ED000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: AccountChanger.exe, 00000005.00000003.2464828704.0000015D38D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/re.html
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/re.html#
Source: AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464828704.0000015D38CFF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2466342868.0000015D38D45000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464828704.0000015D38D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539#
Source: AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: AccountChanger.exe, 00000004.00000003.2399742696.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2399742696.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exe
Source: AccountChanger.exe, 00000005.00000002.3282343042.0000015D36433000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2459902063.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: AccountChanger.exe, 00000005.00000002.3284783282.0000015D393B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packagingSP
Source: AccountChanger.exe, 00000005.00000002.3283357072.0000015D386B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: AccountChanger.exe, 00000005.00000002.3286878095.0000015D39FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: AccountChanger.exe, 00000004.00000003.2363247984.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-pillow/Pillow/issues/1293
Source: AccountChanger.exe, 00000005.00000003.2459902063.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3282844467.0000015D38070000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: AccountChanger.exe, 00000005.00000002.3282343042.0000015D36433000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2459902063.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: AccountChanger.exe, 00000005.00000002.3282343042.0000015D36433000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2459902063.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: AccountChanger.exe, 00000005.00000002.3285169192.0000015D39735000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: AccountChanger.exe, 00000005.00000002.3282844467.0000015D38070000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: AccountChanger.exe, 00000005.00000002.3285169192.0000015D3977D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283255304.0000015D385B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A688000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3285169192.0000015D3977D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: AccountChanger.exe, 00000005.00000003.2465661770.0000015D388E0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464018093.0000015D388E8000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2462706633.0000015D388D0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2462821642.0000015D38878000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2462921582.0000015D388D0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2465201264.0000015D388D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: AccountChanger.exe, 00000005.00000002.3284783282.0000015D393B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
Source: AccountChanger.exe, 00000005.00000002.3287163389.0000015D3A1C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309#30631309
Source: AccountChanger.exe, 00000005.00000002.3286878095.0000015D39FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666#70724666
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2467168296.0000015D38D63000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38CB0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464828704.0000015D38CFF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2466342868.0000015D38D45000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464828704.0000015D38D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: AccountChanger.exe, 00000004.00000003.2457347804.000001EDA3F3F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000002.3282342733.000001EDA3F3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.apple.com/en-us/HT201236
Source: AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/
Source: AccountChanger.exe, 00000005.00000002.3287163389.0000015D3A1C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: AccountChanger.exe, 00000005.00000002.3287258878.0000015D3A2D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: AccountChanger.exe, 00000004.00000003.2380041326.000001EDA3F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu
Source: AccountChanger.exe, 00000005.00000002.3282343042.0000015D36433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: AccoutChangersetup.tmp, 00000002.00000003.2348304093.0000000002238000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.accountchanger.online/
Source: AccoutChangersetup.exe, 00000000.00000003.2350311833.0000000002140000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.exe, 00000000.00000003.2038181630.0000000002141000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.tmp, 00000002.00000003.2040827676.0000000002238000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.tmp, 00000002.00000003.2348304093.0000000002238000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.accountchanger.online/2
Source: AccountChanger.exe, 00000004.00000003.2361924842.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2361159759.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3292236939.00007FF8B815B000.00000002.00000001.01000000.00000016.sdmp, AccountChanger.exe, 00000005.00000002.3290674468.00007FF8A8AD6000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: AccountChanger.exe, 00000005.00000002.3285169192.0000015D3977D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: AccountChanger.exe, 00000005.00000002.3283357072.0000015D386B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: AccountChanger.exe, 00000005.00000002.3282844467.0000015D38070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: AccountChanger.exe, 00000005.00000002.3285169192.0000015D39735000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: C:\AccountChanger\AccountChanger.exe

Code function: 5_2_00007FF8A8492AD0 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

5_2_00007FF8A8492AD0

Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8492AD0 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	5_2_00007FF8A8492AD0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8448C00 GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,	5_2_00007FF8A8448C00
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8448DD0 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	5_2_00007FF8A8448DD0

Source: C:\AccountChanger\AccountChanger.exe

Code function: 5_2_00007FF8A84486A0 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GetLocaleInfoA,GlobalUnlock,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,

5_2_00007FF8A84486A0

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00423B84 NtdllDefWindowProc_A,	2_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004125D8 NtdllDefWindowProc_A,	2_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00478AC0 NtdllDefWindowProc_A,	2_2_00478AC0
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0042F520 NtdllDefWindowProc_A,	2_2_0042F520
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00457594 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	2_2_00457594

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

2_2_0042E934

Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		2_2_004555E4

Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_0040840C	0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004706A8	2_2_004706A8
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004809F7	2_2_004809F7
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004673A4	2_2_004673A4
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0043035C	2_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004444C8	2_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004345C4	2_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00444A70	2_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00486BD0	2_2_00486BD0
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00430EE8	2_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0045F0C4	2_2_0045F0C4
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00445168	2_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0045B174	2_2_0045B174
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004352C8	2_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00469404	2_2_00469404
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00445574	2_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004519BC	2_2_004519BC
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00487B30	2_2_00487B30
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0043DD50	2_2_0043DD50
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0048DF54	2_2_0048DF54
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758995D6C	4_2_00007FF758995D6C
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758994E20	4_2_00007FF758994E20
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758976780	4_2_00007FF758976780
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF7589811C0	4_2_00007FF7589811C0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF7589931CC	4_2_00007FF7589931CC
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF7589809A0	4_2_00007FF7589809A0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF7589909B4	4_2_00007FF7589909B4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75898FA08	4_2_00007FF75898FA08
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF7589813C4	4_2_00007FF7589813C4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758988BA0	4_2_00007FF758988BA0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758980BA4	4_2_00007FF758980BA4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75898CC04	4_2_00007FF75898CC04
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758982C04	4_2_00007FF758982C04
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758971B90	4_2_00007FF758971B90
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758998B68	4_2_00007FF758998B68
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758980DB0	4_2_00007FF758980DB0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758992D30	4_2_00007FF758992D30
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75898FA08	4_2_00007FF75898FA08
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758986560	4_2_00007FF758986560
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758986714	4_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758981E70	4_2_00007FF758981E70
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758986F98	4_2_00007FF758986F98
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758980FB4	4_2_00007FF758980FB4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758982800	4_2_00007FF758982800
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758984F50	4_2_00007FF758984F50
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75898D718	4_2_00007FF75898D718
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75898D098	4_2_00007FF75898D098
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75899509C	4_2_00007FF75899509C
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF7589780A0	4_2_00007FF7589780A0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758995820	4_2_00007FF758995820
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758986714	4_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758995D6C	5_2_00007FF758995D6C
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF7589811C0	5_2_00007FF7589811C0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF7589931CC	5_2_00007FF7589931CC
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF7589809A0	5_2_00007FF7589809A0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF7589909B4	5_2_00007FF7589909B4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75898FA08	5_2_00007FF75898FA08
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF7589813C4	5_2_00007FF7589813C4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758988BA0	5_2_00007FF758988BA0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758980BA4	5_2_00007FF758980BA4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75898CC04	5_2_00007FF75898CC04
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758982C04	5_2_00007FF758982C04
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758971B90	5_2_00007FF758971B90
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758998B68	5_2_00007FF758998B68
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758980DB0	5_2_00007FF758980DB0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758992D30	5_2_00007FF758992D30
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75898FA08	5_2_00007FF75898FA08
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758986560	5_2_00007FF758986560
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758986714	5_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758994E20	5_2_00007FF758994E20
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758981E70	5_2_00007FF758981E70
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758986F98	5_2_00007FF758986F98
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758980FB4	5_2_00007FF758980FB4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758982800	5_2_00007FF758982800
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758984F50	5_2_00007FF758984F50
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75898D718	5_2_00007FF75898D718
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758976780	5_2_00007FF758976780
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75898D098	5_2_00007FF75898D098
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75899509C	5_2_00007FF75899509C
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF7589780A0	5_2_00007FF7589780A0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758995820	5_2_00007FF758995820
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758986714	5_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8528570	5_2_00007FF8A8528570
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8474060	5_2_00007FF8A8474060
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A85191F0	5_2_00007FF8A85191F0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8455380	5_2_00007FF8A8455380
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8451470	5_2_00007FF8A8451470
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A85175AE	5_2_00007FF8A85175AE
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A847A9F0	5_2_00007FF8A847A9F0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84F4A60	5_2_00007FF8A84F4A60
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A844CA30	5_2_00007FF8A844CA30
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8446A20	5_2_00007FF8A8446A20
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84F0B40	5_2_00007FF8A84F0B40
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84FCB40	5_2_00007FF8A84FCB40
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84EEB80	5_2_00007FF8A84EEB80
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A844AC50	5_2_00007FF8A844AC50
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8452C00	5_2_00007FF8A8452C00
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A850CCF0	5_2_00007FF8A850CCF0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84F2CF0	5_2_00007FF8A84F2CF0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8450CB0	5_2_00007FF8A8450CB0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84ECD50	5_2_00007FF8A84ECD50
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8458D40	5_2_00007FF8A8458D40
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84CAD10	5_2_00007FF8A84CAD10
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84D0D30	5_2_00007FF8A84D0D30
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84FADD0	5_2_00007FF8A84FADD0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8528E00	5_2_00007FF8A8528E00
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8444EE0	5_2_00007FF8A8444EE0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84FCEB0	5_2_00007FF8A84FCEB0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8484EA0	5_2_00007FF8A8484EA0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8476F10	5_2_00007FF8A8476F10
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A853B050	5_2_00007FF8A853B050
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84C5020	5_2_00007FF8A84C5020
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A85270F0	5_2_00007FF8A85270F0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84C10E0	5_2_00007FF8A84C10E0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84410E0	5_2_00007FF8A84410E0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84E4140	5_2_00007FF8A84E4140
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84FE100	5_2_00007FF8A84FE100
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84B01F0	5_2_00007FF8A84B01F0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84562B0	5_2_00007FF8A84562B0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84BA2A0	5_2_00007FF8A84BA2A0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8454340	5_2_00007FF8A8454340
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A849C420	5_2_00007FF8A849C420
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84C24E0	5_2_00007FF8A84C24E0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A85004E0	5_2_00007FF8A85004E0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84EE4B0	5_2_00007FF8A84EE4B0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84C8540	5_2_00007FF8A84C8540
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84C4574	5_2_00007FF8A84C4574
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84845A0	5_2_00007FF8A84845A0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84C0740	5_2_00007FF8A84C0740
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84B4760	5_2_00007FF8A84B4760
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A848683D	5_2_00007FF8A848683D
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A85048F0	5_2_00007FF8A85048F0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A85068E0	5_2_00007FF8A85068E0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84628B0	5_2_00007FF8A84628B0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A84A68A0	5_2_00007FF8A84A68A0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A87923F1	5_2_00007FF8A87923F1
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8795D9E	5_2_00007FF8A8795D9E
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8932AF0	5_2_00007FF8A8932AF0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8872BC0	5_2_00007FF8A8872BC0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8794D04	5_2_00007FF8A8794D04
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8791B22	5_2_00007FF8A8791B22
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8795B0F	5_2_00007FF8A8795B0F
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A879213F	5_2_00007FF8A879213F
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8794633	5_2_00007FF8A8794633
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A87972C0	5_2_00007FF8A87972C0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A88CAFF0	5_2_00007FF8A88CAFF0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A87AEF00	5_2_00007FF8A87AEF00
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A87929CD	5_2_00007FF8A87929CD
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8796EEC	5_2_00007FF8A8796EEC

Source: C:\AccountChanger\AccountChanger.exe	Code function: String function: 00007FF8A8792734 appears 61 times
Source: C:\AccountChanger\AccountChanger.exe	Code function: String function: 00007FF8A8535A40 appears 38 times
Source: C:\AccountChanger\AccountChanger.exe	Code function: String function: 00007FF758972770 appears 82 times
Source: C:\AccountChanger\AccountChanger.exe	Code function: String function: 00007FF8A8791EF1 appears 199 times
Source: C:\AccountChanger\AccountChanger.exe	Code function: String function: 00007FF8A8794057 appears 88 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00457F1C appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00457D10 appears 96 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 004078F4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00403494 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00403684 appears 225 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 00453344 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: String function: 004460A4 appears 59 times

Source: AccoutChangersetup.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: AccoutChangersetup.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: AccoutChangersetup.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-9HL2D.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-9HL2D.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-9HL2D.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: AccoutChangersetup.exe, 00000000.00000003.2038741071.00000000021EE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs AccoutChangersetup.exe
Source: AccoutChangersetup.exe, 00000000.00000003.2038508264.000000000241A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs AccoutChangersetup.exe

Source: AccoutChangersetup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: sus24.spyw.evad.winEXE@10/1039@0/0

Source: C:\AccountChanger\AccountChanger.exe

Code function: 4_2_00007FF7589774B0 GetLastError,FormatMessageW,WideCharToMultiByte,

4_2_00007FF7589774B0

Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		2_2_004555E4

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

2_2_00455E0C

Source: C:\AccountChanger\AccountChanger.exe

Code function: 5_2_00007FF8A844A2A0 GetModuleHandleW,GetProcAddress,CoInitialize,CoCreateInstance,CoCreateInstance,

5_2_00007FF8A844A2A0

Source: C:\Users\user\Desktop\AccoutChangersetup.exe

Code function: 0_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409C34

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6784:120:WilError_03

Source: C:\Users\user\Desktop\AccoutChangersetup.exe

File created: C:\Users\user\AppData\Local\Temp\is-M482R.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\AccoutChangersetup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: AccoutChangersetup.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: AccountChanger.exe	String found in binary or memory: -startline must be less than or equal to -endline
Source: AccountChanger.exe	String found in binary or memory: -help

Source: C:\Users\user\Desktop\AccoutChangersetup.exe

File read: C:\Users\user\Desktop\AccoutChangersetup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AccoutChangersetup.exe "C:\Users\user\Desktop\AccoutChangersetup.exe"
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp "C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp" /SL5="$20470,18246292,90112,C:\Users\user\Desktop\AccoutChangersetup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process created: C:\AccountChanger\AccountChanger.exe "C:\AccountChanger\AccountChanger.exe"
Source: C:\AccountChanger\AccountChanger.exe	Process created: C:\AccountChanger\AccountChanger.exe "C:\AccountChanger\AccountChanger.exe"
Source: C:\AccountChanger\AccountChanger.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp "C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp" /SL5="$20470,18246292,90112,C:\Users\user\Desktop\AccoutChangersetup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process created: C:\AccountChanger\AccountChanger.exe "C:\AccountChanger\AccountChanger.exe"	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Process created: C:\AccountChanger\AccountChanger.exe "C:\AccountChanger\AccountChanger.exe"	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior

Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: version.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: tcl86t.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: tk86t.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: AccountChanger.lnk.2.dr

LNK file: ..\..\..\..\..\..\AccountChanger\AccountChanger.exe

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Automated click: I accept the agreement

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AccoutChangersetup.exe

Static file information: File size 18495052 > 1048576

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: AccountChanger.exe, 00000004.00000003.2360806532.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3294398265.00007FF8B90B3000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: AccountChanger.exe, 00000004.00000003.2362442277.000001EDA3F3F000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3291690334.00007FF8B7EEC000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: AccountChanger.exe, 00000004.00000003.2347547959.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3295786417.00007FF8BA251000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: AccountChanger.exe, 00000005.00000002.3295463557.00007FF8B9F70000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3292741355.00007FF8B8B36000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3294825486.00007FF8B90FB000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: AccountChanger.exe, 00000004.00000003.2347662604.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3293271804.00007FF8B8CE7000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: AccountChanger.exe, 00000005.00000002.3292122162.00007FF8B8126000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: AccountChanger.exe, 00000005.00000002.3292122162.00007FF8B8126000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: AccountChanger.exe, 00000005.00000002.3294203045.00007FF8B9092000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: AccountChanger.exe, 00000004.00000003.2349395214.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3293914149.00007FF8B9063000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: AccountChanger.exe, 00000004.00000003.2348920092.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3294825486.00007FF8B90FB000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: AccountChanger.exe, 00000004.00000003.2349250192.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3293096753.00007FF8B8CD5000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: AccountChanger.exe, 00000004.00000003.2347784759.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3295065042.00007FF8B93CD000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: AccountChanger.exe, 00000004.00000003.2350074055.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3292924630.00007FF8B8CB8000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: AccountChanger.exe, 00000004.00000003.2349711459.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3294593111.00007FF8B90C8000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: AccountChanger.exe, 00000004.00000003.2354448227.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3282303465.0000015D363C0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: AccountChanger.exe, 00000004.00000003.2349110323.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: AccountChanger.exe, 00000005.00000002.3290350063.00007FF8A8A61000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: AccountChanger.exe, 00000005.00000002.3293517963.00007FF8B8F7D000.00000002.00000001.01000000.00000015.sdmp

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004502C0

Source: is-6MOI9.tmp.2.dr	Static PE information: section name: _RDATA
Source: is-EOJ2S.tmp.2.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_004065C8 push 00406605h; ret	0_2_004065FD
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_00408104 push ecx; mov dword ptr [esp], eax	0_2_00408109
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: 0_2_00408F38 push 00408F6Bh; ret	0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0040994C push 00409989h; ret	2_2_00409981
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00483F88 push 00484096h; ret	2_2_0048408E
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004062B4 push ecx; mov dword ptr [esp], eax	2_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004104E0 push ecx; mov dword ptr [esp], edx	2_2_004104E5
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00412928 push 0041298Bh; ret	2_2_00412983
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00494CAC push ecx; mov dword ptr [esp], ecx	2_2_00494CB1
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0040CE38 push ecx; mov dword ptr [esp], edx	2_2_0040CE3A
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004592D0 push 00459314h; ret	2_2_0045930C
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0040F398 push ecx; mov dword ptr [esp], edx	2_2_0040F39A
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00443440 push ecx; mov dword ptr [esp], ecx	2_2_00443444
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0040546D push eax; ret	2_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0040553D push 00405749h; ret	2_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004055BE push 00405749h; ret	2_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00485678 push ecx; mov dword ptr [esp], ecx	2_2_0048567D
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0040563B push 00405749h; ret	2_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004056A0 push 00405749h; ret	2_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004517F8 push 0045182Bh; ret	2_2_00451823
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004519BC push ecx; mov dword ptr [esp], eax	2_2_004519C1
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00477B08 push ecx; mov dword ptr [esp], edx	2_2_00477B09
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00419C28 push ecx; mov dword ptr [esp], ecx	2_2_00419C2D
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0045FD1C push ecx; mov dword ptr [esp], ecx	2_2_0045FD20
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00499D30 pushad ; retf	2_2_00499D3F

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\AccountChanger\AccountChanger.exe

Process created: "C:\AccountChanger\AccountChanger.exe"

Source: C:\AccountChanger\AccountChanger.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingmorph.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	File created: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\AccountChanger\unins000.exe (copy)	Jump to dropped file
Source: C:\AccountChanger\AccountChanger.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingft.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\AccountChanger\is-9HL2D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\AccountChanger\AccountChanger.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\AccountChanger\is-EOJ2S.tmp	Jump to dropped file
Source: C:\AccountChanger\AccountChanger.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingmath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\AccountChanger\is-6MOI9.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AccountChanger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AccountChanger\AccountChanger.lnk			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	2_2_0042285C
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	2_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	2_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004241DC IsIconic,SetActiveWindow,SetFocus,	2_2_004241DC
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00424194 IsIconic,SetActiveWindow,	2_2_00424194
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	2_2_00418384
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00417598 IsIconic,GetCapture,	2_2_00417598
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_0048393C IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	2_2_0048393C
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00417CCE IsIconic,SetWindowPos,	2_2_00417CCE
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	2_2_00417CD0
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A8464370 IsIconic,IsZoomed,AdjustWindowRectEx,SendMessageW,SendMessageW,GetSystemMetrics,MoveWindow,GetWindowRect,GetClientRect,MoveWindow,GetWindowRect,MoveWindow,DrawMenuBar,	5_2_00007FF8A8464370

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_0041F118

Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\AccountChanger\AccountChanger.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingmorph.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Dropped PE file which has not been started: C:\AccountChanger\unins000.exe (copy)	Jump to dropped file
Source: C:\AccountChanger\AccountChanger.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingft.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Dropped PE file which has not been started: C:\AccountChanger\is-9HL2D.tmp	Jump to dropped file
Source: C:\AccountChanger\AccountChanger.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingmath.cp310-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\AccoutChangersetup.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5450

Source: C:\AccountChanger\AccountChanger.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_4-16052

Source: C:\AccountChanger\AccountChanger.exe

API coverage: 6.6 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00452A60 FindFirstFileA,GetLastError,	2_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00474F88 FindFirstFileA,FindNextFileA,FindClose,	2_2_00474F88
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_004980A4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	2_2_004980A4
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	2_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00462750 FindFirstFileA,FindNextFileA,FindClose,	2_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: 2_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	2_2_00463CDC
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF7589909B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00007FF7589909B4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758986714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	4_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758977820 FindFirstFileExW,FindClose,	4_2_00007FF758977820
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758986714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	4_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF7589909B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF7589909B4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758986714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	5_2_00007FF758986714
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758977820 FindFirstFileExW,FindClose,	5_2_00007FF758977820
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758986714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	5_2_00007FF758986714

Source: C:\Users\user\Desktop\AccoutChangersetup.exe

Code function: 0_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409B78

Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat	Jump to behavior

Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61.1265_ Mu:]
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: guratioamd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_e0127aac1cc27b15.manifest20dcPC
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7.manifest_syswow64_percpZ
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-storflt_31bf3856ad364e35_10.0.19041.1_none_cce38a03f1e40067.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1.1265_amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79oDevice.dll Du:]
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: h_enginamd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87.manifest_4
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-f..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_4d711034023df04d.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bdacc15
Source: AccoutChangersetup.tmp, 00000002.00000003.2348696327.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\#
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: olicymaamd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127dll`Fu:]
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1bjter40.dllt
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-drivers-hypervisor-bcd_31bf3856ad364e35_10.0.19041.1_none_cbb2f6c087e55fc0.manifest-ms
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: der.dllamd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d_0.dlldll
Source: AccountChanger.exe, 00000005.00000002.3288141520.0000015D3BF60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164.manifestp
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-hypervisor-events_31bf3856ad364e35_10.0.19041.1_none_642b49da78e510c8.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41bHost
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_165edb2e5d580618.manifest0J
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ospaymeamd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24dll0Iu:]
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vdev-offline_31bf3856ad364e35_10.0.19041.1_none_92013f260f9b1b7b.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-drivers-hypervisor-bcd_31bf3856ad364e35_10.0.19041.1_none_cbb2f6c087e55fc0.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5.manifest291.cdf-ms
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 9f43986amd64_microsoft-hyper-v-3dvideo_31bf3856ad364e35_10.0.19041.928_none_b394b845725c83f9.manifest1
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-rdv_31bf3856ad364e35_10.0.19041.928_none_58e4b5397f9ab13a.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 4384c1damd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586.manifestdf-pF
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-guest-network-drivers_31bf3856ad364e35_10.0.19041.1_none_2cfac380b9544760.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4.manifestPW
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_e16d8a57f6edf359.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mejp_apamd64_microsoft-hyper-v-m..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_90826ff4620798e4.manifest_52
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd0ebd3d8c
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98vcrt40.dllllp
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040.manifest0
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0p120.dlle
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744itlb.dlll
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda.manifest]
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_90826ff4620798e4.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: r_001e_amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981.manifest752
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-3dvideo.resources_31bf3856ad364e35_10.0.19041.928_en-us_4257e8c2720c2e68.manifest0
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15.manifest0
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-o..n-merged-deployment_31bf3856ad364e35_10.0.19041.1566_none_4d0af6f3ee4c927e.manifest_
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5.manifest`
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-storvsp_31bf3856ad364e35_10.0.19041.1_none_cb2cd273f2fa3722.manifest
Source: AccountChanger.exe, 00000005.00000003.3027246161.0000015D3BD60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..n-merged-deployment_31bf3856ad364e35_10.0.19041.1566_none_4d0af6f3ee4c927e.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_53df9e1a6706366c.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: llshielamd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24.manifestield_setupd
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06WImage.dll
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vid_31bf3856ad364e35_10.0.19041.1_none_56baaad119b4f126.manifestell.ope`
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DB_id-iamd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-p..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_8b1c06953b85da99.manifestnstPM
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: rintfilamd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fdaatLu:]
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ers-vmswitch-common_31bf3856ad364e35_10.0.19041.1_none_e5de88ec9eb30808.manifests
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920.manifestb.ma
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: les_044amd64_microsoft-hyper-v-vmbus_31bf3856ad364e35_10.0.19041.1_none_8d60e49d6e4b7e60.manifest0
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79.manifest4e
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..r-merged-deployment_31bf3856ad364e35_10.0.19041.1_none_479626a02c4fee1b.manifest
Source: AccoutChangersetup.tmp, 00000002.00000003.2348696327.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: r_0c0c_amd64_microsoft-hyper-v-vstack-rdv_31bf3856ad364e35_10.0.19041.928_none_58e4b5397f9ab13a.manifest3e5392b.cdf-ms
Source: AccountChanger.exe, 00000005.00000003.3026791036.0000015D3BC60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de.manifestp
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd8
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 08e5070amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3.manifesta5e0P\
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b.manifestswow64_inst
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a6732.dlll
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_31900babde4397db.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_0544b95dbde97edc.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6EG2ENC.DLL
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8ciceAp
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0
Source: AccountChanger.exe, 00000005.00000003.2462283353.0000015D387E4000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2462403404.0000015D387EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWt on%SystemRoot%\system32\mswsock.dllthe socket object.
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fd6c30eamd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_e16d8a57f6edf359.manifest750
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955.manifestpA
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: samd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_0544b95dbde97edc.manifestst
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de9487ebd5
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-3dvideo_31bf3856ad364e35_10.0.19041.928_none_b394b845725c83f9.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd8.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-f..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_4d711034023df04d.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-firewallrules_31bf3856ad364e35_10.0.19041.1_none_89d7babee737651c.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ontactsamd64_microsoft-hyper-v-vstack-vdev-offline_31bf3856ad364e35_10.0.19041.1_none_92013f260f9b1b7b.manifestus_e9bc0Y
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-guest-network-drivers_31bf3856ad364e35_10.0.19041.1_none_2cfac380b9544760.manifests
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5.manifestnst
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack_31bf3856ad364e35_10.0.19041.1_none_1aae8085937aee95.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: t.Sourcamd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c2r.dll0
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_165edb2e5d580618.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..p-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_27157646a7f74243.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..r-merged-deployment_31bf3856ad364e35_10.0.19041.1_none_479626a02c4fee1b.manifest0
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b.manifestf-ms
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3_
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: llshielamd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2.manifestd_setupdpP
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Compat.amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15`
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0_modulamd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: poramd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b.exee79ef38f
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_e0127aac1cc27b15.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13.manifestw64_spee
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-3dvideo.resources_31bf3856ad364e35_10.0.19041.928_en-us_4257e8c2720c2e68.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-firewallrules_31bf3856ad364e35_10.0.19041.1_none_89d7babee737651c.manifest-ms
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-dmvsc_31bf3856ad364e35_10.0.19041.1_none_5cb76f18a25ee556.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6.manifestsp
Source: AccountChanger.exe, 00000005.00000002.3288141520.0000015D3BF60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f-msamd64_microsoft-hyper-v-m..ients-firewallrules_31bf3856ad364e35_10.0.19041.1_none_a0e7047dc07f4f53.manifestest0E
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vmbus_31bf3856ad364e35_10.0.19041.1_none_8d60e49d6e4b7e60.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580.dlll
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7PJu:]
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .cdf-msamd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dabe55amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379.manifestP
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vid_31bf3856ad364e35_10.0.19041.1_none_56baaad119b4f126.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .powersamd64_microsoft-hyper-v-storflt_31bf3856ad364e35_10.0.19041.1_none_cce38a03f1e40067.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca841
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-p..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_8b1c06953b85da99.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wspoweramd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c1412\
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5.manifestriv
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..s-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_68a612f12d9ba982.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ation_damd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: llshielamd64_microsoft-hyper-v-o..s-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_68a612f12d9ba982.manifestd
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5cc96dlll
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cb98815amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127.manifest80c.cdf-ms
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cb97d65amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c.manifest0
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4b11b7a3cc41bP
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5sk.dllll
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: _1.0.1_amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..ients-firewallrules_31bf3856ad364e35_10.0.19041.1_none_a0e7047dc07f4f53.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: r_0010_amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c.manifest011_5cf947280O
Source: AccountChanger.exe, 00000005.00000003.3026791036.0000015D3BC60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ad364e3amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c704038`
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-p..e-merged-deployment_31bf3856ad364e35_10.0.19041.1415_none_36f742b3b56a2468.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141.manifestnlo`
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3ebp.dll
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 6bb4866amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8.manifest0db7
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cb98866amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2.manifest-msPR
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: m1etramd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5ulCu:]
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135.manifestP
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ers-vmswitch-common_31bf3856ad364e35_10.0.19041.1_none_e5de88ec9eb30808.manifest
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-hypervisor-events_31bf3856ad364e35_10.0.19041.1_none_642b49da78e510c8.manifestcdf-ms`
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A734000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611ntIsolationHo
Source: AccountChanger.exe, 00000005.00000003.3002443847.0000015D3BE60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dowspowamd64_microsoft-hyper-v-storvsp_31bf3856ad364e35_10.0.19041.1_none_cb2cd273f2fa3722.manifest
Source: AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A708000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\AccountChanger\AccountChanger.exe

Code function: 4_2_00007FF758989AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00007FF758989AE4

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004502C0

Source: C:\AccountChanger\AccountChanger.exe

Code function: 4_2_00007FF7589925A0 GetProcessHeap,

4_2_00007FF7589925A0

Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF758989AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF758989AE4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75897AE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF75897AE00
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75897B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF75897B69C
Source: C:\AccountChanger\AccountChanger.exe	Code function: 4_2_00007FF75897B880 SetUnhandledExceptionFilter,	4_2_00007FF75897B880
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF758989AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF758989AE4
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75897AE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF75897AE00
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75897B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF75897B69C
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF75897B880 SetUnhandledExceptionFilter,	5_2_00007FF75897B880
Source: C:\AccountChanger\AccountChanger.exe	Code function: 5_2_00007FF8A85401DC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF8A85401DC

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_00478504 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

2_2_00478504

Source: C:\AccountChanger\AccountChanger.exe	Process created: C:\AccountChanger\AccountChanger.exe "C:\AccountChanger\AccountChanger.exe"			Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

2_2_0042E09C

Source: C:\AccountChanger\AccountChanger.exe

Code function: 4_2_00007FF7589989B0 cpuid

4_2_00007FF7589989B0

Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: GetLocaleInfoA,	0_2_0040520C
Source: C:\Users\user\Desktop\AccoutChangersetup.exe	Code function: GetLocaleInfoA,	0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: GetLocaleInfoA,	2_2_00408568
Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Code function: GetLocaleInfoA,	2_2_004085B4
Source: C:\AccountChanger\AccountChanger.exe	Code function: InitCommonControlsEx,RegisterClassW,GetKeyboardLayout,GetLocaleInfoW,TranslateCharsetInfo,	5_2_00007FF8A84669C0
Source: C:\AccountChanger\AccountChanger.exe	Code function: OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GetLocaleInfoA,GlobalUnlock,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,	5_2_00007FF8A84486A0

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\PIL VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\certifi VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\fonts\Roboto VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\icons VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_rendering VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling\__pycache__ VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\tcl VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\select.pyd VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\setuptools-65.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI12922 VolumeInformation	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	Queries volume information: C:\AccountChanger\AccountChanger.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_004585C8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

2_2_004585C8

Source: C:\Users\user\Desktop\AccoutChangersetup.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Code function: 2_2_0045559C GetUserNameA,

2_2_0045559C

Source: C:\AccountChanger\AccountChanger.exe

Code function: 4_2_00007FF758994E20 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

4_2_00007FF758994E20

Source: C:\Users\user\Desktop\AccoutChangersetup.exe

Code function: 0_2_00405CF4 GetVersionExA,

0_2_00405CF4

Source: C:\AccountChanger\AccountChanger.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\hyphen-data	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\WidevineCdm	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\AutofillStates	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OptimizationHints	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\PKIMetadata	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\RecoveryImproved	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\GrShaderCache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Safe Browsing	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\GraphiteDawnCache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials	Jump to behavior
Source: C:\AccountChanger\AccountChanger.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ZxcvbnData	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Exploitation for Privilege Escalation	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	12 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	36 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AccoutChangersetup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\AccountChanger\AccountChanger.exe (copy)	3%	ReversingLabs
C:\AccountChanger\is-6MOI9.tmp	3%	ReversingLabs
C:\AccountChanger\is-9HL2D.tmp	3%	ReversingLabs
C:\AccountChanger\is-EOJ2S.tmp	3%	ReversingLabs
C:\AccountChanger\unins000.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://cacerts.digicert.co	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.dk-soft.org/	0%	URL Reputation	safe
http://www.remobjects.com/psU	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html	0%	Avira URL Cloud	safe
http://.../back.jpeg	0%	Avira URL Cloud	safe
https://www.accountchanger.online/2	0%	Avira URL Cloud	safe
https://foss.heptapod.net/pypy/pypy/-/issues/3539#	0%	Avira URL Cloud	safe
http://crl3.digk	0%	Avira URL Cloud	safe
http://cacerts.digicert.co8	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
https://www.accountchanger.online/	0%	Avira URL Cloud	safe
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html	0%	Avira URL Cloud	safe
http://crl3.dig	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38EC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	AccountChanger.exe, 00000005.00000002.3287028499.0000015D3A0B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.telegram.org/botz	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aka.ms/vcpython27	AccountChanger.exe, 00000005.00000002.3284977658.0000015D395B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu	AccountChanger.exe, 00000004.00000003.2380041326.000001EDA3F3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/unittest.html	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	AccountChanger.exe, 00000005.00000002.3282343042.0000015D36433000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2459902063.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://stackoverflow.com/questions/19622133/	AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	AccountChanger.exe, 00000005.00000002.3286878095.0000015D39FB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	AccountChanger.exe, 00000005.00000002.3287473971.0000015D3A5E4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	AccountChanger.exe, 00000005.00000002.3286878095.0000015D39FB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	AccountChanger.exe, 00000005.00000002.3287163389.0000015D3A1C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.innosetup.com/	AccoutChangersetup.tmp, AccoutChangersetup.tmp, 00000002.00000000.2039314837.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/pprint.html	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2470832979.0000015D388ED000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	AccountChanger.exe, 00000005.00000003.2459902063.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3282844467.0000015D38070000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/get	AccountChanger.exe, 00000005.00000002.3282844467.0000015D38070000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-pillow/Pillow/	AccountChanger.exe, 00000005.00000002.3286878095.0000015D39FB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access	AccountChanger.exe, 00000005.00000003.2465661770.0000015D388E0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464018093.0000015D388E8000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2462706633.0000015D388D0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2462821642.0000015D38878000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2462921582.0000015D388D0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2465201264.0000015D388D2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	AccountChanger.exe, 00000005.00000002.3282343042.0000015D36433000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2459902063.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	AccoutChangersetup.exe, AccoutChangersetup.exe, 00000000.00000000.2035706447.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
https://httpbin.org/	AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539#	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	AccountChanger.exe, 00000005.00000002.3282343042.0000015D36433000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2459902063.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/re.html	AccountChanger.exe, 00000005.00000003.2464828704.0000015D38D4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	AccountChanger.exe, 00000005.00000002.3283357072.0000015D386B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://github.com/ActiveState/appdirs	AccountChanger.exe, 00000005.00000002.3283886903.0000015D38BB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wiki.debian.org/XDGBaseDirectorySpecification#state	AccountChanger.exe, 00000005.00000002.3282343042.0000015D36433000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38CB0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	AccountChanger.exe, 00000005.00000002.3287258878.0000015D3A2D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue44497.	AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.accountchanger.online/	AccoutChangersetup.tmp, 00000002.00000003.2348304093.0000000002238000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/mail	AccountChanger.exe, 00000005.00000002.3285169192.0000015D39735000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283255304.0000015D385B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools/issues/5	AccountChanger.exe, 00000005.00000002.3284783282.0000015D393B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	AccountChanger.exe, 00000005.00000003.2460007638.0000015D364CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-pillow/Pillow/issues/1293	AccountChanger.exe, 00000004.00000003.2363247984.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue23606)	AccountChanger.exe, 00000005.00000002.3287163389.0000015D3A1C0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2470947110.0000015D3978E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2470947110.0000015D39799000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://.../back.jpeg	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38F82000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3287473971.0000015D3A5E4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html	AccountChanger.exe, 00000004.00000003.2398290422.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2398290422.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	AccountChanger.exe, 00000005.00000002.3282844467.0000015D38070000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	AccoutChangersetup.exe, 00000000.00000000.2035706447.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
https://httpbin.org/post	AccountChanger.exe, 00000005.00000002.3285169192.0000015D3977D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.accountchanger.online/2	AccoutChangersetup.exe, 00000000.00000003.2350311833.0000000002140000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.exe, 00000000.00000003.2038181630.0000000002141000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.tmp, 00000002.00000003.2040827676.0000000002238000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.tmp, 00000002.00000003.2348304093.0000000002238000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Ousret/charset_normalizer	AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/re.html#re.sub	AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464828704.0000015D38CFF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2466342868.0000015D38D45000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464828704.0000015D38D4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	AccountChanger.exe, 00000005.00000002.3285169192.0000015D39735000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl3.digk	AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tip.tcl.tk/48)	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2	AccountChanger.exe, 00000005.00000002.3284783282.0000015D393B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666#70724666	AccountChanger.exe, 00000005.00000002.3286878095.0000015D39FB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2467168296.0000015D38D63000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38CB0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464828704.0000015D38CFF000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2466342868.0000015D38D45000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2464828704.0000015D38D4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packagingSP	AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cacerts.digicert.co	AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exe	AccountChanger.exe, 00000004.00000003.2399742696.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2399742696.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38CB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyparsing/pyparsing/wiki	AccountChanger.exe, 00000005.00000002.3283458199.0000015D387B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	AccountChanger.exe, 00000005.00000002.3287258878.0000015D3A2D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/re.html#	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38EC6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://upload.pypi.org/legacy/	AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/library/itertools.html#recipes	AccountChanger.exe, 00000005.00000002.3283794274.0000015D38AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://requests.readthedocs.io	AccountChanger.exe, 00000005.00000002.3287657720.0000015D3A688000.00000004.00001000.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3285169192.0000015D3977D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.gnu.org/licenses/	AccountChanger.exe, 00000004.00000003.2402793578.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402450812.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402292108.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402793578.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402292108.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402654445.000001EDA3F3E000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402654445.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2402450812.000001EDA3F40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	AccountChanger.exe, 00000005.00000002.3284682951.0000015D392B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/declaring-project-metadata/	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38F82000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org	AccountChanger.exe, 00000005.00000002.3285169192.0000015D3977D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38CB0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection	AccountChanger.exe, 00000004.00000003.2404575896.000001EDA3F3C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	AccountChanger.exe, 00000004.00000003.2353922688.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.python.org/	AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://json.org	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0205/	AccountChanger.exe, 00000005.00000002.3283357072.0000015D386B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://twitter.com/	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38FA9000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/pprint.html#pprint.pprint	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2470832979.0000015D388ED000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3283606857.0000015D3895D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/	AccountChanger.exe, 00000005.00000002.3283606857.0000015D38937000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.dk-soft.org/	AccoutChangersetup.tmp, 00000002.00000003.2348304093.0000000002238000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google.com/mail/	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38DE1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/mail/	AccountChanger.exe, 00000005.00000002.3283981260.0000015D38EC6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate	AccountChanger.exe, 00000005.00000002.3284977658.0000015D395B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.remobjects.com/psU	AccoutChangersetup.exe, 00000000.00000003.2038508264.0000000002370000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.exe, 00000000.00000003.2038741071.0000000002148000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.tmp, 00000002.00000000.2039314837.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://cacerts.digicert.co8	AccountChanger.exe, 00000004.00000003.2348775178.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.openssl.org/H	AccountChanger.exe, 00000004.00000003.2354072931.000001EDA3F37000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000002.3292236939.00007FF8B815B000.00000002.00000001.01000000.00000016.sdmp, AccountChanger.exe, 00000005.00000002.3290674468.00007FF8A8AD6000.00000002.00000001.01000000.00000017.sdmp	false		high
http://code.activestate.com/recipes/577916/	AccountChanger.exe, 00000005.00000002.3283143117.0000015D384B0000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2463841665.0000015D388AB000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000005.00000003.2463806655.0000015D38CB1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	AccoutChangersetup.exe, 00000000.00000003.2038508264.0000000002370000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.exe, 00000000.00000003.2038741071.0000000002148000.00000004.00001000.00020000.00000000.sdmp, AccoutChangersetup.tmp, AccoutChangersetup.tmp, 00000002.00000000.2039314837.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://bugs.ghostscript.com/show_bug.cgi?id=698272)	AccountChanger.exe, 00000004.00000003.2380714897.000001EDA3F38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://creativecommons.org/publicdomain/zero/1.0/	AccountChanger.exe, 00000004.00000003.2380041326.000001EDA3F3B000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2363125113.000001EDA3F3A000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2381574470.000001EDA3F3D000.00000004.00000020.00020000.00000000.sdmp, AccountChanger.exe, 00000004.00000003.2381574470.000001EDA3F3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309#30631309	AccountChanger.exe, 00000005.00000002.3287163389.0000015D3A1C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl3.dig	AccountChanger.exe, 00000004.00000003.2348257370.000001EDA3F36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431269
Start date and time:	2024-04-24 18:58:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AccoutChangersetup.exe
Detection:	SUS
Classification:	sus24.spyw.evad.winEXE@10/1039@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 241 Number of non-executed functions: 204
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: AccoutChangersetup.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_setup64.tmp	L1QnAwXT7U.exe	Get hash	malicious	Socks5Systemz	Browse
	SecuriteInfo.com.FileRepMalware.9294.28999.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, Socks5Systemz, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse
	CtEeMS3H62.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse
	LIRR4A0xzv.exe	Get hash	malicious	Amadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse
	6BE4950D9A919F5D0150D19552B340E9B5EF1959A18FD.exe	Get hash	malicious	LummaC, GCleaner, Mars Stealer, PrivateLoader, PureLog Stealer, RedLine, RisePro Stealer	Browse
	5i7hafPPeN.exe	Get hash	malicious	Socks5Systemz	Browse
	kZmq9FlFbC.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\AccountChanger\AccountChanger.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18565178
Entropy (8bit):	7.994472520308763
Encrypted:	true
SSDEEP:	393216:marszf490oxv89aq+ZkFMq3+d9ux01vUIT3J0bAW84vvNiyuW:marszfm0ohFCrOd9uo0kW84vv7uW
MD5:	874D9918AC068743FF1D236347FFA120
SHA1:	589821E6B92F03E1954BA9D13654E246627EBD73
SHA-256:	4E0E9D2D6101CB27FC1F17A2BBA9BBF545F2BB25D8E7D8438662989A62FFBC19
SHA-512:	C225F3BA2D6BCD5454568C2E87F25651EC49BDE8FA1B1952057795DBE4DE7CCE7A957F945B8B6E4C97AF24EE4E8BDC9D60E10843428C97327F21222DC002A778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../...W.../...W...+l..W...+...W...+...W...+...W.../...W...W..)W..e+...W..e+...W..Rich.W..................PE..d....s.d.........."....".......................@..........................................`.....................................................x.... ..8........ ..............X...................................@...@............................................text............................... ..`.rdata...+.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc...8.... ......................@..@.reloc..X...........................@..B........................................................................................................................................................................................................

C:\AccountChanger\config.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.101486287151099
Encrypted:	false
SSDEEP:	3:3HxrE9qhwICfsr:3HxQzIXr
MD5:	E9EB0BF60903EEBDB2087970C71DF337
SHA1:	501151C188A7BB5EDBAE2258F6D83DC872964792
SHA-256:	27E08B5C09748338F4F6776E6840F42563307BF9946ED7717901DB6853134E85
SHA-512:	3F31D3A600C744502DA743378A97FCA99ADA0F6699FC9128A58075663428DEE063C555D884FF7E9B5EA060FD3EA3AB1F44FA8944FB8AF3AEDAD4FF71D8800F71
Malicious:	false
Reputation:	low
Preview:	{.. "fileName": "",.. "theme": false,.. "accounts": {}..}..

C:\AccountChanger\images\is-LAVPD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	MS Windows icon resource - 1 icon, 96x96, 32 bits/pixel
Category:	dropped
Size (bytes):	38078
Entropy (8bit):	0.5789649620363432
Encrypted:	false
SSDEEP:	384:sCiCiCiD1S1C1y1C1S1vfP2nHnHnPfmPi1t1d1N191t1osMs3XfP/k0E0kWSySyE:QALzD
MD5:	910CEA3C5D3D2534CF28311A7A538CA5
SHA1:	EB495721F34303421845483B24519E0950192DC5
SHA-256:	850C3AEB4ABCCA4DBED63F0A1208B8829327F7AE901D14D3E954329EC49B36C8
SHA-512:	98EF4928FDE312C95ECCC2E65C59455F020C5179CD589A3B03E07DCBE4401C4C634519334F01A4CCFE1B724906D9A4B5C03A938B18E5310249D49034C72C89F2
Malicious:	false
Reputation:	low
Preview:	......``.... .........(...`......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\AccountChanger\images\logo.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	MS Windows icon resource - 1 icon, 96x96, 32 bits/pixel
Category:	dropped
Size (bytes):	38078
Entropy (8bit):	0.5789649620363432
Encrypted:	false
SSDEEP:	384:sCiCiCiD1S1C1y1C1S1vfP2nHnHnPfmPi1t1d1N191t1osMs3XfP/k0E0kWSySyE:QALzD
MD5:	910CEA3C5D3D2534CF28311A7A538CA5
SHA1:	EB495721F34303421845483B24519E0950192DC5
SHA-256:	850C3AEB4ABCCA4DBED63F0A1208B8829327F7AE901D14D3E954329EC49B36C8
SHA-512:	98EF4928FDE312C95ECCC2E65C59455F020C5179CD589A3B03E07DCBE4401C4C634519334F01A4CCFE1B724906D9A4B5C03A938B18E5310249D49034C72C89F2
Malicious:	false
Reputation:	low
Preview:	......``.... .........(...`......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\AccountChanger\is-4KCS3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.101486287151099
Encrypted:	false
SSDEEP:	3:3HxrE9qhwICfsr:3HxQzIXr
MD5:	E9EB0BF60903EEBDB2087970C71DF337
SHA1:	501151C188A7BB5EDBAE2258F6D83DC872964792
SHA-256:	27E08B5C09748338F4F6776E6840F42563307BF9946ED7717901DB6853134E85
SHA-512:	3F31D3A600C744502DA743378A97FCA99ADA0F6699FC9128A58075663428DEE063C555D884FF7E9B5EA060FD3EA3AB1F44FA8944FB8AF3AEDAD4FF71D8800F71
Malicious:	false
Reputation:	low
Preview:	{.. "fileName": "",.. "theme": false,.. "accounts": {}..}..

C:\AccountChanger\is-6MOI9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18565178
Entropy (8bit):	7.994472520308763
Encrypted:	true
SSDEEP:	393216:marszf490oxv89aq+ZkFMq3+d9ux01vUIT3J0bAW84vvNiyuW:marszfm0ohFCrOd9uo0kW84vv7uW
MD5:	874D9918AC068743FF1D236347FFA120
SHA1:	589821E6B92F03E1954BA9D13654E246627EBD73
SHA-256:	4E0E9D2D6101CB27FC1F17A2BBA9BBF545F2BB25D8E7D8438662989A62FFBC19
SHA-512:	C225F3BA2D6BCD5454568C2E87F25651EC49BDE8FA1B1952057795DBE4DE7CCE7A957F945B8B6E4C97AF24EE4E8BDC9D60E10843428C97327F21222DC002A778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../...W.../...W...+l..W...+...W...+...W...+...W.../...W...W..)W..e+...W..e+...W..Rich.W..................PE..d....s.d.........."....".......................@..........................................`.....................................................x.... ..8........ ..............X...................................@...@............................................text............................... ..`.rdata...+.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc...8.... ......................@..@.reloc..X...........................@..B........................................................................................................................................................................................................

C:\AccountChanger\is-9HL2D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	751265
Entropy (8bit):	6.3310304155603605
Encrypted:	false
SSDEEP:	12288:jTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5rRx9vy:3PcYn5c/rPx37/zHBA6pFptZ1CEQqrRO
MD5:	7E112C1769A1862EC9CDDF2FFC087A85
SHA1:	461560CFF66A05285944923234B16EBA0A1BB04C
SHA-256:	9FFE8A0189E5342CEC03A371C8BD9C284858A47A1786A4E5B359236A70B7FEF8
SHA-512:	6C105DBC8EB0AD148889B63D469D6AC7DA976F9FCDB146E7DD8494514B90DA8FF2671DC8AC314A57FB49EC3EEBE8575261EAF3982344E9F21C50BFC2A1C92675
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..........................@...................@...............................%.......................... ......................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc..............................@..P.....................T..............@..P........................................................................................................................................

C:\AccountChanger\is-EOJ2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18565178
Entropy (8bit):	7.994472520308763
Encrypted:	true
SSDEEP:	393216:marszf490oxv89aq+ZkFMq3+d9ux01vUIT3J0bAW84vvNiyuW:marszfm0ohFCrOd9uo0kW84vv7uW
MD5:	874D9918AC068743FF1D236347FFA120
SHA1:	589821E6B92F03E1954BA9D13654E246627EBD73
SHA-256:	4E0E9D2D6101CB27FC1F17A2BBA9BBF545F2BB25D8E7D8438662989A62FFBC19
SHA-512:	C225F3BA2D6BCD5454568C2E87F25651EC49BDE8FA1B1952057795DBE4DE7CCE7A957F945B8B6E4C97AF24EE4E8BDC9D60E10843428C97327F21222DC002A778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../...W.../...W...+l..W...+...W...+...W...+...W.../...W...W..)W..e+...W..e+...W..Rich.W..................PE..d....s.d.........."....".......................@..........................................`.....................................................x.... ..8........ ..............X...................................@...@............................................text............................... ..`.rdata...+.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc...8.... ......................@..@.reloc..X...........................@..B........................................................................................................................................................................................................

C:\AccountChanger\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	InnoSetup Log AccountChanger {490550FF-0A0F-4C3C-B624-AD94CD8F4F98}, version 0x30, 1347 bytes, 820094\user, "C:\AccountChanger"
Category:	dropped
Size (bytes):	1347
Entropy (8bit):	4.319249839150884
Encrypted:	false
SSDEEP:	24:1I6PfzMVMCBxK5uuNfd10ubYVMCOgVMCVVMCXVn7:3P4vx0Lp8jDZJ
MD5:	0363492FDA3A35C50CEE843899CFA501
SHA1:	6298F0B428E45ABD977B42C7F68E6847DC82033F
SHA-256:	31B00BAF3DD48C4CBFDE9F2BA2CD209AB7EDCAE448AE36DF1D3E6A6B5244B945
SHA-512:	6CBC23809555D5B651E17B269BC5C4A6B44B44B817669134650EFE21CC4633861521F44F46C0A22F9698F4240DB5D5FCF5A4225E36D7A1C51214464E8CF28C94
Malicious:	false
Reputation:	low
Preview:	Inno Setup Uninstall Log (b)....................................{490550FF-0A0F-4C3C-B624-AD94CD8F4F98}..........................................................................................AccountChanger..................................................................................................................0.......C...%................................................................................................................Xa.w.......#?.o......2....820094.user.C:\AccountChanger...........;...j.. .......... .................................C:\AccountChangerCC:\ProgramData\Microsoft\Windows\Start Menu\Programs\AccountChanger.AccountChanger.english.............C:\AccountChanger..........$C:\AccountChanger\AccountChanger.exe..............$C:\AccountChanger\AccountChanger.exe...........#....C:\AccountChanger\config.json................C:\AccountChanger\images.......'...!C:\AccountChanger\images\logo.ico...........E...CC:\ProgramData\Microsoft\Windows\Start Menu\Program

C:\AccountChanger\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	751265
Entropy (8bit):	6.3310304155603605
Encrypted:	false
SSDEEP:	12288:jTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5rRx9vy:3PcYn5c/rPx37/zHBA6pFptZ1CEQqrRO
MD5:	7E112C1769A1862EC9CDDF2FFC087A85
SHA1:	461560CFF66A05285944923234B16EBA0A1BB04C
SHA-256:	9FFE8A0189E5342CEC03A371C8BD9C284858A47A1786A4E5B359236A70B7FEF8
SHA-512:	6C105DBC8EB0AD148889B63D469D6AC7DA976F9FCDB146E7DD8494514B90DA8FF2671DC8AC314A57FB49EC3EEBE8575261EAF3982344E9F21C50BFC2A1C92675
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..........................@...................@...............................%.......................... ......................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc..............................@..P.....................T..............@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AccountChanger\AccountChanger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Apr 24 15:59:20 2024, mtime=Wed Apr 24 15:59:23 2024, atime=Sun Jun 18 21:14:02 2023, length=18565178, window=hide
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.580778672748567
Encrypted:	false
SSDEEP:	12:8mZYXwe0G0DjFr9uJJ+CiFasLHrtJ+CRtYjAOamD1J+CKJ+CsJ+C76VmV:8mgonAcCivcC78AOampcCKcCscC76Vm
MD5:	54082353C012A1B81129D58AAB2B7B8F
SHA1:	359B7F9BFA17FB5687B5D3331E87EC419B4824BF
SHA-256:	9DF7FB056E2B59C98751C67BD232E03BB0A20908EB153EA0D9DC5C0BBAD68629
SHA-512:	788FCF51A18CE0712603476FF834A6FF7B1ABDCE0CAF829EB8B48F5F17B3251ECA66A8790F7CC402D32925AA7B9504896DB97A6F294019DB710A62EEAFB2717B
Malicious:	false
Preview:	L..................F.... ...5...h.......h....../2...:H...........................P.O. .:i.....+00.../C:\...................f.1......Xl...ACCOUN~1..N......Xk..Xl.....*.......................I.A.c.c.o.u.n.t.C.h.a.n.g.e.r.....r.2.:H...V.. .ACCOUN~1.EXE..V......Xk..Xl...............................A.c.c.o.u.n.t.C.h.a.n.g.e.r...e.x.e.......S...............-.......R...........y.s......C:\AccountChanger\AccountChanger.exe..3.....\.....\.....\.....\.....\.....\.A.c.c.o.u.n.t.C.h.a.n.g.e.r.\.A.c.c.o.u.n.t.C.h.a.n.g.e.r...e.x.e...C.:.\.A.c.c.o.u.n.t.C.h.a.n.g.e.r.`.......X.......820094...........hT..CrF.f4... .K.2=.b...,...W..hT..CrF.f4... .K.2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\JpegPresets.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12583
Entropy (8bit):	3.145864500603762
Encrypted:	false
SSDEEP:	96:K8YqNDWQYpR5PWMgvU86dPu9hyMwx02gjDQyvaQPYDkDaMS4izTkUkjDQyh/:hP+pF26d2XXwx0k2aQcvXkUps/
MD5:	44221DCE27B0F19B92BCF41EE3E034AB
SHA1:	E3FBF129A768387D4E78B69E91F8D6B0B185BAC4
SHA-256:	EE512E9B1C48750ADD7381329DCE11F0822DBEEED6C8FE8A298F6F691DD11DF6
SHA-512:	9604C25949AFEE7C6CFC647D7118A13F44918C4CF8099386E70B55B1B6926E4E8362127E0DD5D39218C78F0F9A07C2FFDB387474BC31DA5D5016BA7076B615C0
Malicious:	false
Preview:	"""..JPEG quality settings equivalent to the Photoshop settings...Can be used when saving JPEG files.....The following presets are available by default:..``web_low``, ``web_medium``, ``web_high``, ``web_very_high``, ``web_maximum``,..``low``, ``medium``, ``high``, ``maximum``...More presets can be added to the :py:data:`presets` dict if needed.....To apply the preset, specify::.... quality="preset_name"....To apply only the quantization table::.... qtables="preset_name"....To apply only the subsampling setting::.... subsampling="preset_name"....Example::.... im.save("image_name.jpg", quality="web_high")....Subsampling..-----------....Subsampling is the practice of encoding images by implementing less resolution..for chroma information than for luma information...(ref.: https://en.wikipedia.org/wiki/Chroma_subsampling)....Possible subsampling values are 0, 1 and 2 that correspond to 4:4:4, 4:2:2 and..4:2:0.....You can get the subsampling of a JPEG with the..:func:`.JpegImagePlugin.g

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\McIdasImagePlugin.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	4.8650924557205615
Encrypted:	false
SSDEEP:	48:RqKjpw12p/bk3PIeFskklN0X0pm6QHVTqwl4t7:Rjjpo2pGQeFssX0FQhqwlG7
MD5:	ECE6BCC8D9B7C5647E7D923A8CC31A24
SHA1:	1C68B5C258EE83F72AB706F5A11B183D698E168F
SHA-256:	C7DA78C44321B28F73D87F30325C60FE9149E0EC481069EAFFBB408317B8F8D1
SHA-512:	B87E651624C441603BB2163696E653B39BCB16F2DDF7A7197626FD8E6890CD7773C8E3F4D99BE44E7849F771670406387D675CF1F07F30EE615BA39C5C144E1A
Malicious:	false
Preview:	#..# The Python Imaging Library...# $Id$..#..# Basic McIdas support for PIL..#..# History:..# 1997-05-05 fl Created (8-bit images only)..# 2009-03-08 fl Added 16/32-bit support...#..# Thanks to Richard Jones and Craig Swank for specs and samples...#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1997...#..# See the README file for information on usage and redistribution...#....import struct....from . import Image, ImageFile......def _accept(s):.. return s[:8] == b"\x00\x00\x00\x00\x00\x00\x00\x04"......##..# Image plugin for McIdas area images.......class McIdasImageFile(ImageFile.ImageFile):.. format = "MCIDAS".. format_description = "McIdas area file".... def _open(self):.. # parse area file directory.. s = self.fp.read(256).. if not _accept(s) or len(s) != 256:.. msg = "not an McIdas area file".. raise SyntaxError(msg).... self.area_descriptor_raw = s.. self.area_descriptor = w = [0] + list(

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\MicImagePlugin.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2699
Entropy (8bit):	4.6617757434409395
Encrypted:	false
SSDEEP:	48:RqKf3jZ8/bkFvp6qfQiTarq4QYFe/x0540ws1xkq/Bg4A+LZVGRzw3stpw2i:RjfzZ8Svp1QiTMRQYWxA4TI7BgE1Mw3x
MD5:	D273467699E44714895CD3861E43656D
SHA1:	75FC5DA10DA187F647364D5E255F45942618B7D9
SHA-256:	4E225B09DE1815E9534A566ADE3BB353C6F34118A711C0DC50508B7E84F6AC3D
SHA-512:	A1795C9C65D0AA36876492BFE224EAC4517F7AFE7D8E603BB80E2877B4552D838BA415961BFE7A8426336AEAA6753286216176053C004E96A0873ABFAE7B8AD6
Malicious:	false
Preview:	#..# The Python Imaging Library...# $Id$..#..# Microsoft Image Composer support for PIL..#..# Notes:..# uses TiffImagePlugin.py to read the actual image streams..#..# History:..# 97-01-20 fl Created..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1997...#..# See the README file for information on usage and redistribution...#......import olefile....from . import Image, TiffImagePlugin....#..# --------------------------------------------------------------------......def _accept(prefix):.. return prefix[:8] == olefile.MAGIC......##..# Image plugin for Microsoft's Image Composer file format.......class MicImageFile(TiffImagePlugin.TiffImageFile):.. format = "MIC".. format_description = "Microsoft Image Composer".. _close_exclusive_fp_after_loading = False.... def _open(self):.. # read the OLE directory and see if this is a likely.. # to be a Microsoft Image Composer file.... try:.. self.ole = olefile.Ole

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\MpegImagePlugin.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1905
Entropy (8bit):	4.710452550395935
Encrypted:	false
SSDEEP:	48:RqKsgS9JbkEP1/l0NVpLbnhhMNThNth7GPD1N/ajqwlRw7mwNi:RjM9dt/lsXnhhMhhNunwlRw7mwNi
MD5:	6AA59C344E0E4FA4D76A574A5E36C4D4
SHA1:	B862ECB7951B0066929740E4AF0025A6DDBBBB4A
SHA-256:	8439718EEA72EEAFB9E6C18225F4D009953740171DEF6480DF83669F7B384434
SHA-512:	A6A3970319EAEF006ED26085E8ACC0D710ED03023925A9178D81BD8EB20E79C8F2C8EDB5C910F856A68CA4FEFF96D1B83C2465459EF88A218B3E0E734F10BD23
Malicious:	false
Preview:	#..# The Python Imaging Library...# $Id$..#..# MPEG file handling..#..# History:..# 95-09-09 fl Created..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1995...#..# See the README file for information on usage and redistribution...#......from . import Image, ImageFile..from ._binary import i8....#..# Bitstream parser......class BitStream:.. def __init__(self, fp):.. self.fp = fp.. self.bits = 0.. self.bitbuffer = 0.... def next(self):.. return i8(self.fp.read(1)).... def peek(self, bits):.. while self.bits < bits:.. c = self.next().. if c < 0:.. self.bits = 0.. continue.. self.bitbuffer = (self.bitbuffer << 8) + c.. self.bits += 8.. return self.bitbuffer >> (self.bits - bits) & (1 << bits) - 1.... def skip(self, bits):.. while self.bits < bits:.. self.bitbuffer = (self.bitbuffer << 8) + i8(self.fp.read(1))..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PcxImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3752
Entropy (8bit):	5.4835015335497195
Encrypted:	false
SSDEEP:	96:kzguFiklbk/HE7wJJtrAEW6ih5ySUVmLUCVndW2Wy9m:GgusWimUJtrxWrySUVh52Wy9m
MD5:	8F36086392AA9BA7DB31B75A319E9855
SHA1:	B9A35AF959116C712E609058CA5DE729E717A040
SHA-256:	E42ED55E82DA6C2BC9E82FEC9BBF80901760EF086FC1C9C86476BD946FBE93ED
SHA-512:	80E8AB2248FFF4489ADBBDB5C6FEF76EE6193749F14321087E3AED14DDBC5235391F7CC8E64913C65EBE086F0F8E5EE2DCFA0446FDA373468F58FADFC5CB9F37
Malicious:	false
Preview:	o.......5+.db........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.d.d...Z.G.d.d...d.e.j...Z.d.d.d.d.d...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....e...e.j.d.....d.S.)......N.....)...Image..ImageFile..ImagePalette)...i16le)...o8)...o16lec....................C...s....\|.d...d.k.o.\|.d...d.v.S.).Nr.........r....).r.....................)...prefixr....r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/PcxImagePlugin.py.._accept'...s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...PcxImageFileZ.PCXZ.Paintbrushc....................C...s....\|.j...d...}.t.\|...s.d.}.t.\|.....t.\|.d...t.\|.d...t.\|.d...d...t.\|.d...d...f.}.\|.d...\|.d...k.s6\|.d...\|.d...k.r<d.}.t.\|.....t.j.d.g.\|...R.....\|.d...}.\|.d...}.\|.d...}.t.\|.d...}.t...d.\|.\|.\|.\|.....t.\|.d...t.\|.d...f.\|.j.d.<.\|.d.k.ry\|.d.k.ryd...}.}.n.\|.d.k.r.\|.d.v.r.d.}.d.\|...}.t...d.\|.d.d.......\|._.n{\|.d.k.r.\|.d.k.r.\|.d.k.r.d...}.}.\|.j...d

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PdfImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4214
Entropy (8bit):	5.908341799319632
Encrypted:	false
SSDEEP:	96:tgAg+7FYunO2SESQ+jVon2F6HX2o/iO5ekV7LKJlW9m:tC+7FYunO2xXI6Hh1RtUlW9m
MD5:	DA3271A43E626AA75FBA2EE7A1D5A477
SHA1:	38FCF9C321FCABECEC211C7CAD89C3656C01BBBE
SHA-256:	92544FAC8EAD64D117C7770316E7A1D268DFFEB7ADB0CF72999141D8A6B17360
SHA-512:	DF1A6D6D185F452DA9954EC6644FEAD85E0CD8FFA98061BF112F95E437452BAAB4BF1A90F13630C4C1606BE5489D8A456A5A28D31F5ACB96D9327E23644921C0
Malicious:	false
Preview:	o.......5+.d0$.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.d.d...Z.e...d.e.....e...d.e.....e...d.d.....e...d.d.....d.S.)......N.....)...Image..ImageFile..ImageSequence..PdfParser..__version__..featuresc....................C...s....t.\|.\|.\|.d.d.....d.S.).NT)...save_all)..._save)...im..fp..filename..r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/PdfImagePlugin.py.._save_all)...s......r....Fc............&.......C...s....\|.j...d.d...}.\|.r.t.j.\|.\|.d.d...}.n.t.j.\|.\|.d.d...}.\|.j...d...}.\|.r+\|.d...}.\|.d...}.n.\|.j...d.d.....}.}.\|.r8d.n.t.j...t.j...\|.....d...d.d.d.d.d.\|.rLd.n.t.....\|.rSd.n.t.....d...}.\|.....D.]"\.}.}.\|.\|.j.v.rl\|.j...\|...n.\|.}.\|.r.\|.\|.j.\|.d.......\|.d.d.......<.q]\|.......\|.......\|.......\|...d.t...d.......\|.g.}.\|.r.\|.j...d.g...}.\|.D.].}.\|.j.....\|._.\|...\|.....q.d.}.g.}.g.}.g.}.\|.D.]@}.d.}.\|.r.z.\|.j.}.W.n...t.y.......Y.n.w.\|.\|.7.}.t.\|...D.]"}.\|...\|...d.......\|...\|...d.......\|...\|...d.....

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PdfParser.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	26958
Entropy (8bit):	5.35171458910631
Encrypted:	false
SSDEEP:	768:4JsfUFMcaFDJ7HxoXOY2V6O7EKzDHPMq/r5:4J4mKzDk0
MD5:	F7B222785989C695455331AAC3797A90
SHA1:	4B871513462D666CCC635FF441135E19B58426C1
SHA-256:	84A5DBFC4A9F5F82DA6AB315D677ABCAAA359EB5D5BA82ADF05D66B589683E1C
SHA-512:	865D16E088FEE6C9A3B321F60FCF65C416C6EDB0BD0C6FB720B2B4443DD9758F9D0A77DBE5ED3210501F0381246DB39EA8E51A995B11787288DBED17FC75D9A9
Malicious:	false
Preview:	o.......5+.d........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..d"d#..d$d%..i.d&d'..d(d)..d*d+..d,d-..d.d/..d0d1..d2d3..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG....dHdIdJdKdLdMdNdO....Z.dPdQ..Z.G.dRdS..dSe...Z.dTdU..Z.G.dVdW..dWe...dXdYdZg.....Z.G.d[d\..d\e...Z.G.d]d^..d^..Z.G.d_d`..d`..Z.G.dadb..dbe...Z.G.dcdd..dde.j...Z.G.dedf..df..Z.G.dgdh..dh..Z.didj..Z.G.dkdl..dl..Z.d.S.)m.....Nc....................C...s....t.j.\|...d.....S.).N..utf_16_be)...codecs..BOM_UTF16_BE..encode)...s..r.....YC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/PdfParser.py..encode_text...........r.................u..........u..........u..........u..........u..........u..........u..........u.........u.........u.........u.........u.........u.........u.........u.........u.........u.........u

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PixarImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1163
Entropy (8bit):	5.193613671456574
Encrypted:	false
SSDEEP:	24:95Kpln9Gqu6+1trzWSQVPtzX3WcbVxo5Uk9+GdVaA:a9h9+1tWS+tp45Uk1Vd
MD5:	6F2BEAEBFB71D14667F755A39D6BF7A9
SHA1:	85DBB723B91F6710F8C5B16A74A0F3675D35A6EA
SHA-256:	DFD08E727B9F9C5F6B1C29A2CA7E5ADC64364BCAE642F0FA35587BE7F0FE7B08
SHA-512:	1F3BD933DCE5FEB794614BEE8C20C087D027897A7F326A92D5330938DBAC4656040B119A713064B06073C625C4E899A7545FA4C5851C3CB6E83B2216545D9B7A
Malicious:	false
Preview:	o.......5+.d.........................@...sX...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)......)...Image..ImageFile)...i16lec....................C...s....\|.d.d.....d.k.S.).N.....s..........)...prefixr....r.....`C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/PixarImagePlugin.py.._accept....s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...PixarImageFileZ.PIXARz.PIXAR raster imagec....................C...s....\|.j...d...}.t.\|...s.d.}.t.\|.....\|.\|.j...d.....}.t.\|.d...t.\|.d...f.\|._.t.\|.d...t.\|.d...f.}.\|.d.k.r4d.\|._.d.d.\|.j...d.\|.j.d.d.f.f.g.\|._.d.S.).Nr....z.not a PIXAR filei....i....i....i....i....).............RGB..raw)......r....i....r....r....)...fp..readr......SyntaxError..i16.._size..mode..sizeZ.tile)...self..s..msgr....r....r....r......_open)...s......................".z.PixarImageFile._openN)...__name__..__module__..__qualname__..format..format_descriptionr....r....r....r....r....r....

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PngImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	30715
Entropy (8bit):	5.389489304344518
Encrypted:	false
SSDEEP:	384:dkovAnnnmj2duUXY29lerbSqPn4rntSAdxBxBH4pcxOXKtZmH42UwPu5wGQn2Gr:6nmatYUlOnPnWntFdH4pQOXOoH+582Gr
MD5:	ED7FE42EBBE89D54304DE7222C4CAB8D
SHA1:	E1079FE4D51AF2E6C8102585BD02E0AAC8128DE4
SHA-256:	ECEA8BCCBB279100BC14A18AC781DDA52C5DCE9691010CA0EC10404F2DB8C637
SHA-512:	E96266A2ACEB07F86CCB1DAC0E09B1AB7AA644515ACAE57466F5A52FD29EDA4D5E1D60598F2017767352F377DD28EF6351127F7B66D00D12318A8B8F9B5B589E
Malicious:	false
Preview:	o.......5+.dG........................@...sF...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.e...d...j.Z.d.Z d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z!e...d...Z"e.j#Z$..d.e$..Z%..G.d.d ..d e...Z&G.d!d"..d"e...Z'd#d$..Z(d%d&..Z)dUd'd(..ZG.d)d..d*..Z+G.d+d,..d,e,..Z-G.d-d...d...Z.G.d/d0..d0e+..Z/d1d2..Z0G.d3d4..d4e.j...Z1d5d6d7d8d9d:d;d;d<d=d>d?d@dAdB..Z2dCdD..Z3G.dEdF..dF..Z4G.dGdH..dH..Z5dIdJ..Z6dKdL..Z7e3dMf.dNdO..Z8dPdQ..Z9e..:e1j;e1e0....e..<e1j;e8....e..=e1j;e7....e..>e1j;dRdSg.....e..?e1j;dT....d.S.)V.....N)...IntEnum.....)...Image..ImageChops..ImageFile..ImagePalette..ImageSequence)...i16be)...i32be)...o8)...o16be)...o32be)...deprecates....\w\w\w\ws.....PNG....)...1r....)...L..L;2).r......L;4).r....r....)...I..I;16B)...RGBr....).r....z.RGB;16B)...P..P;1).r......P;2).r......P;4).r....r....)...LAr....)...RGBAz.LA;16B).r....r....).r....z.RGBA;16B).).r....r....).....

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PpmImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7320
Entropy (8bit):	5.399699753319385
Encrypted:	false
SSDEEP:	192:w3hAULhCfPIoBN817StFahMK8FitYWsY4w:sAImPnBG17WFS8Fi/
MD5:	54EB852F973BD20D006B9BA172AE91AE
SHA1:	25B7DED5358A062D9B21B92B95C37D7335DF2F4E
SHA-256:	0E31149F40C038E9477886BB68C70F2B07E37DB6A0B40E37956D49B71BBB37D2
SHA-512:	8E0113D89595635846E78150EE11DC3FFE2FB7AEA5D6C9A58C0CDEA597B3A8072226C5348DE4C1B16AFF323299E16F15D42A39677B5138977F5BA90917381DA2
Malicious:	false
Preview:	o.......5+.d.-.......................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...d.e.....e...d.e.....e...e.j.g.d.......e...e.j.d.....d.S.)......)...Image..ImageFile)...i16be)...o8)...o32les.... .......1..L..RGBZ.CMYK..P..RGBA)......P1.....P2.....P3.....P4.....P5.....P6s....P0CMYKs....PyPs....PyRGBAs....PyCMYKc....................C...s....\|.d.d.....d.k.o.\|.d...d.v.S.).N.....r.........Ps....0123456y..)...prefixr....r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/PpmImagePlugin.py.._accept-...s......r....c....................@...s,...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PpmImageFileZ.PPMz.Pbmplus imagec....................C...s<...d.}.t.d...D.].}.\|.j...d...}.\|.r.\|.t.v.r...\|.S.\|.\|.7.}.q.\|.S.).N..........r....)...range..fp..read..b_whitespace)...self..magic.._..cr....r....r......_read_magic9...s.

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PsdImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4870
Entropy (8bit):	5.442623692408768
Encrypted:	false
SSDEEP:	96:mbI9gGI98Q66VfGkNVCznznkkloHj7kv4e0sMZq+ZUP9Isb88IM6rF9Q:moQ6ofpPuxlEnDBlILIF9Q
MD5:	610F4ED3B15C08BA03404608BF103029
SHA1:	97FBA6E788C66FD54C6E4AD7DD6383F31ED09FA6
SHA-256:	38E0A964EAB87CE3088EE744C86F0657F4E608A0B86FA9119F33AA2DA8B166AC
SHA-512:	8D3B7BA9ABFA1CA1977C263E0F9BCE2ADBD7D0455B961CEBDBF8E4ADAB823CB89478E96862FBB70E3740D53E753B7522DDC13CDFBB711B1EC0D66B7E478BF1FA
Malicious:	false
Preview:	o.......5+.d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.d.d...Z.e...e.j.e.e.....e...e.j.d.....e...e.j.d.....d.S.)......N.....)...Image..ImageFile..ImagePalette)...i8)...i16be)...i32be)...si16be)...1r....)...Lr....)...Pr....)...RGB.....)...CMYK.....).Z.LABr....).).r....r....).r.........).r....r....)......r....).r....r....).r....r....)......r....).r....r....)......r....c....................C...s....\|.d.d.....d.k.S.).Nr....s....8BPS..)...prefixr....r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/PsdImagePlugin.py.._accept-...s......r....c....................@...s0...e.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PsdImageFileZ.PSDz.Adobe PhotoshopFc....................C...sF...\|.j.j.}.\|.d...}.t.\|...r.t.\|.d...d.k.r.d.}.t.\|.....t.\|.d...}.t.\|.d...}.t.\|.d...}.t.\|.\|.f...\.}.}.\|.\|.k.r:d.}.t.\|.....\|.d.k.rF\|.d.k.rFd.}.d.}.\|.\|._.t.\|.d..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PyAccess.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10175
Entropy (8bit):	5.055187958942821
Encrypted:	false
SSDEEP:	192:GXVtfJt2xDhGi1mG2RoeMd7DcVf7V7Vji97V7Dg8FsdtAOaYRnmJ1e3:GltfJEsi1z/XL+n72e3
MD5:	FC8F4A288675DB5A1D939AE55280B90F
SHA1:	4D6A1A9074D2BDC7368A182EAB24E4D013281754
SHA-256:	04F6276EA40A9821DB78B583D5AADC3A9A58E3994702F0787ADD2CE8CB541289
SHA-512:	2C5F1BAD69E243B4D85A0C14F21934A907846EBDA2666EA9086583049942A3AF6224771358802B57DF08ACE9B223FD4A207285CACC5C7570CAD1BD9A15B220D7
Malicious:	false
Preview:	o.......5+.d.'.......................@...s....d.d.l.Z.d.d.l.Z.z.d.d.l.m.Z...d.Z.e...Z.e...e.....W.n...e.y8..Z...z.d.d.l.m.Z...e.e.....Z.Z.W.Y.d.Z.[.n.d.Z.[.w.w.e...e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.i.d.e...d.e...d.e...d.e...d e...d!e...d"e...d#e...d$e...d%e...d&e...d'e...d(e...d)e...d*e...d+e...d,e...Z.e.j.d-k.r.e.e.d.<.e.e.d/<.e.e.d0<.e.e.d1<.e.e.d2<.n.e.e.d.<.e.e.d/<.e.e.d0<.e.e.d1<.e.e.d2<.d6d4d5..Z.d.S.)7.....N)...FFIz\|. struct Pixel_RGBA {. unsigned char r,g,b,a;. };. struct Pixel_I16 {. unsigned char l,r;. };. .....)...DeferredErrorc....................@...s>...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.Z.e.Z.d.d...Z.d.S.)...PyAccessFc....................C...s....t.\|.j.j...}.\|.\|._.t...d.\|.d.....\|._.t...d.\|.d.....\|._.t...d.\|.d.....\|._.\|.j.j.\.\|._.\|._.\|.\|._.\|.j.\|._.\|.j.j.d.v.r=\|.j.\|._.\|.......d.S.).Nz.unsigne

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\QoiImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3424
Entropy (8bit):	5.275064969715929
Encrypted:	false
SSDEEP:	96:a7h89hfQnIq815XCuWz6/B8UqN1IxaZIAlZWjUB315dcOZuG4HFzGhbv:8ZIq815Cuk6mN1HRoIxGOZ30FzGhbv
MD5:	38C6761ABACD35A7AF50B340F7D5E195
SHA1:	5E69AA84B5279C0C994CB4687012ACA7014F09EA
SHA-256:	836C474357E11AE3315E8BC859B8F563B03E14548F81DD1B2F419867CBEB970B
SHA-512:	5AB291AD6AB88DB36EE830BB6E20DBD13F9CBA08B6F22F67F40DA5CF1D733DE3EA248000216C1D2247928FF9AA47497B4556B2CE43EFB8F2FABC900C89843A94
Malicious:	false
Preview:	o.......5+.d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...d.e.....e...e.j.d.....d.S.)......N.....)...Image..ImageFile)...i32be....o8c....................C...s....\|.d.d.....d.k.S.).N.....s....qoif..)...prefixr....r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/QoiImagePlugin.py.._accept....s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...QoiImageFileZ.QOIz.Quite OK Imagec........................s....t...j...d.....s.d.}.t.\|.....t...f.d.d...t.d...D......._...j...d...d...}.\|.d.k.r*d.n.d..._...j...d.t.j.....d.d...j.....j.....d.f.g..._.d.S.).Nr....z.not a QOI filec....................3...s .....\|.].}.t...j...d.....V...q.d.S.).r....N)...i32..fp..read.....0..i....selfr....r......<genexpr>....s........z%QoiImageFile._open.<locals>.<genexpr>.....r....r...........RGBZ.RGBA..qoi).r....r....).r....r....r......SyntaxError..tuple..range.._siz

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\SgiImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4001
Entropy (8bit):	5.483155727922378
Encrypted:	false
SSDEEP:	96:dKAR6IECyiEmt4uwj2zR3o3ve887cFoCmSEBAWG:vECyKt4uwjgRYWMFoCmSEBAWG
MD5:	9CF7B88183680096D29A9A6DFB448FA1
SHA1:	40605B9F321E89B47F83620624EE9A8A925BE40A
SHA-256:	1B75F5CB80F59AF0724DC9DBD2576B39C70111C8A167A0C36E9EE08A7BE81687
SHA-512:	4ADE7875C7CCE7DC8174BC5B8FC2517C66639C7B2481E713FDDC874D73C2168BAE06868F79C5B0E5ABDAE2560940D48DEF0086A96C2881822D9E745024F3B0A3
Malicious:	false
Preview:	o.......5+.d.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d.d.d.d.d.d.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.G.d.d...d.e.j...Z.e...d.e.....e...e.j.e.e.....e...e.j.e.....e...e.j.d.....e...e.j.g.d.......d.S.)......N.....)...Image..ImageFile)...i16be)...o8c....................C...s....t.\|...d.k.o.t.\|...d.k.S.).N..........)...len..i16)...prefix..r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/SgiImagePlugin.py.._accept!...s......r......L..L;16B..RGBz.RGB;16B..RGBAz.RGBA;16B).).r....r....r....).r....r....r....).r....r....r....).r....r....r....).r.........r....).r....r....r....).r....r.........).r....r....r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...SgiImageFileZ.SGIz.SGI Image File Formatc....................C...sx...d.}.\|.j...\|...}.t.\|...s.d.}.t.\|.....\|.d...}.\|.d...}.t.\|.d...}.t.\|.d...}.t.\|.d...}.t.\|.d...}.\|.\|.\|.f.}.d.}.z.t.\|...}.W.n...t.yD......Y.n.w.\|.d.k.rOd.}.t.\|.....\|.\|.f.\|._.\|..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\SpiderImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6635
Entropy (8bit):	5.313002496048074
Encrypted:	false
SSDEEP:	192:/Ppzql1yfEfcRemA6c1qOTB1KMUKL3RkRFgg2zJYzrzvrH7:/dql8fEfRmA6c1HTB1KMUi3RkRFgg2tC
MD5:	992CED5F15BA3C56A1E39DD3CF54E988
SHA1:	55D39565DB83855FF939B0AAFA74B8C0854F9B18
SHA-256:	EC93B77B71F221F18594EB77103D3E7777A0A766DC81257847D757F77FDE4562
SHA-512:	1E59439702DBEFD58AA13D009069D6E2538680B4C75A4FB404A2294001110C75738CDB3FDA10F98CEF2CB828353603D9A47C8C2C6DECD89A96BEADAEA8F17E0A
Malicious:	false
Preview:	o.......5+.d@&.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d...Z.g.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.e...e.j.e.....e...e.j.e.....e.d.k.r.e.e.j...d.k.r_e.d.....e.......e.j.d...Z.e.e...spe.d.....e.......e...e....iZ.e.d.e.e.........e.d.e.e.j.........e.d.e.e.j.........e.d.e.e.j.........e.d.d.d.....e.e.........e.e.j...d.k.r.e.j.d...Z.e...e.j j!..Z.e.d e.j".#e.....d!e...d.......e..$e.e.j.....W.d.........d.S.W.d.........d.S.1.s.w.......Y...d.S.d.S.)#.....N)...Image..ImageFilec....................C...s:...z.t.\|...}.\|.\|...d.k.r.W.d.S.W.d.S...t.t.f.y.......Y.d.S.w.).Nr.........)...int..ValueError..OverflowError)...f..i..r.....aC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/SpiderImagePlugin.py..isInt*...s....................r....).r.........i....i....i....i....c....................C...st...d.\|...}.d.D.].}.t.\|.\|.....s...d.S.q.t.\|.d.....}.\|.t.v.r.d.S.t.\|.d.....}.t.\|.d.....}.t.\|.d.....}.\|.\|.\|...k.r8d.

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\SunImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1933
Entropy (8bit):	5.4783753747187465
Encrypted:	false
SSDEEP:	48:3CPWqE+FuFyNDH57qowH32Sbxnm7CipyF:3d2uM5Vw5tC7pyF
MD5:	2A7ECA1EDA5BBD463084659B90FC7592
SHA1:	424B75EC571AA4D32E5DC278B556E91BE5E6FCE3
SHA-256:	0AB19F3C9A628FFC26942A9F6296FAE4FBA09964D84FB07BC43DDFE1459450F4
SHA-512:	BE11C8873CD6F865D9725FD840A685F12253287A1DF9B7E2BAD5AD660C152D2D76251F5123F5A8EEB02D520225AC4F1B7004BF871652BE8C21B82FFF1FF7AD0A
Malicious:	false
Preview:	o.......5+.d.........................@...s\...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)......)...Image..ImageFile..ImagePalette)...i32bec....................C...s....t.\|...d.k.o.t.\|...d.k.S.).N.....i.j.Y)...len..i32)...prefix..r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/SunImagePlugin.py.._accept....s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...SunImageFileZ.SUNz.Sun Raster Filec....................C...s....\|.j...d...}.t.\|...s.d.}.t.\|.....d.}.t.\|.d...t.\|.d...f.\|._.t.\|.d...}.t.\|.d...}.t.\|.d...}.t.\|.d...}.\|.d.k.r;d.\.\|._.}.nB\|.d.k.rEd.\.\|._.}.n8\|.d.k.rOd...\|._.}.n.\|.d.k.rc\|.d.k.r]d.\.\|._.}.n d.\.\|._.}.n.\|.d.k.rw\|.d.k.rqd.\.\|._.}.n.d.\.\|._.}.n.d.}.t.\|.....\|.r.\|.d.k.r.d.}.t.\|.....\|.d.k.r.d.}.t.\|.....\|.\|...}.t...d.\|.j...\|.....\|._.\|.j.d.k.r.d.\|._.\|...d.d...}.\|.j.d...\|...d...d...d...}.\|.d.v.r.d.d.\|.j...\|.\|.\|.f.f.g.\|._.d.S.\|.d.k.r.d.d.\|.j...\|.\|.f.g.\|._.d.S.d }.t.\|.....)!N. ..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\TarIO.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1587
Entropy (8bit):	5.263792233586746
Encrypted:	false
SSDEEP:	24:gtWLFLyTcq8trEy/s5QIMIWPFZbjkvJABX3kjd9coikJUbcyoa5QA/Q1yQRR36FU:TxLYN4rE4oJODkviX3G9bivbzQHLBb
MD5:	D64996AE2846265D455E8CE558F47639
SHA1:	B7A014504B189118F45FAA19756E6FB454911C94
SHA-256:	D9C6ACA60E4C94A106F9C709F6B60704A9B6EDB682B9C6A9D2CF78BCA0C06981
SHA-512:	8681BC115525EBA7A4D31B0D31CEB89A55F3A45387C89C002C59C12D3FC16923911882A82301E9022477A919F5AD1D9D04BEEDD5C146B0A1540010A1A66C1149
Malicious:	false
Preview:	o.......5+.d.........................@...s*...d.d.l.Z.d.d.l.m.Z...G.d.d...d.e.j...Z.d.S.)......N.....)...ContainerIOc........................s8...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)...TarIOzHA file object that provides read access to a given member of a TAR file.c........................s....t.\|.d...\|._...\|.j...d...}.t.\|...d.k.r.d.}.t.\|.....\|.d.d.......d...}.\|...d...}.\|.d.k.r1d.}.t.\|.....\|.d.k.r;\|.d.\|.....}.t.\|.d.d.....d...}.\|.\|.k.rIn.\|.j...\|.d...d.@.t.j.....q.t.....\|.j.\|.j.....\|.....d.S.).zz. Create file object... :param tarfile: Name of TAR file.. :param file: Name of member file.. ..rbTi....z.unexpected end of tar fileN.d...z.utf-8...r....z.cannot find subfile.\|............i....i....)...open..fh..read..len..OSError..decode..find..int..seek..io..SEEK_CUR..super..__init__..tell)...self..tarfile..file..s..msg..name..i..size....__class__...UC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/TarIO.pyr........s&.

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\TgaImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4038
Entropy (8bit):	5.458761842451197
Encrypted:	false
SSDEEP:	96:XF0tw8R6P5Nkex4ttreLtQvrixFxhNu+FdcPI8Fe7u57D4j:XQw8zexAtreeixF9u+vcnU7o7D4j
MD5:	48D5660AC545FC9A78C2811434DC775E
SHA1:	1C9B3F83F3D03E6481D52576909DE8FF675FE967
SHA-256:	25E57BC13033AE11F2136E2F715E4386EDB528D06DD9AE6E312AFE2AAA605BD0
SHA-512:	18918730D83CB7F96D8749DBCF3633F555E1E8E4FA2A0540A1B911034786AB60AC610AE053B4F676865F65ABE22EC58D5BDA6BC8569619B4962257A77A89A26F
Malicious:	false
Preview:	o.......5+.d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.d.d.d.d.d.d...Z.G.d.d...d.e.j...Z.d.d.d.d.d.d.d...Z.d.d...Z.e...e.j.e.....e...e.j.e.....e...e.j.g.d.......e...e.j.d.....d.S.)......N.....)...Image..ImageFile..ImagePalette)...i16le)...o8)...o16le..P..1..L..LAz.BGR;5..BGR..BGRA).).r.........)......r....).r....r....).r.........)......r....).r.........).r..... ...c....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...TgaImageFileZ.TGAZ.Targac....................C...s~...\|.j...d...}.\|.d...}.\|.d...}.\|.d...}.\|.d...}.\|.d...}.t.\|.d...t.\|.d...f.\|._.\|.d.v.s;\|.j.d...d.k.s;\|.j.d...d.k.s;\|.d.v.rAd.}.t.\|.....\|.d.v.rXd.\|._.\|.d.k.rPd.\|._.n%\|.d.k.rWd.\|._.n.\|.d.v.r`d.\|._.n.\|.d.v.rod.\|._.\|.d.k.rnd.\|._.n.d.}.t.\|.....\|.d.@.}.\|.d.v.\|._.\|.d.v.r.d.}.n.\|.d.v.r.d.}.n.d.}.t.\|.....\|.\|.j.d.<.\|.d.@.r.d.\|.j.d <.\|.r.\|.j...\|...\|.j.d!<.\|.r.t.\|.d"..t.\|.d#..\|.d$......}.}.}.\|.d.k.r.t...d%d&\|...\|.j...d.\|.........\|._.n+\|.d'k.r.t...d(d)\|...\|.j...d"

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\TiffImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	52123
Entropy (8bit):	5.663149033479821
Encrypted:	false
SSDEEP:	768:HMqP5b6B6/HlcX1PEHmkglIM/phzpHvoUYW2NetwwWjEVh9QQllmHXgd:B/HyX1PEHmYQz5lYW2NetwnEVhpIHXQ
MD5:	74BC1C141055769BD1141E8ECE298B0F
SHA1:	84D8AC8D0AD5A752962AB90DDCA526E431BBE8D9
SHA-256:	2A7ACED736E13AB4C9ABE3762F6D0A2A3387AF0DD3A0AFF5237AD0E55FF55F94
SHA-512:	B874A485409B3B794F56B1A6DF7D20C809DB4BF445D3E14BA6DA5432F31B64B400728959E24245664DD73DAD5E327BC7F97A18554F21D2DE7AC46A541A2945AC
Malicious:	false
Preview:	o.......5+.dk5.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(d.Z)d.Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d.Z3d Z4d!Z5d"Z6d#Z7d$Z8d%Z9d&Z:d'Z;d(Z<d)Z=dZ>d+Z?d,Z@d-ZAd.ZBd/ZCd0ZDd1ZEd2ZFd3ZGd4ZHd5ZId6ZJd7ZKi.d.d8..d9d:..d;d<..d=d>..d?d@..dAdB..dCdD..dEdF..dGdH..dIdJ..dKdL..dMdN..dOdP..dQdR..dSdT..dUdV..dWdX..ZLdYdZ..eL.M..D...ZNi.e"d.d[d.d[d\f.d]..e#d.d[d.d[d\f.d]..e"d.d[d9d[d\f.d^..e#d.d[d9d[d\f.d^..e"d.d[d.d[d\f.d_..e#d.d[d.d[d\f.d_..e"d.d[d9d[d\f.d`..e#d.d[d9d[d\f.d`..e"d.d[d.dad\f.db..e#d.d[d.dad\f.db..e"d.d[d9dad\f.dc..e#d.d[d9dad\f.dc..e"d.d[d.dad\f.dd..e#d.d[d.dad\f.dd..e"d.d[d9dad\f.de..e#d.d[d9dad\f.de..e"d.d[d.dfd\f.dg..i.e#d.d[d.dfd\f.dg..e"d.d[d9dfd\f.dh..e#d.d[d9dfd\f.dh..e"d.d[d.dfd\f.di..e#d.d[d.dfd\f.di..e"d.d[d9dfd\f.dj..e#d.d[d9dfd\f.dj..e"d.d[d.dkd\f.dl..e#d.d[d.dk

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\TiffTags.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12827
Entropy (8bit):	6.098020721768083
Encrypted:	false
SSDEEP:	192:6y0UJg/OjKvafcCpW4viVym51IQ1DsS5rOyjA7qxy0k4bde:I/8BWv5NGWrkO1Rw
MD5:	CB15D5B021198C5E90F94D2B06981775
SHA1:	03F13552D8BFA9E01C90EFD097DE50CF092EF64E
SHA-256:	41CC288569F3E2370C226AF5B54D4A74B37307B4777731BAF59D8F68F4F9D99B
SHA-512:	0FE5C8841ACB4FEBF7736A7595E5CD4C85D712D3D7B17F8A8260525008104CD65D52CE3B3931AB5C7A76CBA558915BBBFA8F48EF97556095397ECE734E75DC72
Malicious:	false
Preview:	o.......5+.d.C.......................@...s@...d.d.l.m.Z...G.d.d...d.e.d.d.....Z...d"d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d e.d.f...d!d"e.d.d.d.d.d.d.d.d#d$..f...d%d&e.d.d.d.d.d.d.d.d.d.d'd(d)..f...d*d+e.d.f...d,d-e.d.f...d.d/e.d.f...d0d1e.d.f...d2d3e.d.f...d4d5e.d.f...d6d7e.d.f...d8d9e.d.f...d:d;e.d.f...d<d=e.d.f...i.d>d?e.d.f...d@dAe.d.f...dBdCe.d.f...dDdEe.d.f...dFdGe.d.f...dHdIe.d.f...dJdKe.d.f...dLdMe.d.d.d.dN..f...dOdPe.d.f...dQdRe.d.f...dSdTe.d.f...dUdVe.d.f...dWdXe.d.f...dYdZe.d.f...d[d\e.d.f...d]d^e.d.f...d_d`e.d.f.....i.dadbe.d.d.d.d.dc..f...dddee.d.f...dfdge.d.f...dhdie.d.f...djdke.d.f...dldme.d.f...dndoe.d.f...dpdqe.d.d.d.dr..f...dsdte.d.f...dudve.d.f...dwdxe.d.f...dydze.d.f...d{d\|e.d.f...d}d~e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f.....i.d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.e.d.f...d.d.

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\WalImageFile.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2886
Entropy (8bit):	5.998193538378216
Encrypted:	false
SSDEEP:	48:/lXoOokqW9P76k59LeLet2SWUpQe/FEvaMGulxu7XDqQby4Yxm:ipW9P7lWLRUHSaOl87O9Y
MD5:	512D00CD90B1ED97CDE9B9CA63165660
SHA1:	164641C12B00BA75849C19FBDA5C4FDAE015FB17
SHA-256:	F075D5B5EAF0C3E2AA8D8793B3DDD6FE3BC7F40483AAC777BF84F0E793BAEA21
SHA-512:	32B04DFA7487F3082E447C360D19BC3ED313BD380FC497CCD0326F97E6B6D4D227C59B0DC0B2987533B5DB8F5E232705463FEECA70E71BE16ED1BBC16E464FAD
Malicious:	false
Preview:	o.......5+.d.........................@...sB...d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.d...Z.d.Z.d.S.).a.....This reader is based on the specification available from:.https://www.flipcode.com/archives/Quake_2_BSP_File_Format.shtml.and has been tested with a few sample files found using google..... note::. This format cannot be automatically recognized, so the reader. is not registered for use with :py:func:`PIL.Image.open()`.. To open a WAL file, use the :py:func:`PIL.WalImageFile.open()` function instead.......)...Image..ImageFile)...i32lec....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...WalImageFileZ.WALz.Quake2 Texturec....................C...s....d.\|._.\|.j...d...}.t.\|.d...t.\|.d...f.\|._.t...\|.j.....t.\|.d...}.\|.j...\|.....\|.d.d.......d.d...d...\|.j.d.<.\|.d.d.......d.d...d...}.\|.rI\|.\|.j.d.<.d.S.d.S.).N..P.d.... ....$....(.........r...........name.8....X.....next_name)...mode..fp..read..i32.._sizer....Z._decompression_bomb_check..size..seek..split.

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\WebPImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7532
Entropy (8bit):	5.492225976651654
Encrypted:	false
SSDEEP:	192:mN0AHU7yy5Nt948/SAlAr9qOs+RKMHW9h:fAHU7yy5N5ArgOsV
MD5:	FDFF885230A525C4D11438F3ECA62442
SHA1:	BC1D8C8113C2F14A74F695ABF59463A61B3A9CB7
SHA-256:	677D814A4BCF9C723BC1CAD4F7CB0617B35E922A2B4322F8EF537CF60F846944
SHA-512:	38652B4297CBF0806549776215EFD8434AB70918ADAFD3F9248EC0D4CB9C720E63998BC54BE75EAE7686B5055A999C52B9A613F261B15D5E6E071C00EDEB6DA6
Malicious:	false
Preview:	o.......5+.d.-.......................@...s....d.d.l.m.Z...d.d.l.m.Z.m.Z...z.d.d.l.m.Z...d.Z.W.n...e.y#......d.Z.Y.n.w.d.d.d.d...Z.d.d.d...Z.d.d.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.d.d...Z.e...e.j.e.e.....e.rue...e.j.e.....e.j.ree...e.j.e.....e...e.j.d.....e...e.j.d.....d.S.d.S.)......)...BytesIO.....)...Image..ImageFile)..._webpTF)...RGBX..RGBA..RGB).r....r....r....r....).s....VP8 s....VP8Xs....VP8Lc....................C...sV...\|.d.d.....d.k.}.\|.d.d.....d.k.}.\|.d.d.....t.v.}.\|.r%\|.r'\|.r)t.s#..d.S.d.S.d.S.d.S.d.S.).N.....s....RIFF..........s....WEBP.....zEimage file could not be identified because WEBP support not installedT)..._VP8_MODES_BY_IDENTIFIER..SUPPORTED)...prefixZ.is_riff_file_formatZ.is_webp_fileZ.is_valid_vp8_mode..r....._C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/WebPImagePlugin.py.._accept....s......................r....c........................sr...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z...f

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\WmfImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3454
Entropy (8bit):	5.245874075977342
Encrypted:	false
SSDEEP:	96:FFqlpWUFa1E4Bd/mNHMIn4KL33iVIfWOrnFhoirl9nZzVa8DPa:FWplF0E2FCnn/iqrnFqiR9nZzVa8DPa
MD5:	6B7FCE91B2A4865642DED2CD92664AEA
SHA1:	0D7C5CFF854D35E15115E298438E168B9CE3C02F
SHA-256:	30F40F90E1BFCB7AB4989E1301FAC620D91F5D29E5EAB05BA86E408FCDE924DF
SHA-512:	E715395BF738188CCF0DDD848F2B2DD1736738374848BE08A28187E6A94657010D7871D417E96E8D5B0AC6B491B9656268DE297E11222C032792AC6F1DB4CB75
Malicious:	false
Preview:	o.......5+.d.........................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.a.d.d...Z.e.e.j.d...r2G.d.d...d...Z.e.e.......d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.d.g.....d.S.)......)...Image..ImageFile)...i16le)...si16le)...si32leNc....................C...s....\|.a.d.S.).z^. Install application-specific WMF image handler... :param handler: Handler object.. N...._handler)...handler..r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/WmfImagePlugin.py..register_handler....s......r......drawwmfc....................@...s....e.Z.d.Z.d.d...Z.d.d...Z.d.S.)...WmfHandlerc....................C...s....d.\|._.\|.j.d...\|._.d.S.).N..RGB..wmf_bbox)...mode..info..bbox....self..imr....r....r......open,...s........z.WmfHandler.openc....................C...sL...\|.j...d.....t...d.\|.j.t.j...\|.j.....\|.j.\|.j...d.d.\|.j.d...d...d...d.@.d...S.).N.....r......rawZ.BGR...............)...fp..seekr......frombytes..size..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\XVThumbImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1455
Entropy (8bit):	5.450023753847409
Encrypted:	false
SSDEEP:	24:v7joRVOhCY/B/Hn95ht6ArzWDD5wfCY1dA8/BdU/8bJGkSO5wSF25Viesw/srzIx:QRMVH95fZWDN//8bJGkL5wY25V5czO
MD5:	07346657C727FA022B6F873338F33B30
SHA1:	7CF88FC81BB9F86A6D18299026021A197C5F14D8
SHA-256:	A3DEC612B10717CE2C89CDECB26C899FB44A4EC8B3215CADF5B1B5C6C66547CE
SHA-512:	3D967014B74543FB7A9029416E2AA519BB58E642559E9B9DE661B63D19A6FA658F836DA375D974782589D17ACFE31BDB98001FE7622AC892B1703165BE847A26
Malicious:	false
Preview:	o.......5+.d.........................@...s....d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.e.d...D.]*Z.e.d...D.]#Z.e.d...D.].Z.e.e.e.d...d.....e.e.d...d.......e.e.d...d.........Z.q$q.q.d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....d.S.)......)...Image..ImageFile..ImagePalette)...o8s....P7 332..............................c....................C...s....\|.d.d.....t.k.S.).N.....)..._MAGIC)...prefix..r.....bC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/XVThumbImagePlugin.py.._accept#...s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...XVThumbImageFileZ.XVThumbz.XV thumbnail imagec....................C...s....t.\|.j...d.....s.d.}.t.\|.....\|.j.........\|.j.....}.\|.s!d.}.t.\|.....\|.d...d.k.r(n.q.\|.........}.d.\|._.t.\|.d.....t.\|.d.....f.\|._.t...d.t...\|._.d.d.\|.j...\|.j.....\|.j.d.d.f.f.g.\|._.d.S.).Nr....z.not an XV thumbnail fileTz(Unexpected EOF reading XV thumbnail file......#.....Pr......RGB..raw).r....r....).r......fp..read..SyntaxError..readline..stri

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\XbmImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2120
Entropy (8bit):	5.591489847137234
Encrypted:	false
SSDEEP:	48:+QW/yPvZj5KWvw4oe1PsYFqPmXR7kF7oQFMDjJFzkmXU/y9yB:HXZjFwGkQRhQWDjJdXU/y9yB
MD5:	4FF6F1660CDEDB05F07BC46C4DD87231
SHA1:	996A6E6CDBFC056B94C5CCDFBC3F271408514B0E
SHA-256:	11837AE2A8F18D24355ED863F2AAAA0124270C53BFF044EFD586270A6CEE7986
SHA-512:	EED91D1D337C7B74EF1B7AE04BDCD90C96DFADEF0AE53E6326D4F29C32A03BB31C1077F659EBF337B10915B11D55071739157671B69D23A4ED88C7092558B89B
Malicious:	false
Preview:	o.......5+.d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...e...d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....e...e.j.d.....d.S.)......N.....)...Image..ImageFiles....\s#define[ \t]+._width[ \t]+(?P<width>[0-9]+)[\r\n]+#define[ .]+._height[ .]+(?P<height>[0-9]+)[..]+(?P<hotspot>#define[ .]+[^_]_x_hot[ .]+(?P<xhot>[0-9]+)[..]+#define[ .]+[^_]_y_hot[ .]+(?P<yhot>[0-9]+)[..]+)?[\000-\377]_bits\[]c....................C...s....\|.....d.d.....d.k.S.).N.....s....#define)...lstrip)...prefix..r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/XbmImagePlugin.py.._accept&...s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...XbmImageFileZ.XBMz.X11 Bitmapc....................C...s....t...\|.j...d.....}.\|.s.d.}.t.\|.....t.\|...d.....}.t.\|...d.....}.\|...d...r5t.\|...d.....t.\|...d.....f.\|.j.d.<.d.\|._.\|.\|.f.\|._.d.d.\|.j...\|.....d.f.g.\|._.d.S.).Ni....z.not a XBM file..width..height..hotspotZ.xhotZ.yhot

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\XpmImagePlugin.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	5.514228424423944
Encrypted:	false
SSDEEP:	48:yovkl98767MT1CrYrl7lfRh/YsJLUj4mmOvW51X5ak8yqn19P:ql9HEnxFpYECvW7oNn19P
MD5:	16ED196D45E355226C949CFC426EE0C2
SHA1:	B674870F7754C7CEDE150B5FE9F16B6B16777203
SHA-256:	30AAC0B943BE316D1B827103F2713705FC22FC10C680D0642372BD29E3F99097
SHA-512:	5DF3D09216DE4A811E8C0F4A01ED6704A51D137FD9D1AC00497EAD024F56B646D95706D6E244DE895C6B4383BADAE24DAE0E3FB1B17CFAF40B1FB3151BE566AD
Malicious:	false
Preview:	o.......5+.d.........................@...s\|...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...e...d...Z.d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....e...e.j.d.....d.S.)......N.....)...Image..ImageFile..ImagePalette)...o8s$..."([0-9]) ([0-9]) ([0-9]) ([0-9])c....................C...s....\|.d.d.....d.k.S.).N.....s..../* XPM */..)...prefixr....r.....^C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/XpmImagePlugin.py.._accept....s......r....c....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...XpmImageFileZ.XPMz.X11 Pixel Mapc....................C...s....t.\|.j...d.....s.d.}.t.\|.......\|.j.....}.\|.s.d.}.t.\|.....t...\|...}.\|.r$n.q.t.\|...d.....t.\|...d.....f.\|._.t.\|...d.....}.t.\|...d.....}.\|.d.k.sJ\|.d.k.rPd.}.t.\|.....d.g.d...}.t.\|...D.].}.\|.j.....}.\|.d.d.....d.k.ro\|.d.d.....}.n.\|.d.d.....d.v.r}\|.d.d.....}.\|.d...}.\|.d.d.........}.t.d.t.\|...d...D.]J}.\|.\|...d.k.r.\|.\|.d.....}.\|.d.k.r.\|.\|.j.d.<.n0\|.d.d.....d.k.r.t.\|.d.d.....d...}.t.\|.d.?.d.@...t.\|.d.?

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1932
Entropy (8bit):	5.396717591242199
Encrypted:	false
SSDEEP:	48:/UqetD27XhaCqLfLgpG08IqLUYRuYaQr5TS:8dDfCifLj0ZqL+A1e
MD5:	98CBD308586F81C95E051AB8B53F93D9
SHA1:	EE5AB9B826E7A4C61F6500427D4C2F5D6A45F156
SHA-256:	7BF25C5E3BAB140A7AAB4E6455A3651D20E8380011F9377D9A1034D1CB5D1C93
SHA-512:	274D9297079524004D63ED017FF61EF10207297F880255DFE035F469FEC9E3EF1B8D990B53F61E398C656C67A936B83161B5F22B1536090096A179DA0E243503
Malicious:	false
Preview:	o.......5+.d+........................@...s4...d.Z.d.d.l.m.Z...e.j.Z.[.g.d...Z.G.d.d...d.e...Z.d.S.).ah...Pillow (Fork of the Python Imaging Library)..Pillow is the friendly PIL fork by Jeffrey A. Clark (Alex) and contributors.. https://github.com/python-pillow/Pillow/..Pillow is forked from PIL 1.1.7...PIL is the Python Imaging Library by Fredrik Lundh and contributors..Copyright (c) 1999 by Secret Labs AB...Use PIL.__version__ for this Pillow version...;-)......)..._version)/Z.BlpImagePluginZ.BmpImagePluginZ.BufrStubImagePluginZ.CurImagePluginZ.DcxImagePluginZ.DdsImagePluginZ.EpsImagePluginZ.FitsImagePluginZ.FitsStubImagePluginZ.FliImagePluginZ.FpxImagePluginZ.FtexImagePluginZ.GbrImagePluginZ.GifImagePluginZ.GribStubImagePluginZ.Hdf5StubImagePluginZ.IcnsImagePluginZ.IcoImagePluginZ.ImImagePluginZ.ImtImagePluginZ.IptcImagePluginZ.JpegImagePluginZ.Jpeg2KImagePluginZ.McIdasImagePluginZ.MicImagePluginZ.MpegImagePluginZ.MpoImagePluginZ.MspImagePluginZ.PalmImagePluginZ.PcdImagePluginZ.Pc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\main.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	229
Entropy (8bit):	4.935349120084603
Encrypted:	false
SSDEEP:	6:y/Kqtez/QolsQjkWhY6f+uyxn23d6ZUArE6x:Cdez/QonY6zIi6x
MD5:	145B65EE12AF3402FB057F255B538B79
SHA1:	696D0C9F9466727603C9FA257979D97ECC86E355
SHA-256:	9073BE862DABBE750FCF37504A645F7277041E7EBC5D6229EFD6BC3422D45E75
SHA-512:	92D25C2F037D74AED3F7C758FBDE4C8BBC839C9A9D9BD46F09889948DF5D690788FB25A457C84B63C1C635640BFB2EE584F98A4331A8E5B5D7E5353D41556A27
Malicious:	false
Preview:	o.......5+.d,........................@...s....d.d.l.m.Z...e.....d.S.)......)...pilinfoN)...featuresr......r....r.....XC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/__main__.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_binary.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2580
Entropy (8bit):	4.7500406426629596
Encrypted:	false
SSDEEP:	48:vFgArZ6vqHrOAbIUG5EJrXuAWai5N8A+ux:vFgsKIRA5N8A+I
MD5:	74E3F4B6BE97C9F2D651A0FBF5E4EDC2
SHA1:	A1EB5BEF5A8FBD169D93E9487E7AF074F3B30D2E
SHA-256:	2AE4B04605EB0FE69D29E288FD241BE9339E55E61401EE52C898EFF2A156DD60
SHA-512:	6860F5C4FEF0D0079C61D3E88EC040601221E7B568AE05FBEC5D57526CC8CDB201BE69F960EE1403FFAE6E919505A96B3C345CAF217D8499F04E4281A4607CB8
Malicious:	false
Preview:	o.......5+.da........................@...s....d.Z.d.d.l.m.Z.m.Z...d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z%Binary input/output support routines......)...pack..unpack_fromc....................C...s....\|.j.t.u.r.\|.S.\|.d...S.).Nr....)...__class__..int)...c..r.....WC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/_binary.py..i8....s......r....c....................C...s....t.\|.d.@.f...S.).N.....)...bytes....ir....r....r......o8....s......r....c....................C........t.d.\|.\|...d...S.).z.. Converts a 2-bytes (16 bits) string to an unsigned integer... :param c: string containing bytes to convert. :param o: offset of bytes to convert in string. ..<Hr......r......r......or....r....r......i16le...........r....c....................C...r....).z.. Converts a 2-bytes (16 bits) string to a signed integer... :param c: string containing bytes to convert. :param o: o

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_deprecate.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2116
Entropy (8bit):	5.445934275465931
Encrypted:	false
SSDEEP:	48:MSwvVVxX8YL3wP5m0vwmvrrVlDgfZV1hyGzC:MtHxXJL3irr/ERVvLzC
MD5:	31587D665150D655F299DEA2F62DDA60
SHA1:	61B0E49A484E8F57A6D98BD8F66CC72CF8D3BA99
SHA-256:	6BA5A5D8DB033DB3B2D45C7330FEF342E92F800E995D12F26ED9425C0C24F9F1
SHA-512:	F4AB713F9F1BD3625B12115307610F3B5C394DB247B323C8D95C35DC3FB0648DE5D06505E19CE84BEC85D4746491F355A505D3730C9AA8A199B1042D7A7AD4DA
Malicious:	false
Preview:	o.......5+.d.........................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...d.d.d...Z.d.S.)......)...annotationsN.....)...__version__F)...action..plural..deprecated..str..when..int \| None..replacement..str \| Noner....r......bool..return..Nonec....................C...s....\|.r.d.n.d.}.\|.d.u.r.d.}.n2\|.t.t...d...d.....k.r$\|...d.\|...d...}.t.\|.....\|.d.k.r+d.}.n.\|.d.k.r2d.}.n.d.\|...d.t...d...}.t.\|.....\|.rI\|.rId.}.t.\|.....\|.rRd.\|...d...}.n.\|.r^d.\|...d.....d...}.n.d.}.t.j.\|...d.\|...d.\|...\|.....t.d.d.....d.S.).a..... Deprecations helper... :param deprecated: Name of thing to be deprecated.. :param when: Pillow major version to be removed in.. :param replacement: Name of replacement.. :param action: Instead of "replacement", give a custom call to action. e.g. "Upgrade to new thing".. :param plural: if the deprecated thing is plural, needing "are" instead of "is"... Usually of the form:.. "[deprecated] is deprecated and will be removed in Pillow [wh

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_tkinter_finder.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	686
Entropy (8bit):	5.610620108094022
Encrypted:	false
SSDEEP:	12:CmUvGBcYmcmfWO/dilNZy6ert2WRXF73xq63tHfXsYnhWE7IoDIfyt:8ywWO/wlNZyNhRXFVphWqX
MD5:	41FE69B5F6E796FCBD4134261A1C2626
SHA1:	824F3B119A8EC491981513A18F654125293C4D24
SHA-256:	4EB052202D803E8C50FC2C4FBF9DF47A5305EB1FE27FA342B64F79F63EB814DA
SHA-512:	95B56DE4ECCE4B76565B9523584CBE75F5B8BF244D91420BD83D4EAAAFB07CDF25935BDABE0B1BF64CB0A74FE11030BED7F0F24493BB0D9C054C607252C71650
Malicious:	false
Preview:	o.......5+.d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...z.e.e.d...r!e.j.j.Z.n.e.j.Z.W.n...e.y0......d.Z.Y.n.w.e.e.j...Z.e.d.k.rCe.d.d.d.d.....d.S.d.S.).z4 Find compiled module linking to Tcl / Tk libraries......N)..._tkinter.....)...deprecateZ.pypy_find_executablez.8.4z.Support for Tk/Tcl 8.4.....z%Please upgrade to Tk/Tcl 8.5 or newer)...action)...__doc__..sys..tkinterr....Z.tkZ._deprecater......hasattrZ.tklib_cffi..__file__Z.TKINTER_LIB..AttributeError..strZ.TkVersionZ.tk_version..r....r....._C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/_tkinter_finder.py..<module>....s&.........................................

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_util.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1017
Entropy (8bit):	4.671276991409208
Encrypted:	false
SSDEEP:	24:CoUhX9DkeZduL2n/MOU543Mf6IcvVXkJWlpA5oQG:CDzDZ7M2NO1S/dX3l0od
MD5:	9D4D760E386913AD7830B6AF5DB059DC
SHA1:	0CC2EE61817EEDB015F8E3CCFE6F187D0420E19C
SHA-256:	FEF6E030EB01601D3D59D4F8D2F2ED95475CFB47C8320CA0C95B1B340D9AB6C6
SHA-512:	E7BEA1AFC141AF39C4F2494A87C2595FC4DC1008339B8C2BAC8D248E547D436C037836FC78C68787A8A551F795ACDDF597C11E1374212BC2CDED9D90440C2C80
Malicious:	false
Preview:	o.......5+.d.........................@...s6...d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d...Z.G.d.d...d...Z.d.S.)......N)...Pathc....................C...s....t.\|.t.t.t.f...S...N)...isinstance..bytes..strr........f..r.....UC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/_util.py..is_path....s......r....c....................C...s....t.\|...o.t.j...\|...S.).zCChecks if an object is a string, and that it points to a directory.).r......os..path..isdirr....r....r....r......is_directory....s......r....c....................@...s....e.Z.d.Z.d.d...Z.d.d...Z.d.S.)...DeferredErrorc....................C...s....\|.\|._.d.S.r........ex)...selfr....r....r....r......__init__....s......z.DeferredError.__init__c....................C...s....\|.j...r....r....).r......eltr....r....r......__getattr__....s......z.DeferredError.__getattr__N)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....).r......pathlibr....r....r....r....r....r....r....r......<module>..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_version.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.976492164482279
Encrypted:	false
SSDEEP:	3:y/K3WuletxbkCo1Kntt/lPle5jAuy2LqiE2J51X6rSkuDVWrzr9GMe8ITgM:y/KGqetGCownr++uyxn23d6ZUAr1i8It
MD5:	D15146BAE76F9E6C50852939AEE510E9
SHA1:	E8991DA4D4E0060F4D47227CDA207758898CF29B
SHA-256:	53C70811D925807374B3440DAD2C170F0C7D16E62F734D068D74A7E48F127AC6
SHA-512:	A3E2F4431ABC1F47F311E2D7FAF478277D81FCE7BB65C8B388C442829611345E346CB903632AB8B09BC14F63DDB964A76BBF51B8CD7787835BB647C2C55D1765
Malicious:	false
Preview:	o.......5+.d4........................@...s....d.Z.d.S.).z.9.5.0N)...__version__..r....r.....XC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\PIL/_version.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\features.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8802
Entropy (8bit):	5.611343509782036
Encrypted:	false
SSDEEP:	192:eKKSksSV9CXmXSbLO/ZqcSqxNmXrDSvDqPY1u5kK/iGs3yzcCtq:edsSV97XSXSZqcSqLe/Sv2PYQ5kKNs3L
MD5:	69FCFD9FC77EC531371D781A3C18CB36
SHA1:	E35893F4CB9ABB9F9AEE65A19FD0C2805D9A8E90
SHA-256:	E2D009EA1F2161ACEE8A9DEDC0AEE518E11DF63CA63FDBAF5819D5C3008D5439
SHA-512:	579EBAEE8B214E883CD55141CA2CEAD8173D6126894131523407128AB67EE37AA0A163805222853635DA21EB37A6A3F57E9988A15C3718A245050FEB9FDE6B84
Malicious:	false
Preview:	o.......5+.d.&.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d.d.d.d d!d"d#d$..Z.d%d&..Z.d'd(..Z.d)d*..Z.d+d,..Z.d-d...Z.d/d0..Z.d4d2d3..Z.d.S.)5.....N.....)...Image)...PIL._imagingZ.PILLOW_VERSION).z.PIL._tkinter_finderZ.tk_version)...PIL._imagingftZ.freetype2_version).z.PIL._imagingcmsZ.littlecms_version)...PIL._webpZ.webpdecoder_version)...pil..tkinter..freetype2..littlecms2..webpc....................C...s\|...\|.t.v.r.d.\|.....}.t.\|.....t.\|...\.}.}.z.t.\|.....W.d.S...t.y$......Y.d.S...t.y=..}...z.t...t.\|.......W.Y.d.}.~.d.S.d.}.~.w.w.).z.. Checks if a module is available... :param feature: The module to check for.. :returns: ``True`` if available, ``False`` otherwise.. :raises ValueError: If the module is not defined in this version of Pillow.. z.Unknown module TFN)...modules..ValueError..__import__..ModuleNotFoundError..ImportError..warnings..warn..str)

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_binary.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	4.824787796839016
Encrypted:	false
SSDEEP:	48:RqKCCopbkQRIPC4PKUERbUkT8Ui4KUPTbUvkCm1HaM69Et:RjCHRI64hEqkPiaPsvkCm1HaM69Et
MD5:	021DBA4C7A4B29D423782244D3A144CB
SHA1:	48E63ABC3B144E00687B3D0EE43E4C3CC5D5FBF5
SHA-256:	4ECD872A828431CF4DE03B202184E624CFDE7232AC7B1C4986C2FACD1D2D9AE4
SHA-512:	02B1DD134F6626DF4CFACBCE125B7A3D112F3B4B2AC70B9107EE4F0FB7481A233FB05C048A6E1B9DDB7FCCD06A910F86E91279A93C5653CF952A6E8C7A31A26A
Malicious:	false
Preview:	#..# The Python Imaging Library...# $Id$..#..# Binary input/output support routines...#..# Copyright (c) 1997-2003 by Secret Labs AB..# Copyright (c) 1995-2003 by Fredrik Lundh..# Copyright (c) 2012 by Brian Crowell..#..# See the README file for information on usage and redistribution...#......"""Binary input/output support routines."""......from struct import pack, unpack_from......def i8(c):.. return c if c.__class__ is int else c[0]......def o8(i):.. return bytes((i & 255,))......# Input, le = little endian, be = big endian..def i16le(c, o=0):.. """.. Converts a 2-bytes (16 bits) string to an unsigned integer..... :param c: string containing bytes to convert.. :param o: offset of bytes to convert in string.. """.. return unpack_from("<H", c, o)[0]......def si16le(c, o=0):.. """.. Converts a 2-bytes (16 bits) string to a signed integer..... :param c: string containing bytes to convert.. :param o: offset of bytes to convert in string.. """.. r

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_deprecate.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2071
Entropy (8bit):	4.589222340458015
Encrypted:	false
SSDEEP:	24:1Rwg1cgFqz0R/vAcM7LyAzyilznQkfw3mDpLGlgByTyZ85CMCMrO0Z8N0jXQYzSa:Ph1c0EC/vAcMPhckUmwlg0rh9ys
MD5:	1FF3429EB212EA16009031EDF66922D3
SHA1:	A2C8CC2898598921F4E5B92F2F16AEEBA7C6B4B7
SHA-256:	033BFA7B1CAA13F7D126C44DD85D79E6256D4622F02DD71CDE0020953D57AFC5
SHA-512:	94F7C00E2EFFF78476C8ED564799191B61553BF47D29E3368662268279523950815EE0AA7624397D5E67533D69E8346C8DC0D1997C506D77FAC95939A3A0411B
Malicious:	false
Preview:	from __future__ import annotations....import warnings....from . import __version__......def deprecate(.. deprecated: str,.. when: int \| None,.. replacement: str \| None = None,.. *,.. action: str \| None = None,.. plural: bool = False,..) -> None:.. """.. Deprecations helper..... :param deprecated: Name of thing to be deprecated... :param when: Pillow major version to be removed in... :param replacement: Name of replacement... :param action: Instead of "replacement", give a custom call to action.. e.g. "Upgrade to new thing"... :param plural: if the deprecated thing is plural, needing "are" instead of "is"..... Usually of the form:.... "[deprecated] is deprecated and will be removed in Pillow [when] (yyyy-mm-dd)... Use [replacement] instead.".... You can leave out the replacement sentence:.... "[deprecated] is deprecated and will be removed in Pillow [when] (yyyy-mm-dd)".... Or with another call to action:....

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingft.cp310-win_amd64.pyd

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1715712
Entropy (8bit):	6.766126807611171
Encrypted:	false
SSDEEP:	24576:avFvHnJD9hnKf7IT6Cscv78+yiMW2X2IUAZe/vkrrsaCWZy+1XxZZANNX2wl4N:atvHB206gv7dyiMA3HknsPWDk2k4
MD5:	0324E8CB4617E1A9CCB78291D5E2776A
SHA1:	C027A22A39CA595735F6C765ABA19DEFBC1DA369
SHA-256:	FBF63B8A450B36B6315803737459D0842A672A65669A39DDDDAB443B4128A8ED
SHA-512:	5F1600E514EF35CA47230650B82469181A706C864AEED2E5D481F118593FB6903F0D7F00D3594655D583D7FC22F800E4BF568BD92859C65ED20A1847DC757FA5
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......................<................R............................X........................P.........Rich...........................PE..d.....'d.........." ...".....R...............................................p............`..........................................#..d...D$.......P.......`..@............`..........................................@............... ............................text...h........................... ..`.rdata...B.......D..................@..@.data........@.......(..............@....pdata..@....`.......>..............@..@_RDATA..0....@......................@..@.rsrc........P......................@..@.reloc.......`....... ..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingmath.cp310-win_amd64.pyd

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.587195639192031
Encrypted:	false
SSDEEP:	384:5wU5804Pp/4TsXwCrhBOa8j65XGmIgyJ+:5p80s4T/Crhs565Vt
MD5:	FDF4B8E8A1B7B69A7B35B82103E3572B
SHA1:	E7586001239D37396ED5291F6ED169A29F342DC1
SHA-256:	7EC3047EE84DE49B32264F58E70D19E549BF07042FEDC9C7AC34740647D43FC1
SHA-512:	DB227860926354E0DF51B00FFCE639EDD50A1680004D8B8486E961CEADF143D3A19BCA99E4B999F888416ACB371EBED8B4A8B4664B76EFD104C25CB0D284B7C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<...<...<...D...<...@...<...D...<...@...<...@...<...@...<..(I...<...<...<..-@...<..-@...<..-@..<..-@...<..Rich.<..................PE..d.....'d.........." ...".4...,.......8....................................................`.........................................``..h....`..x...............P...............@....U...............................S..@............P..`............................text...X3.......4.................. ..`.rdata.. ....P.......8..............@..@.data........p.......P..............@....pdata..P............R..............@..@.rsrc................Z..............@..@.reloc..@............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_imagingmorph.cp310-win_amd64.pyd

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.058822923477256
Encrypted:	false
SSDEEP:	192:s+9Tf1MbDVmnZDhGmuvD2j1mhaD7YFcqgiR:VoDVmao57YbgiR
MD5:	57A8FF7CA333A71F3CA3DCB1A4E67ECD
SHA1:	9052EC54155B8EEBEE8AA0FC3A30BAC80962E31D
SHA-256:	390A9881C0E0DEA97DE0023B503F048619FCD97BFC198BD3C6EC2E2C5C18CAD9
SHA-512:	C12B72E4194BC22CB666DA52AE67307AE02EF524A6C3CAE77A7BFF0B6E5019CB7000E225197A19C6A9487A91D3F112C2C55EC9C51337FCAF836F575FD5153D6F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2E+.v$E.v$E.v$E..\..t$E.9XD.t$E.=\D.t$E.9X@.}$E.9XA.~$E.9XF.u$E..QD.u$E.v$D.[$E..XM.w$E..XE.w$E..X..w$E..XG.w$E.Richv$E.................PE..d.....'d.........." ..."..... ............................................................`..........................................:..l...l:..d....`.......P..L............p..H...@4...............................3..@............0..H............................text............................... ..`.rdata..p....0......................@..@.data...(....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..H....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_tkinter_finder.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	691
Entropy (8bit):	4.822168600321646
Encrypted:	false
SSDEEP:	12:S1lNZycKOFRjr8l8cBk13cFxmiFHyFxmiF2dRsWbouygcXnvGrcQ/W9xmiFrm26T:SlNZyjqCl2Mf5yfkvouygx4Q/WHRmVuu
MD5:	BD776E00A5CB9FAAF42AC17BA87B3DA4
SHA1:	595308611BBE97C4B99591B9501ED4910B9D2B46
SHA-256:	C9326F241351EB53290F35A62AEFF70BCE906ED3C8A9A709900DB72C63A58748
SHA-512:	15F632424D378D21EC63E99591BA3ABD58E225EC97E53EFFA89E7C9B3C68E80735BFC22B1AC8AC54FC26043D66F80B8334A8090BEDC1AF212C36724CD1B7DA14
Malicious:	false
Preview:	""" Find compiled module linking to Tcl / Tk libraries.."""..import sys..import tkinter..from tkinter import _tkinter as tk....from ._deprecate import deprecate....try:.. if hasattr(sys, "pypy_find_executable"):.. TKINTER_LIB = tk.tklib_cffi.__file__.. else:.. TKINTER_LIB = tk.__file__..except AttributeError:.. # _tkinter may be compiled directly into Python, in which case __file__ is.. # not available. load_tkinter_funcs will check the binary first in any case... TKINTER_LIB = None....tk_version = str(tkinter.TkVersion)..if tk_version == "8.4":.. deprecate(.. "Support for Tk/Tcl 8.4", 10, action="Please upgrade to Tk/Tcl 8.5 or newer".. )..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_util.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	388
Entropy (8bit):	4.497225624490064
Encrypted:	false
SSDEEP:	12:BVATA/uWxWwYJXMd2AVmj42DpWuWhjTuU1ATPRrvkv:BVA0/uWxWwRdndMpWfOgATPdkv
MD5:	113C6F819B27D22FFDAAB16F60051E5D
SHA1:	56411CDB5119098A9937D1819DDB9463936AF279
SHA-256:	B17F218E3AF9A0239034B0A1C8533B94FE5968A2292126B849CD2FB9C96C47EE
SHA-512:	977CF8BFC2C46DC4B10A3AB1C00D179E9261F55CA4C3CCA90070F44A36F014B4E376CF40E12B0C53FE4522F8D233026499DE67F76E20E886F75ECA0F3640DBBD
Malicious:	false
Preview:	import os..from pathlib import Path......def is_path(f):.. return isinstance(f, (bytes, str, Path))......def is_directory(f):.. """Checks if an object is a string, and that it points to a directory.""".. return is_path(f) and os.path.isdir(f)......class DeferredError:.. def __init__(self, ex):.. self.ex = ex.... def __getattr__(self, elt):.. raise self.ex..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\_version.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.397085150625374
Encrypted:	false
SSDEEP:	3:SZ1TAX8Lv0QhS:SZ1MsL0R
MD5:	116D4FA15A02C87FFC0665975D4D2B41
SHA1:	298EC1FC7230108BF03BD933BD814FEA2FA61CAF
SHA-256:	11985B1A4844C4B631191307A34B16A66BDB4FF3395C01250FA6CC08663A3FF9
SHA-512:	04F9DB976725430813B3F5C712F872A8BAE48DA0F68E4BC78A13DEC3CC32B783F5B3D7629252510D0F7C54DD240D45E325F96CD38C951EB011AB3ADF21591576
Malicious:	false
Preview:	# Master version for Pillow..__version__ = "9.5.0"..

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\features.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9949
Entropy (8bit):	4.716030003088541
Encrypted:	false
SSDEEP:	192:BS/eZSanOBVSUKx27fnTdfSjnvMNuS1MC5ooEGp9hTCvbZG4eYm:BlZS3SsnTdfSY4S113p9hTClDU
MD5:	F849DCBF6E55EEA352E6B2793D1FCAB7
SHA1:	0C5A3442AD80E4B537FC1AEF2629C2D521BE23FE
SHA-256:	D256AD97266ED08C64901AA19C6AA06E3AC0AC07ECCFCFCEF4E094838495C764
SHA-512:	473571BEB65AA945EDC1B4B4ED6449D830E89519E886D770B59D6F8934422EE307D7BD61E7BC8F91B6E8B01AF246BE2D4BB89CB1A59C3FC4B4EF5582C0D21B00
Malicious:	false
Preview:	import collections..import os..import sys..import warnings....import PIL....from . import Image....modules = {.. "pil": ("PIL._imaging", "PILLOW_VERSION"),.. "tkinter": ("PIL._tkinter_finder", "tk_version"),.. "freetype2": ("PIL._imagingft", "freetype2_version"),.. "littlecms2": ("PIL._imagingcms", "littlecms_version"),.. "webp": ("PIL._webp", "webpdecoder_version"),..}......def check_module(feature):.. """.. Checks if a module is available..... :param feature: The module to check for... :returns: ``True`` if available, ``False`` otherwise... :raises ValueError: If the module is not defined in this version of Pillow... """.. if not (feature in modules):.. msg = f"Unknown module {feature}".. raise ValueError(msg).... module, ver = modules[feature].... try:.. __import__(module).. return True.. except ModuleNotFoundError:.. return False.. except ImportError as ex:.. warnings.warn(str(ex)).. re

C:\Users\user\AppData\Local\Temp\_MEI12922\base_library.zip

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1066353
Entropy (8bit):	5.671219011999444
Encrypted:	false
SSDEEP:	12288:wgYJu4KXWyBC6SJIEljA4a2YWh3dpVwx/fpEK+riUu+kPSLMNq:wgYJiVBsLa2VJVwx/fpEK+Du+k8MNq
MD5:	6D02F71360E1E373743AB7B2A962FD59
SHA1:	3F46FF5E0452CF247487ADC72B871AE91100AF3F
SHA-256:	01325CCE27323FA5CE1CBDF9CBEC6BEA24DAE999D91165AB1125E5B953BEB694
SHA-512:	62E268CCEC6CCEB56C1B16E74215BCF0C0A544235F0FC66F4F013ABFA5C92A9A6E9FADBBB28E9F5C86C5C8C5F58715D48E9416F527D33CB9BAC30F648140A519
Malicious:	false
Preview:	PK..........!..8.q5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI12922\certifi\cacert.pem

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	278952
Entropy (8bit):	6.049041164740881
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR0mNplkXCRrVADwYCuCigT/Q5MSRqNb7d86:QWN/TRLNLWCRrI55MWavdJ
MD5:	8D0619BFE30DEADF6F21196F0F8D53D3
SHA1:	E7ABD65A8CCAFEFF6CAF6A2FF98D27D24D87C9AD
SHA-256:	B301535DCA491D9814EA28FAA320AC7A19D0F5D94237996FA0A3B5A936432514
SHA-512:	5A88E4A06B98832AAA9BBB89E382F6C7E9B65C5ECBA48DE8F4FF1FA58BB06A74B9C2F6B2EC185C2A306CB0B5D68D0B28D74B323432A0B2953D8DFC29FED920D7
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info\INSTALLER

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info\LICENSE

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info\LICENSE.APACHE

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info\LICENSE.BSD

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info\METADATA

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	5.12808207864762
Encrypted:	false
SSDEEP:	96:DxEpqZink/QIHQIyzQIZQILuQIR8vtklGovxNx6FWHCbCcbGLrrg9BMMzVEQDjye:+JnkoBs/sqL+4TcbGLrrUiMzVEQDjyeh
MD5:	4E5169613D93EC27EE0B3A0E80DB6640
SHA1:	7D721C24EAD56B9CD623ED9B5E0811DE9A71B85B
SHA-256:	855ED42CAAB9FBDCC6A95C098A02BC58C9035757D40129A9B715D8F7F4189624
SHA-512:	14179FCA4596CBDF4201ED38E8C0866BCC67F334B880D2F0A447B283A7B7FB61F7FB75B0FDE98DD6918FF6C578FDC61654302595503062900EBBBD7CC98392F7
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 41.0.1..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info\RECORD

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15240
Entropy (8bit):	5.551089627538169
Encrypted:	false
SSDEEP:	384:1XbU/ZfaigPOSJN5E6W1HepPNx6uvnpLEw:1rUxfzOPt9Ew
MD5:	E37C1AB144452FDB2ED9F66C119AE9C0
SHA1:	D4A3C94DF3FDCBE9EFF8011123537DB160F334A7
SHA-256:	201644EED53B9AB5E903A8A9269D1E6F4EFF6B4F2B3CCA0248F5922311306B86
SHA-512:	0F94409EF84CB2FAD2B4A45D0C42ED5A484444B4DE9870EB00D6C6A799167EB496B5A785520312BF0B9CE282030A959190F12B2ABA2642957B378B37FFBAE3B5
Malicious:	false
Preview:	cryptography-41.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-41.0.1.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-41.0.1.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-41.0.1.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-41.0.1.dist-info/METADATA,sha256=hV7ULKq5-9zGqVwJigK8WMkDV1fUASmptxXY9_QYliQ,5308..cryptography-41.0.1.dist-info/RECORD,,..cryptography-41.0.1.dist-info/WHEEL,sha256=AF8zPkSkcAhmODpLt1et9zmyR4I9Cg-zXEqffJFVfzk,100..cryptography-41.0.1.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=X4SPKBQ74QTjSR70oBCtcO9O5AR7x7Wa_9nHGNUbL2I,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/__about__.cpython-310.pyc,,..cryptography/__pycache__/__init__.cpython-310.pyc,,..cryptography/

C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info\WHEEL

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.987885415836538
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlhVMSgP+tkKc/SKQLn:RtBMwlVSZWKxDQLn
MD5:	C20F485EC06558EB04B2EDCE8362FD4F
SHA1:	D621F40B4522E88FD3E56EBEAA6332C7BDF40BED
SHA-256:	005F333E44A4700866383A4BB757ADF739B247823D0A0FB35C4A9F7C91557F39
SHA-512:	C701255A1793C5478F8B8FF7CBD86ADB4FE2320808C6A395461459B422D159312472519F01F337FD2801271D9732DB19F9F18E8BD4D0541C0F38387AF4A87F52
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.40.0).Root-Is-Purelib: false.Tag: cp37-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI12922\cryptography-41.0.1.dist-info\top_level.txt

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	4.783133177195051
Encrypted:	false
SSDEEP:	48:znD1AWMQi+WQ2zDhXeFKgA3iEsted6MgCQTGqTZONOgR:jDPMQ129uFmgCkGKZv8
MD5:	16025A45D4096B93FB5D17137D028160
SHA1:	AA3248B6E8998AB29925A02BD0CBE8C135992716
SHA-256:	7EC00E53C2FBD0AABF6713E817AF097B018526F74B7CD283B88B1D052B2B4D47
SHA-512:	451564E4B93E04C22A695708EE4796764D0F28442DF2F7EE709AB1FE62FAAB9D03EBA810AC4C8DA6CECF0CEACB718F9D1BAA62179B48B8D27EBC77C511B3A5B3
Malicious:	false
Preview:	__version__ = "5.1.3"..import os.import sys.from tkinter import Variable, StringVar, IntVar, DoubleVar, BooleanVar.from tkinter.constants import *.import tkinter.filedialog as filedialog..# import manager classes.from .windows.widgets.appearance_mode import AppearanceModeTracker.from .windows.widgets.font import FontManager.from .windows.widgets.scaling import ScalingTracker.from .windows.widgets.theme import ThemeManager.from .windows.widgets.core_rendering import DrawEngine..# import base widgets.from .windows.widgets.core_rendering import CTkCanvas.from .windows.widgets.core_widget_classes import CTkBaseClass..# import widgets.from .windows.widgets import CTkButton.from .windows.widgets import CTkCheckBox.from .windows.widgets import CTkComboBox.from .windows.widgets import CTkEntry.from .windows.widgets import CTkFrame.from .windows.widgets import CTkLabel.from .windows.widgets import CTkOptionMenu.from .windows.widgets import CTkProgressBar.from .windows.widgets import CTkRadioBut

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2909
Entropy (8bit):	5.417342939259122
Encrypted:	false
SSDEEP:	48:ry8Yan2wJpkLURmQ0pqxarmgiWRIaDSqipEZ82g/4ITeUHT5gE8p/aUGmPN:r6/QRmzpqxUPhSVE82gAseUzX2N
MD5:	0DCC4E4A065ADC5C8BA88AD3857BF28F
SHA1:	2F054E922E8D10B29D6112F4079B365206A766A2
SHA-256:	7A2691DD3816130D1F43800DC16A2762165C859169875771E9485372BBAB4B27
SHA-512:	7DEE054AFD28470F0A853DE13F47B28365B3690C86DF4845EBC3CD7D7501963B6ACF8E495F6D6840DB4E20FE15E722EA6A0F74DE6982DA63B973A63D07F41828
Malicious:	false
Preview:	o.......).xd.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.m'Z'..d.d.l.m(Z(..d.d.l.m)Z)..d.d.lm+Z+..d.d.lm,Z,..d.d.lm-Z-..d.d l.m.Z...d.d!l/m0Z0..e.e.e.e.e.e1e.f.Z2d"e3f.d#d$..Z4d%e3f.d&d'..Z5d(e3f.d)d..Z6d+e7f.d,d-..Z8d+e7f.d.d/..Z9d0d1..Z:d.S.)2z.5.1.3.....N)...Variable..StringVar..IntVar..DoubleVar..BooleanVar)...*.....)...AppearanceModeTracker)...FontManager)...ScalingTracker)...ThemeManager)...DrawEngine)...CTkCanvas)...CTkBaseClass)...CTkButton)...CTkCheckBox)...CTkComboBox)...CTkEntry)...CTkFrame)...CTkLabel)...CTkOptionMenu)...CTkProgressBar)...CTkRadioButton)...CTkScrollbar)...CTkSegmentedButton)...CTkSlider)...CTkSwitch)...CTkTabview)...CTkTextbox)...CTkScrollableFrame)...CTk)

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\.DS_Store

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6148
Entropy (8bit):	0.6888931042627182
Encrypted:	false
SSDEEP:	12:Q2ggpaOJTZ4OJTajdO3oz6ifn9mmNIlwO89EEX/HnXw6XUEK/XDXw6X:3fpFTZDToE3oz6ifnImm+fnV2V
MD5:	A2FE3C1CC8F70B63D7B51111A5E45EAD
SHA1:	450C18DF31657412B794688CB1CACE5DBF5E8EFA
SHA-256:	57ADA387AF15BFF448242A05E4E35D2B757798B0802CB894C81B4DC4E473002F
SHA-512:	90D6A5D667A4386DB834EDDFFB526218F1C10B9F56F020B52AAB3E31B5B7E0E51E86867760C7BAFC18DF9F3C52A76C63774A6EE915127C39296209C39A2A77B5
Malicious:	false
Preview:	....Bud1.................................................................................sIlocblob...............................................................................................................................................................................................................................................................................................................................................................................................................................................f.o.n.t.sIlocblob.......A.................i.c.o.n.sIlocblob.........................i.c.o.n.sbwspblob....bplist00.............]ShowStatusBar[ShowToolbar[ShowTabView_..ContainerShowSidebar\WindowBounds[ShowSidebar...._..{{380, 96}, {1099, 800}}...#/;R_klmno......................................i.c.o.n.svSrnlong.........t.h.e.m.e.sIlocblob....................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\fonts\CustomTkinter_shapes_font.otf

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3528
Entropy (8bit):	5.5463381859994065
Encrypted:	false
SSDEEP:	96:AhHW6DYnFFJFRFO7XPfWB8O8E09Li3kX6QpyotT6c43W:AhH/D2FrbQXPuCE09HScSW
MD5:	5F1BFE2E716608D1394D7A444CBD0354
SHA1:	20D061B3B742CFA31E5FBC862D34F557534EFDBF
SHA-256:	FAD67E2B060C318B6C8646D087FBD3ADD938B6676243F14B0C52623179641274
SHA-512:	57E4C2743FDB6D54B7736F88E267ADC1953508075E211A95539A31BF62AEF0DF67367EA9326D43118D69827D3376606705047BFF8092D1D6278D002594B68ABF
Malicious:	false
Preview:	OTTO........CFF ..&.........OS/2i.d........`cmap.J.I........head../........6hhea...........$hmtxYf.....d...dmaxp..P.........name.P.....`...Qpost........... .........a.._.<..........v......v...........................................................P................................1..............................XXXX.@. .Z.........,.........^... . .....".............y.......................K.........#.J.........!.`...........#......... .............y...........y...........y...........y...........y...........y...........y...........y.......................K.....................2.............R.........F.m.........B.............0.........@...........................................................................................................2.............RCustomTkinter_shapes_font.C.u.s.t.o.m.T.k.i.n.t.e.r._.s.h.a.p.e.s._.f.o.n.tRegular.R.e.g.u.l.a.rCustomTkinter_shapes_font Regular.C.u.s.t.o.m.T.k.i.n.t.e.r._.s.h.a.p.e.s._.f.o.n.t. .R.e.g.u.l.a.rCustomTkinter_shapes_fontRegular.C.u.s.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\fonts\Roboto\Roboto-Medium.ttf

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	168644
Entropy (8bit):	6.500433229170635
Encrypted:	false
SSDEEP:	3072:Fqmtn5wkex8r6Qym7KCkygAKuXylCC9ptSUXl8j/6afWZCyhASD/JwXI:425wklN7T3QtSUXz/2STyXI
MD5:	B2D307DF606F23CB14E6483039E2B7FA
SHA1:	FDDC8B1C688EF3BAED0D5A46ABF5F01F0EDAF02B
SHA-256:	4AC8E03606FFA4C37F61A6510A2080F1F37A7054F4726C214887D3B23F72E369
SHA-512:	2623C2A235720F389E0D8668DA01891B7A0D23A0FC3DB82865D8CB9BB730804EE84FCD863F33D28AAA236C1261714FF7C325FA677A4599356C29682D3571ACEE
Malicious:	false
Preview:	........... GDEF.B.........bGPOS.nK.......e.GSUB..Y..}4....OS/2.....<...`cmap..Qm........cvt 1..K...H...\fpgm..$....8....gasp............glyf/......,...<hdmxd.t.........head...r......6hhea...........$hmtx..M........8loca..n........maxp.>.....h... name>.mR........post.m.d...t... prep...).......S...d...(.............o......9........................EX../... >Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^...............<......9.........EX../... >Y..EX../....>Y.....+X!...Y..../01.#.!.462...."&.~......J.JH.H......9KK97JJ....e...@.......%...EX../...">Y..../..../......./01..#.3..#.3..#...-#...w.}....}.....`...............EX../... >Y..EX../... >Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#5!.#5!.3.3.3.3.#.3.#.#.3.#...L.L...:...N.N.N.N..:..L.v.:....f....9....`...`....f.8.9...d.-.&...,...*-...9...EX../... >Y..EX../... >Y..EX.#/.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\fonts\Roboto\Roboto-Regular.ttf

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	168260
Entropy (8bit):	6.486835016949693
Encrypted:	false
SSDEEP:	3072:Jy2goL/sAQRuzzlPrvRwhRFUzMWlYfxJVBxV+aYT3qPXI0eH4OuNOIOU7og2FnI:BOmCeu+bqPaHkWUMxFnI
MD5:	F36638C2135B71E5A623DCA52B611173
SHA1:	84D102488738B0EBBC7A5087973EFFBD54C95BD5
SHA-256:	319CFF6E7A31F0F2A41C475DCA42890AA5D19FE16017E2290F8C1D4E14F76481
SHA-512:	E9D55580EDDDE182CD9AB96057E129039154F54EFB0384613AA9513ED0D2D16EACCB5F6D77A299DE601ADDF0150DCDDE1FE98E31D047BBF85A66AC319C3280B5
Malicious:	false
Preview:	........... GDEF.B.........bGPOS..........].GSUB..Y..{.....OS/2.......l...`cmap..Qm........cvt +......p...Tfpgmw.`....h....gasp.......x....glyf&......,...lhdmxUz`z........head.j.z.......6hhea.......H...$hmtx.r.........8loca.w.........maxp.>........ name6!a.........post.m.d...X... prep.f.....$...I...d...(.............q......9........................EX../....>Y..EX../....>Y......9......9......9......9..........9......9.......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^.......{.......0...EX../....>Y..EX../....>Y.....+X!...Y......901.#.3.462..."&.[....7l88l7......-==Z;;........#.........../......9../........01..#.3..#.3...o.....o...x...........w...............EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9\|../......+X!...Y............../.....+X!...Y...............................01.!.#.#5!.!5!.3.!.3.3.#.3.#.#.!.!....P.P...E....R.R..R.R..E..P....E.....f....b....`...`.....f.#.b....n.0.....+.i...EX../....>Y..EX."/..".>Y.."...9..................+X!.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\icons\.DS_Store

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6148
Entropy (8bit):	0.3190422957527575
Encrypted:	false
SSDEEP:	6:VWilXPQIIW7e4WNW3dDh+Sk1dfl/CuX86XkEslX/9ldlXSPnrtHP8//ktLERulXC:Qi/fHIBdNaO89EEX/HnXw6XAERqXw6X
MD5:	0B5F6FF2993F88FB78902D1CCDD8BEB1
SHA1:	B26C174A98E6564B0E60E2E99BC78E6490B5F42A
SHA-256:	E53EFB2CA4FDE2219A3DC5DED422EC46EECC7A0547B6663B9AC9E16196AC6D25
SHA-512:	D30900D33A2D7387BD115BC2C403C1A70F792579E320C0EE175BF64F68EA2F1C2872D65A8E803653151C94559D2D2CBAD5A0E683347F7D7A926015A6C0F94A06
Malicious:	false
Preview:	....Bud1.................................................................................o.m.T.k.i.n.............................................C.u.s.t.o.m.T.k.i.n.t.e.r._.i.c.o.n._.W.i.n.d.o.w.s...i.c.oIlocblob.......A............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\icons\CustomTkinter_icon_Windows.ico

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13238
Entropy (8bit):	7.73062615393382
Encrypted:	false
SSDEEP:	192:BZXOm6Hm+o9UHgbqweqnjwzVBwNb3bezsRnsE4k7GdfH+jCQoGl8xf+4wznvYvQP:Ph6HmvHeqj4ViPosRnsE94fo0hWPQ+
MD5:	F6E65C6257AFECA83D565264A490029A
SHA1:	B3613164E587D09C052C34CCDC4D44DAC4FF44E2
SHA-256:	1234C017C871EB2E20D36F668F93E066CDCB93DB464D5CEF9D7A5BF83506D28C
SHA-512:	4F9EBE74582F8DB18287292FD5350F20D52E0118F7AAF6848BF6EEC37C4A16069939F0F5716E934FE3D7AAB0E0A0B2BE34BF2AEE359426FF2AAE681B992D75C6
Malicious:	false
Preview:	............ ..3.......PNG........IHDR.............\r.f....orNT..w...3ZIDATx....T...{..e.../~..q.....1N.3..\|A#a..vh...%.q..(....@.[u..]...B...F.K..hDQ\YE....z..{...[.V.Zz.....?U.M.[.......s...8._A....@Z...7.T...3.H..7X.=.u...rQ.x.l...+..o...D..:...rEW..2...+.R...;.)..xJ....3.OaS@.;..W...>.......9 .% ..@zI..y.0;..^.....0.....)7.ct.q.....V5.@W;..5...x..0.p'...`BQ../..5...u>.......K.&..~..k.....#.FO..g.T....A.>.RI'H.....L<3Fi_(.v..e].....@..[.T.].&?..JQ...bo..JZE..VzF..4(.............."M.V`b...W...B.?...56_..k\.A>.......].L].3h..h.P.Q...............8......<H.MtHK>..^.R.!.J.....W.>_h.!..-.J;.Ke....@.\.&.e4.U.^.i..W..t .X...`.;.x.......H3..h....X...._(0......Q.F.....gPs..p.7...:.@9O..s8.h.0F...j4..w1.7...\|...0\|>.M.. x...)..`x.<......$..5..a0.V{,oU.VaJ..."e.i...L>.4..v./..~RY..7......k.s....r.....QY.o.Y...h.%....n[.r..O.y..~M7.j\|..=FUZ..UA.w.....P.T..........JO)...S.[..Q_M.../..._.R.....Q/....w.&.Y..+........1....S...l)..p..Kp...W.....@

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\themes\blue.json

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4520
Entropy (8bit):	4.887912500576038
Encrypted:	false
SSDEEP:	96:KupscLUBH2cEyzmGvNu/XaNgdacg2u/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGgC:KupNUtMiPw/XXIRJ/v+Y51hT/vlggf+4
MD5:	9DCFADAD1B80E97512819C057CCBC56C
SHA1:	D1720FD7A06B0300A313D7CFD0BF040585CEBB8A
SHA-256:	6BAA6D0D43B58C90FA40428D2CB9237E31D2C181F0F95A5A768A6C78B88331E7
SHA-512:	B798F1AA183C89B138750799CA57ABB5F5F239ED2656B57AD78E5644E53105D445B78605A5ECF1EFFA8D66FEDF97A89732288F5DB775CFD2F12F527EC8892724
Malicious:	false
Preview:	{. "CTk": {. "fg_color": ["gray92", "gray14"]. },. "CTkToplevel": {. "fg_color": ["gray92", "gray14"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray86", "gray17"],. "top_fg_color": ["gray81", "gray20"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#3B8ED0", "#1F6AA5"],. "hover_color": ["#36719F", "#144870"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["#DCE4EE", "#DCE4EE"],. "text_color_disabled": ["gray74", "gray60"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray10", "#DCE4EE"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color":["gray10", "#DCE4EE"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckbox": {. "corner_radius": 6,. "bo

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\themes\dark-blue.json

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	4.856927419089279
Encrypted:	false
SSDEEP:	96:Kg6L6Xv7Lo2cE0mUNFRCdV2FiaVdXcEdVfvLpwiunacELTaUb4:K5uXoM0VzonWiaVd9Xvlp604
MD5:	9BA1D0F5ACEBA472B50E993C5107A101
SHA1:	2E852CF342735770A6AAFCD5C39848133F63ED72
SHA-256:	C008B3951C8E61A254029C1E7A9F23BAEA18F3A095E3B64CF99EE2FC0EC37233
SHA-512:	EA7EC195C27D4DDD4F832D7CECD323FC5003FDD192B3AABCDC0E45C7DBF70419EF8419A0E61330ADA0B5D56DE242BDDF2E1313FCE41353057E8389BE485300D3
Malicious:	false
Preview:	{. "CTk": {. "fg_color": ["gray95", "gray10"]. },. "CTkToplevel": {. "fg_color": ["gray95", "gray10"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray90", "gray13"],. "top_fg_color": ["gray85", "gray16"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#3a7ebf", "#1f538d"],. "hover_color": ["#325882", "#14375e"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["#DCE4EE", "#DCE4EE"],. "text_color_disabled": ["gray74", "gray60"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray14", "gray84"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color": ["gray14", "gray84"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckbox": {. "corner_radius": 6,. "bor

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\assets\themes\green.json

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4515
Entropy (8bit):	4.877114268374594
Encrypted:	false
SSDEEP:	96:KupscL34QyzmGvN1GNgdWg21WgKKuvQdVJFvLpwRun8Q+Gga1c4:KupN3FiPvDJmPKK1/vlfN+4
MD5:	F9638A655454C5D0FC6A1CC6DC1C5ED5
SHA1:	E31A6A20F3B169D7919224B27DED27C9DA410A05
SHA-256:	FC280FC722BCD20842C0A9E32070AB285A19EEA3C903F8317B6040FDCE51982F
SHA-512:	0F71BE1AFDC2F3691B5C9B34DFF385B5390128BD59AAC3E17FBD63EEF9C52F9D31524E31DF9921F913D2BB94BB8092EE9A748DB03FCEA03D19EDC0924A09E7E4
Malicious:	false
Preview:	{. "CTk": {. "fg_color": ["gray92", "gray14"]. },. "CTkToplevel": {. "fg_color": ["gray92", "gray14"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray86", "gray17"],. "top_fg_color": ["gray81", "gray20"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#2CC985", "#2FA572"],. "hover_color": ["#0C955A", "#106A43"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["gray98", "#DCE4EE"],. "text_color_disabled": ["gray78", "gray68"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray10", "#DCE4EE"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color":["gray10", "#DCE4EE"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckbox": {. "corner_radius": 6,. "bor

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	107
Entropy (8bit):	4.366846487824888
Encrypted:	false
SSDEEP:	3:1LGxR73xG08s2oKBim4LGKVE6RKbIVQTRPEs:1LWjxiFxsLRVtKbIiJ
MD5:	2C885BDEFAAC94EB10DD3402DFF878D5
SHA1:	0177B07E7A8DD9C3D95AB94D50E1F4AD986013B0
SHA-256:	792A28D31FF85E44A893F05A41BB4CF80B70311BB5CDAE8C3E177A61F5B3EAC2
SHA-512:	D97906A6B6D7112FC9F854E41E29405254F19179255D84E3FD1B163284E1C0E26217123940DBD9390841C1894BB5D7B161598A2319084A8227E8259F0F23E087
Malicious:	false
Preview:	from .ctk_tk import CTk.from .ctk_toplevel import CTkToplevel.from .ctk_input_dialog import CTkInputDialog.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.139769143165974
Encrypted:	false
SSDEEP:	6:y/WI40eWkA3qSRi/m/8jBlFEOtKol/Q/Iyxn23d6ZUArsNNJPDkZ:CS0eWTOg8jBJK8/rI2JPDQ
MD5:	6D58FF25B4D684D78FBD07A89B7C8568
SHA1:	A2D9BD311F4243CF5A54E51A725C906292AD9CA3
SHA-256:	D5AC3BD45E1A9EF3BF321B0AEE13DF53EDF899990A1EC38B800705E03FA4D24D
SHA-512:	C9EC365BEAD7598AD850722E68785060F19B5ED813BF5F6D9E4F0DCE795CC837004396517386E6BEA002655BD9CCCAD6C584FEF18D6962F2A5F15639001D4BF6
Malicious:	false
Preview:	o.......).xdk........................@...s(...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...CTk)...CTkToplevel)...CTkInputDialogN).Z.ctk_tkr....Z.ctk_toplevelr....Z.ctk_input_dialogr......r....r.....jC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/__init__.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\pycache\ctk_input_dialog.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4052
Entropy (8bit):	5.353513926128786
Encrypted:	false
SSDEEP:	96:87Us6d1a7htBDcX8BSDlnil2ipOYLcqS3q77Hy8UJR:c5SJnitOpqTFUJR
MD5:	F6BD8B660859A06DB837F2D04EA57E56
SHA1:	96CA04C1B41036902AC522BB069DD2E914490006
SHA-256:	2E372C7C1189255EB3005EAED61C8DA351FA7E31AFDFB72F7FF15D63576018BC
SHA-512:	EC6DC2093ACBB2ED9A260E00680DB0AB50252B8345F87C6833F936392411D5C54299D9D1087D3B12C5CE63D5C6A451B1ED2EA61B942B6AD7D05D286662EA190B
Malicious:	false
Preview:	o.......).xd.........................@...sd...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...Union..Tuple..Optional.....)...CTkLabel)...CTkEntry)...CTkButton)...ThemeManager)...CTkToplevelc........................s*...e.Z.d.Z.d.Z.....................d.d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.f...f.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)...CTkInputDialogz.. Dialog with extra window, message, entry widget, cancel and ok button.. For detailed information check out the documentation.. N..CTkDialog..fg_color..text_color..button_fg_color..button_hover_color..button_text_color..entry_fg_color..entry_border_color..entry_text_color..title..textc........................s....t...j.\|.d.....\|.d.u.r.t.j.d...d...n.\|...\|...\|._.\|.d.u.r#t.j.d...d...n.\|...\|

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\pycache\ctk_tk.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10122
Entropy (8bit):	5.391041619960797
Encrypted:	false
SSDEEP:	96:bIl+Q92vdFZmu7Uq9szROoJz9U0wSjr+EGDkMN+mnk7zp8q+Qx/CLx63mwwb63B4:EVa5gBzVz4xFNWKq+4qVqAFPx
MD5:	8E66EBE6AAC0EE8477571B3506146F59
SHA1:	42074F93BE17D09BE791718C4B2C1542BD4688E0
SHA-256:	75920203B4A5EF1C8B59761E5F7CE43CD1D7957D2D5B7C73EB0A9CBF74841E7B
SHA-512:	49784E411180D0F1F5869F5F2140559F005F8765BE19A8E1D267DE8CD6EE522702BC09062C8A792C0959D5A97B20C79EFD49CC33742EB98BB91D55529FE6A78D
Malicious:	false
Preview:	o.......).xd.<.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......N)...StrictVersion)...Union..Tuple..Optional.....)...ThemeManager)...CTkScalingBaseClass)...CTkAppearanceModeBaseClass)...pop_from_dict_by_set..check_kwargs_emptyc........................s....e.Z.d.Z.U.d.Z.h.d...Z.e.e.d.<.h.d...Z.e.e.d.<.d.Z.e.e.d.<.d.Z.e.e.d.<...dDd.e.e.e.e.e.e.f...f.....f...f.d.d...Z.d.d...Z.d.d...Z.dD..f.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z...f.d.d...Z...f.d.d...Z...f.d.d ..Z...f.d!d"..Z.dEd#e.d$e.f...f.d%d&..Z.dEd#e.d$e.f...f.d'd(..Z.dEd#e.d$e.f...f.d)d..Z.dDd+e.f...f.d,d-..Z...f.d.d/..Z d0e.d1e!f...f.d2d3..Z"dE..f.d4d5..Z#dE..f.d6d7..Z$d8d9..Z%e&d:d;....Z'e&d<d=....Z(d>e.f...f.d?d@..Z)dAe.f...f.dBdC..Z....Z+S.)F..CTkz\|. Main app window with dark titlebar on Windows and macOS.. For detailed information check out the documentation.. >......baseN

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\pycache\ctk_toplevel.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10341
Entropy (8bit):	5.416202158692636
Encrypted:	false
SSDEEP:	96:vIl+Q9sxLPzylrMyd6i12S5+ZF0RIeg62xgUIrGJtJ5QZk59JEXZ6yg/42yzLjnL:gVk2R6y+b0Y62cisE/42y/3heNJlbM
MD5:	386B55E48566C1DE063BFB10ED64FDD1
SHA1:	16885BC523B28D70F9934F25F7B75B8A0FDF5599
SHA-256:	1D2CB73E500979136B417EECD1D92866B22CA0E4378E16B7AC9682DE02A836A7
SHA-512:	24771DACE1457056ABFC105F6562A97289ADF96BD41DA149833E1EAE50AC35BBE5610B519A5AA3A2F586AAC0945F399DCC9FB875FD74F6F66B9F8D4AE08F7C48
Malicious:	false
Preview:	o.......).xd.9.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......N)...StrictVersion)...Union..Tuple..Optional.....)...ThemeManager)...CTkScalingBaseClass)...CTkAppearanceModeBaseClass)...pop_from_dict_by_set..check_kwargs_emptyc........................s....e.Z.d.Z.U.d.Z.h.d...Z.e.e.d.<.d.Z.e.e.d.<.d.Z.e.e.d.<.d.d...d.e.e.e.e.e.e.f...f.....f...f.d.d...Z.d.d...Z.d.d...Z.d>d.d...Z...f.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z.d>d.e.f...f.d.d...Z...f.d.d...Z...f.d.d ..Z.d?d!e.d"e.f...f.d#d$..Z.d?..f.d%d&..Z.d?..f.d'd(..Z...f.d)d*..Z.d+e.d,e.f...f.d-d...Z.d?..f.d/d0..Z.d1d2..Z e!d3d4....Z"e!d5d6....Z#d7e.f...f.d8d9..Z$..f.d:d;..Z%..f.d<d=..Z&....Z'S.)@..CTkToplevelz\|. Toplevel window with dark titlebar on Windows and macOS.. For detailed information check out the documentation.. >....Z.menu..width..cursor..screenZ.borderwidthZ.takefocusZ.reliefZ.useZ.v

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\ctk_input_dialog.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5532
Entropy (8bit):	4.397691671659192
Encrypted:	false
SSDEEP:	96:gW7VJPJwJtJ8J4JBpJ0JGrIG08h1fJRVcewzV9zd7VGkp2G373ZQT8PxIW:pNSXWaRuaKu+2GrF1
MD5:	2FFC792932F1C594894C7E9DEEAD13F2
SHA1:	CFCD9D95F7875605BB8986D7A99F5FEF7EC8980D
SHA-256:	25B3469B75A4B7E93A0875E65E67B75190667546BF3809C9630EBE27298909C5
SHA-512:	F26022674DBF58498A9DA2A2104CB4600D7DC1662D583C6D6EE2A0730814F73A89862C044B745386D995024C4E2D2974CE3CF4992316E06CE44F098F1306EC6F
Malicious:	false
Preview:	from typing import Union, Tuple, Optional..from .widgets import CTkLabel.from .widgets import CTkEntry.from .widgets import CTkButton.from .widgets.theme import ThemeManager.from .ctk_toplevel import CTkToplevel...class CTkInputDialog(CTkToplevel):. """. Dialog with extra window, message, entry widget, cancel and ok button.. For detailed information check out the documentation.. """.. def __init__(self,. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. text_color: Optional[Union[str, Tuple[str, str]]] = None,. button_fg_color: Optional[Union[str, Tuple[str, str]]] = None,. button_hover_color: Optional[Union[str, Tuple[str, str]]] = None,. button_text_color: Optional[Union[str, Tuple[str, str]]] = None,. entry_fg_color: Optional[Union[str, Tuple[str, str]]] = None,. entry_border_color: Optional[Union[str, Tuple[str, str]]] = None,. entry_

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\ctk_tk.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15580
Entropy (8bit):	4.599410844743333
Encrypted:	false
SSDEEP:	192:7XLVUj1qjWHiivjnC1+x7d42wiUyKzlIrm+eWS4eB2/0OeNHgq2HgR88yAFJ9zTN:7ZGrCE4nkSgqQgRry0J9zTNhow
MD5:	AF64D79CCFC48336844F626D4C79202F
SHA1:	861072F247B068F9E07831C847A39DAB3DD95E42
SHA-256:	C37DEE1A9BE3A9E5512A067A32ADA7323ACBE7711CB110C9F372F45E24110AC0
SHA-512:	A057ED45F1D65857A897EC243BDD69B326CA4CEA26AA1031FCCC14240E902699CABC776A27A89596F60BCD70B4C610A9D42C8DED4BDF9D776B22C2AA48D083C5
Malicious:	false
Preview:	import tkinter.from distutils.version import StrictVersion as Version.import sys.import os.import platform.import ctypes.from typing import Union, Tuple, Optional..from .widgets.theme import ThemeManager.from .widgets.scaling import CTkScalingBaseClass.from .widgets.appearance_mode import CTkAppearanceModeBaseClass..from customtkinter.windows.widgets.utility.utility_functions import pop_from_dict_by_set, check_kwargs_empty...class CTk(tkinter.Tk, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. """. Main app window with dark titlebar on Windows and macOS.. For detailed information check out the documentation.. """.. _valid_tk_constructor_arguments: set = {"screenName", "baseName", "className", "useTk", "sync", "use"}.. _valid_tk_configure_arguments: set = {'bd', 'borderwidth', 'class', 'menu', 'relief', 'screen',. 'use', 'container', 'cursor', 'height',. 'highlightthickness', 'padx', '

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\ctk_toplevel.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14727
Entropy (8bit):	4.618743576463637
Encrypted:	false
SSDEEP:	192:7XnYnUdADqlJuImivjnVx7d42wiB2/yekhXPQe2OnnHgqNHgRkybFJ3zTivJortv:7InP4lrR4PM/NgqtgRkyRJ3zTQJop
MD5:	B53659F9C13265F95CEDD10D6F1B52E9
SHA1:	C792D481CA4ECC30CE49FB70DF4A70A5422F5A67
SHA-256:	D15599CE2663AF3BC9C678CB3A3D6920EA0421EE78A07FA5103AD30CAD002250
SHA-512:	214E753F44BB163EE4747E0E3781DEC800092FAD43D3084D0498D0A4F67ECBAD7D085D9DC90588841B32AE28767355162D17027E406AB19E10EEEF00B827B951
Malicious:	false
Preview:	import tkinter.from distutils.version import StrictVersion as Version.import sys.import os.import platform.import ctypes.from typing import Union, Tuple, Optional..from .widgets.theme import ThemeManager.from .widgets.scaling import CTkScalingBaseClass.from .widgets.appearance_mode import CTkAppearanceModeBaseClass..from customtkinter.windows.widgets.utility.utility_functions import pop_from_dict_by_set, check_kwargs_empty...class CTkToplevel(tkinter.Toplevel, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. """. Toplevel window with dark titlebar on Windows and macOS.. For detailed information check out the documentation.. """.. _valid_tk_toplevel_arguments: set = {"master", "bd", "borderwidth", "class", "container", "cursor", "height",. "highlightbackground", "highlightthickness", "menu", "relief",. "screen", "takefocus", "use", "visual", "width"}.. _deactivate_macos_window_header_mani

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	622
Entropy (8bit):	4.588724608407315
Encrypted:	false
SSDEEP:	12:1uL6A5fj54NjH6E51dRcwm/NRQLKqAk56ufiX/LRvxPIJA8:1ux2dPc7D0k0QTfIi8
MD5:	0899CA62DE34AC843C6C088536E2FD1A
SHA1:	34BB465EF3173868F397E1D7F6CF38095EE01700
SHA-256:	0CDA213A917947601ED623F8C0DA6C0D890E9CC46256B70D77008F588C4D5862
SHA-512:	7468BC0ABC32C562774AAFD1F03E4F75292063694D5B1DEF69705F781EFBFDD1D22B2A28AA861ED30BCDD2DB7308BFC5EAAD8A71ECDA9204803A4DDB9069C30E
Malicious:	false
Preview:	from .ctk_button import CTkButton.from .ctk_checkbox import CTkCheckBox.from .ctk_combobox import CTkComboBox.from .ctk_entry import CTkEntry.from .ctk_frame import CTkFrame.from .ctk_label import CTkLabel.from .ctk_optionmenu import CTkOptionMenu.from .ctk_progressbar import CTkProgressBar.from .ctk_radiobutton import CTkRadioButton.from .ctk_scrollbar import CTkScrollbar.from .ctk_segmented_button import CTkSegmentedButton.from .ctk_slider import CTkSlider.from .ctk_switch import CTkSwitch.from .ctk_tabview import CTkTabview.from .ctk_textbox import CTkTextbox.from .ctk_scrollable_frame import CTkScrollableFrame.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	989
Entropy (8bit):	5.371743825821769
Encrypted:	false
SSDEEP:	24:gH2Wf8aTlqxxW/jHVmzlvCHISuKbhDalI7Dn67o:BW8elqxarmCHISuKtDqGDSo
MD5:	0BB3EBFBD641B019E34F2DBDF91FC635
SHA1:	D87E3FC9B236B8FBDC33DF81020F8430CD31CA18
SHA-256:	32DFA951841DF7610BBB9D5D78DBA225953CF8AEEEEB16A6204FB85D734CAE43
SHA-512:	0EA753654AA48803C7D3E0FAC440EFD7BF35940032E91CFD187F1A8616F627E890E4EFBAEC6810E309C0BCE6D719371CBC3DFF42E51DF5815F7AA398544D47C3
Malicious:	false
Preview:	o.......).xdn........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...CTkButton)...CTkCheckBox)...CTkComboBox)...CTkEntry)...CTkFrame)...CTkLabel)...CTkOptionMenu)...CTkProgressBar)...CTkRadioButton)...CTkScrollbar)...CTkSegmentedButton)...CTkSlider)...CTkSwitch)...CTkTabview)...CTkTextbox)...CTkScrollableFrameN) Z.ctk_buttonr....Z.ctk_checkboxr....Z.ctk_comboboxr....Z.ctk_entryr....Z.ctk_framer....Z.ctk_labelr....Z.ctk_optionmenur....Z.ctk_progressbarr....Z.ctk_radiobuttonr....Z.ctk_scrollbarr....Z.ctk_segmented_buttonr....Z.ctk_sliderr....Z.ctk_switchr....Z.ctk_tabviewr....Z.ctk_textboxr....Z.ctk_scrollable_framer......r....r.....rC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/__init__.py..<module>....s ...................................

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_button.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14509
Entropy (8bit):	5.356017338019303
Encrypted:	false
SSDEEP:	384:JmL9LrBHoX8g4j5f4WTo80EeRBBwFpwiUbVEnD8gKHUFVS:JmL9m4j5f4WpeqFpwiUb4IHU7S
MD5:	19BD99AB80BC4B34A0E165E0236B7AB4
SHA1:	1FDE10B71E4B4EDBAEC43B511AA3B7436C265D69
SHA-256:	DCFF54C53B65C3BE252224F50357CFA67961813F02BAA837BC2281CF1E0682AA
SHA-512:	1F3771E17A80FFFE6CA00DA91857E2B911BD26652E64652BB041433D8BBC1798406E33DED9AC3B9FEDB85BB6E3C9F4158E79FE51D9C24E7B8B8AB8E4DA634F52
Malicious:	false
Preview:	o.......).xd.l.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFont)...CTkImagec................1.......s....e.Z.d.Z.U.d.Z.d.Z.e.e.d.<...............................................dZd.e.d.e.d.e.d.e.e...d.e.e...d.e.d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.e.f...f.....d.f...d.e.d.e.d.e.d.e.e.e.e.f.....d.e.e.j.d.f...d.e.e.d d.f...d!e.d"e.d#e.e.g.d.f...d.f...d$e.d%e.f0..f.d&d'..Z.d[d(e.e...f.d)d*..Z...f.d+d,..Z...f.d-d...Z.d\d.e.d.e.f...f.d/d0..Z.d1d2..Z.d3d4..Z...f.d5d6..Z.d]..f.d8d9..Z.d:d;..Z.d]..f.d<d=..Z.d>e.d?e.f...f.d@dA..Z.dBdC..Z.d[dDdE..Z d[dFdG..Z!dHdI..Z"d[dJdK..Z#dLdM..Z$d^d(e.d#e.dNe.e.e.f...f.dOdP..Z%d\d(e.dQe.f.dRdS..Z&dTdU..Z'dVdW..Z(d

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_checkbox.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12350
Entropy (8bit):	5.330003281289475
Encrypted:	false
SSDEEP:	192:ITU8TzlOU3w6pKJ9888lM9D020ODRnRozwj7snwoDyRJPiogyW6:IPE888lMJ0wDRqzwf5o2bqogyW6
MD5:	227229CDDFB97B94AA8011CF78AA46B1
SHA1:	5F044B2B865D4A67D56CB51480E9476295FB0251
SHA-256:	D2074B8F958BD2E6931D75C30AFC4DEC7A55639BFAAA0A2BD55439E3A104E5AF
SHA-512:	767DD055A0F38CE1CD4E18B2AE343AF072BD1460EA1504EC1EED1DACFE625F6E149CA1A7FC34E4117CA27478F629A29FF6585F80F6D4102E824282FEF8E97179
Malicious:	false
Preview:	o.......).xd:V.......................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFontc................1.......s....e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.d.d.d.d.d.f.d.e.d.e.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.e.j.d.f...d.e.d.e.d.e.e.g.d.f...d.f...d.e.e.e.f...d.e.e.e.f...d.e.e.j.d.f...f...f.d d!..Z.dRd"e.e...f.d#d$..Z...f.d%d&..Z.dSd.e.d.e.f...f.d'd(..Z.d)d*..Z...f.d+d,..Z.dT..f.d.d/..Z.dT..f.d0d1..Z.d2e.d3e.f...f.d4d5..Z.d6d7..Z.dUd8d9..Z.dUd:d;..Z.d<d=..Z.dUd>d?..Z.dTd@dA..Z.dTdBdC..Z d3e.e.e.f...f.dDdE..Z!dVd"e.d.e.dFe.e.e.f...f.dGdH..Z"dSd"e.dIe.f.dJdK..Z#dLdM..Z$dNdO..Z%dPdQ..Z&....Z'S.)W..CTkCheckB

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_combobox.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12051
Entropy (8bit):	5.3289194335875205
Encrypted:	false
SSDEEP:	192:97vVGTZXrWkWloROUG1Zs+A3Hup0/Xk9c9LExvAA3X2OBl4yS/gWYDI:97OZCJdWQp0/b24eX2+l4r/LYDI
MD5:	A80B77AC67ADBEA46B96F5E074FF19FA
SHA1:	4AF37B4E95801BDAC9254787427DCCDD21E1BE90
SHA-256:	7488EF8B099118092D112B55FC4651A93957885591BEBEC299294BDCE050604A
SHA-512:	0F77AFBEF603DCDE1CBD43C6A4749F4A0FC6537E5C55B4E69FBAA1C3779C70F54FF5D2AABE95986681AA81184CE21CA496FB161CC8494A87D101471387721F8F
Malicious:	false
Preview:	o.......).xdvP.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..List..Optional.....)...DropdownMenu)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFontc................0.......s....e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.d.d.d.d.f.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e.e.....d.e.d.e.d.e.e.j.d.f...d.e.e.e.g.d.f...d.f...d.e.f...f.d.d ..Z.dQd!e.e...f.d"d#..Z.d$d%..Z...f.d&d'..Z.dRd.e.d.e.f...f.d(d)..Z.d*d+..Z...f.d,d-..Z.dS..f.d/d0..Z.d1d2..Z.dS..f.d3d4..Z.d5e.d6e.f...f.d7d8..Z.dTd:d;..Z.dTd<d=..Z.d>e.f.d?d@..Z.d>e.f.dAdB..Z d6e.f.dCdD..Z!dQdEd

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_entry.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12075
Entropy (8bit):	5.208525721776839
Encrypted:	false
SSDEEP:	192:wb5MivPiot4WHzYMshf2suUwblKhmb92dLnInfn1anH9nrn9aenXndnfnKn8nFhr:WZ4p2suUVkb92dLnInfnonH9nrnlnXnx
MD5:	8A0FA37C195FC1890C61393CA362F4E8
SHA1:	1256B23D6B03F43FC0C0D6D7C56A52553DF8F827
SHA-256:	C29BB38058153E06BF2E4E955DCCABEC230ACAC23A82C3D6B9E457D0A7A72791
SHA-512:	86DD5C08E36EA8DC34D7EF719F3CF5A780BDFAE5D1A12948B42D074696E108ABEEE33D14D1A59DD164AE7D4959C385E739C86B0CB08481CC6FE0F6D45847F12C
Malicious:	false
Preview:	o.......).xd.E.......................@...s\|...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFont)...pop_from_dict_by_set..check_kwargs_emptyc........................sP...e.Z.d.Z.d.Z.d.Z.h.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.e.j.f.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.j.d.f...d.e.e.d.f...d.e.e.e.e.f.....d.e.f...f.d.d...Z.d_d.e.e...f.d.d...Z.d.d...Z.d.d...Z...f.d.d ..Z.d`..f.d!d"..Z.d#d$..Z...f.d%d&..Z.da..f.d(d)..Z.da..f.dd+..Z.d,e.d-e.f...f.d.d/..Z.dbd1d2..Z.d`d3d4..Z.d5d6..Z.d7d8..Z.d_d9d:..Z d_d;d<..Z!d_d=d>..Z"d?d@..Z#dAdB..Z$dCdD..Z%dEdF..Z&dGdH..Z'dIdJ..Z(dKdL..Z)dMdN..ZdOdP..Z+dQdR..Z,dSdT..Z-dUdV..Z.dWdX..Z/dYdZ..Z0d[d\..Z1d]d^..Z2....Z3S.)c..CTkEntryz.. Entry with rounded corners, border,

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_frame.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5883
Entropy (8bit):	5.392117008409428
Encrypted:	false
SSDEEP:	96:BH9usx6oqXK5DYAJOMb8LEG6Yl+9JFq3GdDss+8GKPQqxqdWHjyM1hFP3cYzuj85:DxzxEAjb8L163JFEGdH7RPJo0zMtqAUB
MD5:	7739EFB283A2A227282A7983BF9CBBC8
SHA1:	A7D148261B998FCF3FBB550E236E48347D7E1918
SHA-256:	4A2553AE4BDBEFCAE79B53B249A05CF90312C30342D872C2535B4192FFE251A8
SHA-512:	FCB88F12B2D2179FE0851EB6457AF2D426D8EA0D733E395218B026BA8AFABAFADB731E57830EF2A943A50AD8D783C697A02BCDAC806D65357C10D544791A06FC
Malicious:	false
Preview:	o.......).xd&%.......................@...s\...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...Union..Tuple..List..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClassc........................sH...e.Z.d.Z.d.Z...................d%d.e.d.e.d.e.d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.e.f...f.....d.f...d.e.e.d.f...f...f.d.d...Z.d.e.e...f...f.d.d...Z...f.d.d...Z.d&..f.d.d...Z.d'..f.d.d...Z.d'..f.d.d...Z.d.e.d.e.f...f.d.d...Z.d(d!d"..Z.d&d#d$..Z.....Z.S.))..CTkFramez.. Frame with rounded corners and border.. Default foreground colors are set according to theme.. To make the frame transparent set fg_color=None.. For detailed information check out the documentation.. .....N..transparent..master..width..height..corner_radius..border_width..bg_color..fg_color..border_color..background_corner_colors."overwrite_preferred_drawing_methodc..

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_label.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	5.294890559644191
Encrypted:	false
SSDEEP:	96:Gy8bCQuJQ9Ix4Uo/YkyaRMlvpOtjW1zINeY/E3GvfLEadvELVHEHEPBbgfzaA93n:GyO8Wqf1cNeY/KyBExbS243y3qk5y9v
MD5:	06183FE6AB86759995F7DFC7E5AF4247
SHA1:	AFE6D89AE128F19161D8D98012E4C79F938127CF
SHA-256:	2EB426080434755C9E860496A9F91E32CA41CCF3E6F39020CA3B97E5D1BAAF68
SHA-512:	FC1A40E8EC8951030E8719903AC52532F71659DF889DD6ADDC7631AB77C46CE0D9AF03F171DF104D85F74DA2E8E57BB7C831DB2477BA93C5262652EDBA61A036
Malicious:	false
Preview:	o.......).xdh/.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFont)...CTkImage)...pop_from_dict_by_set..check_kwargs_emptyc........................s....e.Z.d.Z.d.Z.h.d...Z.........................d=d.e.d.e.d.e.d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.e.d.f...d.e.d.e.d.e.f...f.d.d...Z...f.d.d...Z...f.d.d...Z.d>..f.d.d...Z.d.d...Z.d.d ..Z...f.d!d"..Z.d#d$..Z.d?..f.d&d'..Z.d?..f.d(d)..Z.d*e.d+e.f...f.d,d-..Z.d@d/e.d0e.d1e.f.d2d3..Z.d>d/e.d4e.e...f.d5d6..Z.d7d8..Z.d9d:..Z.d;d<..Z.....Z.S.)A..CTkLabelz.. Label with rounded corners. Default is fg_color=None (transparent fg_color).. For detailed information check out the documentation... state argument will probably be removed because it has

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_optionmenu.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11894
Entropy (8bit):	5.3197873400566476
Encrypted:	false
SSDEEP:	192:nIi18/OpKufluL17hNJG8885ouX9IxykhpT5VuZfmpjGq:nqOpKq074888akSuZfmpaq
MD5:	79610FE4A846E258725C59A8839526AC
SHA1:	70A08522C624684BF3E970718A0A0F46A5993F32
SHA-256:	8D382C585C715B58602D155419FB14378844BB88BEFB112FE9E37ABC872C93F6
SHA-512:	4C636FD1752091E422D2AF49888428326E225979D8BC728DD6B52EE6D5778539B2BC1D67FBB0589B542BE3901F58AD6BF3611BB3DCC480B22336759F6365ED37
Malicious:	false
Preview:	o.......).xd.L.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...DropdownMenu)...CTkFontc................-.......s....e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.d.d.d.d.f.d.e.d.e.d.e.d.e.e.e.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e...d.e.e.j.d.f...d.e.d.e.d.e.e.e.g.d.f...d.f...d.e.d.e.f,..f.d.d...Z.dTd e.e...f.d!d"..Z.d#d$..Z...f.d%d&..Z.dUd.e.d.e.f...f.d'd(..Z.d)d*..Z...f.d+d,..Z.dV..f.d.d/..Z.dV..f.d0d1..Z.d2e.d3e.f...f.d4d5..Z.d6d7..Z.dWd9d:..Z.dWd;d<..Z.d=d>..Z.d?e.f.d@dA..Z d?e.f.dBdC..Z!d3e.f.dDdE..Z"dWdFdG..Z#dXd e.d.e.dHe.e.e.f...f.dId

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_progressbar.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8990
Entropy (8bit):	5.303886856713865
Encrypted:	false
SSDEEP:	192:G2a7cVO/8z+LYHNWxmgA/a5FvlVjsBYVpBaaAcfk1jAKEouT/hICd1C:G2a7cMdkLza7tVLjAN1jAKEonUo
MD5:	B9E17823F06004FA1BBD2083FA8B0481
SHA1:	7A3313FBF4F99AD96C08B4C063766ED6A5F6D004
SHA-256:	7C5FF706F0F9741721FA5B026DFBD758B0A125C6C6D95B073EBB8EB989F16DC8
SHA-512:	6BA6779F8B2ACBB92B267F1EF1A5C2785B3A6BDBE26EBFD8E65EB9045E2EFF0397EA48F30D26CE3036668C85C0E46C95A629F0091F88902AA34D8B491F9F52BD
Malicious:	false
Preview:	o.......).xd#7.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y+......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Optional..Callable)...Literal.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClassc........................s....e.Z.d.Z.d.Z...........................dDd.e.d.e.e...d.e.e...d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.j.d.f...d.e.d.e.d...d.e.d.e.f...f.d.d...Z...f.d.d...Z.dE..f.d.d...Z...f.d.d...Z.dF..f.d.d ..Z.dF..f.d!d"..Z.d#e.d$e.f...f.d%d&..Z.d'd(..Z.dFd)d*..Z.d$e.f.d+d,..Z.d-d...Z.d/d0..Z.d1d2..Z.d3d4..Z.dGd6e.d7e.d8e.e.e.f...f.d9d:..Z.dEd6e.d;e.f.d<d=..Z.d>d?..Z d@dA..Z!dBdC..Z"....Z#S.)H..CTkProgressBarz.. Progressbar with rounded corners, border, variable support,. indeterminate mode, vertical orientation.. For detailed information check out the documentation.. N..t

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_radiobutton.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11716
Entropy (8bit):	5.323604114609769
Encrypted:	false
SSDEEP:	192:bTFA0nL1lHPdTHjKJO888yU0PPcHzjADeclwTF9kjAbvUK/Zz:bj7HlHh888UAHLTIjAbMK/Zz
MD5:	04BF9FFA81AC2C655FDBC38CEAB69314
SHA1:	6A8E8D9517A3A71133DBBFEF192B1258C734242F
SHA-256:	4C8DF8252301FE21F1868A2A3A483A5BE832A0F9DE25B5C48B9E21DDC2F48BBB
SHA-512:	5A1B61143CD5379302E3C9156368111DAF41151136E1C902663DC4B24C4D6978A910224D174EAD50CC9964EA32B76A4C830F8182C8E312C7DBCF898EDA82F1CA
Malicious:	false
Preview:	o.......).xd.N.......................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFontc................/.......sd...e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.d.d.f.d.e.d.e.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.e.j.d.f...d.e.e.j.d.f...d.e.e.e.f...d.e.d.e.d.e.e.d.f...f,..f.d.d...Z.dNd e.e...f.d!d"..Z...f.d#d$..Z.dOd.e.d.e.f...f.d%d&..Z.d'd(..Z...f.d)d*..Z.dP..f.d,d-..Z.dP..f.d.d/..Z.d0e.d1e.f...f.d2d3..Z.d4d5..Z.dQd6d7..Z.dQd8d9..Z.d:d;..Z.dQd<d=..Z.dPd>d?..Z.dPd@dA..Z dRd e.d.e.dBe.e.e.f...f.dCdD..Z!dOd e.dEe.f.dFdG..Z"dHdI..Z#dJdK..Z$dLdM..Z%....Z&S.)S..CTkRadioButtonz.. Radiobutton with rounded corners, border, label,

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_scrollable_frame.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10607
Entropy (8bit):	5.2763769451929505
Encrypted:	false
SSDEEP:	96:Sss4QGSFJwgLqsJTqw2N19NkkWugJVOb9kC4YRe7jDVMZJ9xax5SMkrwm3ELaqY8:VQzbJ2w89owb9WYY7tyY8wm8ayioH
MD5:	ED6BB7C3822245FF37E63DFC8EEDCB55
SHA1:	83E1330556CDB246A90183EB55C7088911616FD6
SHA-256:	166CB68032BA83B0FFCABC1A63D4FC220542829448CE57785F0302D12356B97B
SHA-512:	6230C1732A1F89C5F1F9AF8E5CF2E965FF4F13EF85C1395596EB711BB6C99BF40942F1D61B7B84389D0DCEB92E32E70F2CF0FE13D5B6DC66E23A540859B72CFE
Malicious:	false
Preview:	o.......).xd.;.......................@...s....d.d.l.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y!......d.d.l.m.Z...Y.n.w.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......)...Union..Tuple..Optional)...LiteralN.....)...CTkFrame)...CTkScrollbar)...CTkAppearanceModeBaseClass)...CTkScalingBaseClass)...CTkBaseClass)...CTkLabel)...CTkFont)...ThemeManagerc................$.......s....e.Z.d.Z.................................dLd.e.d.e.d.e.d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.d.e.d...f"d.d...Z.d.d...Z.d.d...Z...f.d.d ..Z...f.d!d"..Z.dMd#d$..Z.d%d&..Z.d'e.f.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.d@dA..Z.dBdC..Z dDdE..Z!dFdG..Z"dNdHdI..Z#dNdJdK..Z$....

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_scrollbar.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8685
Entropy (8bit):	5.295437931655695
Encrypted:	false
SSDEEP:	192:aIG8/XOcCnruKJFzZCY888Bd2KJrHz1XvWs8n/nInwnOnxnAk7lvt:aIR1CnruK7Z3888RHles8n/InwnOnxnr
MD5:	893ABC27FEDFCC29D9CB6027A7A31AEA
SHA1:	90D6EB61FBE27140F871D700A09BEF63A757E1E5
SHA-256:	A4A09F80F1690DBC9062F755C272890D12EEBD7F4D213F62E895C6EA3F580BED
SHA-512:	6B5794220C55E57FC94654D81CC475EA535A2DA039BAB4DD771524EEB732F51CB6712A7714AF64EB1213783409D067C141F205211684833034EC2E217FA8A9EB
Malicious:	false
Preview:	o.......).xd 6.......................@...sd...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClassc........................s....e.Z.d.Z.d.Z.........................dAd.e.d.e.e.e.e.f.....d.e.e.e.e.f.....d.e.e...d.e.e...d.e.d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.d.f...d.e.f...f.d.d...Z.dBd.e.e...f.d.d...Z...f.d.d...Z.dC..f.d.d...Z.d.d...Z.dD..f.d d!..Z.dD..f.d"d#..Z.d$e.d%e.f...f.d&d'..Z.dEd)d*..Z.dEd+d,..Z.d-d...Z.dBd/d0..Z.d1e.d2e.f.d3d4..Z.d5d6..Z.dFd7d8..Z.dCd9d:..Z.d;d<..Z.d=d>..Z.d?d@..Z.....Z S.)G..CTkScrollbarz.. Scrollbar with rounded corners, configurable spacing.. Connect to scrollable widget by passing .set() method and set command attribute.. For detailed information check out the documentation.. N.......transparentT..vertical..master..width..heigh

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_segmented_button.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11898
Entropy (8bit):	5.342407793632558
Encrypted:	false
SSDEEP:	192:JDhfeYnBabRCgYo530cDwc0xnAzFD5iMHZoQLPFNPc7/DSORGUwlgpTWC:JDhVnyRL537DP0xnAzB5iM5xFNoDSGG4
MD5:	983856709A3758C7E6295013652F1B0A
SHA1:	23627B6045219182631CCF26CE56AD89019ADD93
SHA-256:	4F065651687B631DE590A09E9A867B539EA352C16A9C6EABDDED1EDE042EA471
SHA-512:	15B777444BFD244712BD210209F186A1A28D2CF4762E6FA3B2305240FFAF07D6A0BAB87CC2CF7ABEB8E96CE1BF1BAFC0D5AA471B8DDA8A57363148295CD589DE
Malicious:	false
Preview:	o.......).xd.M.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y/......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..List..Dict..Callable..Optional)...Literal.....)...ThemeManager)...CTkFont)...CTkButton)...CTkFramec.......................s....e.Z.d.Z.d.Z.......................................dOd.e.d.e.d.e.d.e.e...d.e.d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.e.f...f.....d.f...d.e.e.e.e.f.....d.e.e...d.e.e.j.d.f...d.e.d.e.e.e.g.d.f...d.f...d.e.f(..f.d.d...Z...f.d.d ..Z.dPd.e.d.e.f...f.d!d"..Z.d#d$..Z.d%e.f.d&d'..Z.d(e.f.d)d..Z.d%e.f.d+d,..Z.d%e.f.d-d...Z.d(e.d%e.d/e.f.d0d1..Z.e.d.e.e...f.d2d3....Z.d4d5..Z.d6d7..Z...f.d8d9..Z d:e.d/e.f...f.d;d<..Z!dQd%e.d>e.d?e.f.d@dA..Z"d/e.f.dBdC..Z#d(e.d%e.f.dDdE..Z$dFe.d%e.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_slider.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10883
Entropy (8bit):	5.301526254765542
Encrypted:	false
SSDEEP:	192:zlU2gOyvtTYZqrA1hi881yilZ7aOaccrnzVVsFae6gUp4C/39GfywF3sbJGCkYg9:zlU2iFY31g88p/7aOaPrnzVCae6gUp4t
MD5:	EB1AB43A9D697E744113B2256FF8A93A
SHA1:	475C4271287379625B8F51015F808534C76B615F
SHA-256:	C5F5D413B2282D4E4A78519ADFBD294030D8AF51E60B026530B9E53528063403
SHA-512:	522ACAC87F214D5261AA446F618287DFA352293279834A0926D90CC70D4B9BBB477A61EEC5D4F1AF8BA2A695EF389B3ED718AACC21C35E0339A808AB72543B6C
Malicious:	false
Preview:	o.......).xd.G.......................@...sl...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClassc................+.......sX...e.Z.d.Z.d.Z.........................................dNd.e.d.e.e...d.e.e...d.e.e...d.e.e...d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.d.e.d.e.e.d.f...d.e.d.e.e.e.g.d.f...d.f...d.e.e.j.d.f...d.e.f..f.d.d...Z.dOd e.e...f.d!d"..Z...f.d#d$..Z.dP..f.d%d&..Z...f.d'd(..Z.d)d..Z.dQ..f.d,d-..Z.dQ..f.d.d/..Z.d0e.d1e.f...f.d2d3..Z.dOd4d5..Z.dRd6d7..Z.dRd8d9..Z.d1e.f.d:d;..Z.d1e.f.d<d=..Z.dQd>d?..Z.d@dA..Z.dSd e.d.e.dBe.e.e.f...f.dCdD..Z.dPd e.dEe.f.dFdG..Z dHdI..Z!dJdK..Z"dLdM..Z#....Z$S.)T..CTkSliderz.. Slider with rounded corners, border, number of steps, variable support, vertical orienta

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_switch.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12664
Entropy (8bit):	5.3232220015211515
Encrypted:	false
SSDEEP:	384:XXOMy/8886HGje/dQxXnMpLvzCcIhS2NUR:XXSfHGje1Qx8pLvzCLS22R
MD5:	04E2BB805323A26D6F6286438433682D
SHA1:	3F0E0A717E387358E21D5F0A6EEC03619AC69BC7
SHA-256:	94300EDF142CA8F3C1F09BF4E8FD58E70831316C530F492C659830D136052307
SHA-512:	8E68CCD0758ABF0FA5603E907CFE1B9E554CB29DDE0A9D12032DBEAF754790D586A2DC1E6DA82436C840EE1E96F8CAE3B6635BF233CCB18777C60CE017E5C65B
Malicious:	false
Preview:	o.......).xdx[.......................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Callable..Optional.....)...CTkCanvas)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFontc................3.......s....e.Z.d.Z.d.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.j.f.d.e.d.e.d.e.d.e.d.e.d.e.e...d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.d.e.e.e.e.f.....d.e.e.j.d.f...d.e.e.e.f...d.e.e.e.f...d e.e.j.d.f...d!e.d"e.e.d.f...d#e.f2..f.d$d%..Z.dVd&e.e...f.d'd(..Z...f.d)d*..Z.dWd.e.d.e.f...f.d+d,..Z.d-d...Z...f.d/d0..Z.d1d2..Z.dX..f.d4d5..Z.dX..f.d6d7..Z.d8e.d9e.f...f.d:d;..Z.dVd<d=..Z.dXd>d?..Z.dXd@dA..Z.d9e.e.e.f...f.dBdC..Z.dYdDdE..Z.dYdFdG..Z dHdI..Z!dZd&e.d"e.dJe.e.e.f...f.dKdL..Z"dWd&e.dMe.f.dNdO..Z#dPdQ..Z$dRdS..Z%dTdU.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_tabview.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11177
Entropy (8bit):	5.301209677395891
Encrypted:	false
SSDEEP:	192:01M7lhKA5IMOBLFOjz5Qx1U3qBj8YmAFBvd+:0a5IpVFOBg1U6BArAF5U
MD5:	2EB15885DB978A5DEA05919BBC626EAF
SHA1:	92D46255F3F6C6978657FBF674CC89C5CEC9615A
SHA-256:	9BB22C14F8CCDD3B4F63D89FDF8897FD04EA6917A04525C49FA70FD1D84A9686
SHA-512:	661A98FA94A075DC12B7DA79722243ACFE2FC0CAE2D053B899A800F3E69599E080EFCD2A9E911E0FB8181EA9DC8D89202736516F11E860924DE85569D7E27587
Malicious:	false
Preview:	o.......).xd$E.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Dict..List..Callable..Optional.....)...ThemeManager)...CTkFrame)...CTkCanvas)...DrawEngine)...CTkBaseClass)...CTkSegmentedButtonc................$.......s....e.Z.d.Z.U.d.Z.d.Z.e.e.d.<.d.Z.e.e.d.<.d.Z.e.e.d.<.d.Z.e.e.d.<.................................dUd.e.d.e.d.e.d.e.e...d.e.e...d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.d.f...d.e.f"..f.d d!..Z.d"d#..Z.d$e.e...f...f.d%d&..Z...f.d'd(..Z.dV..f.d)d*..Z.d+d,..Z.d-e.f.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d-e.f.d6d7..Z.d8d9..Z.d$e.f.d:d;..Z.dWd=e.f...f.d>d?..Z dW..f.d@dA..Z!dBe.f...f.dCdD..Z"d-e.d$e.f.dEdF..Z#dGe.d-e.d$e.f.dHdI..Z$d-e.d$e.f.dJdK..Z%

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_textbox.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17512
Entropy (8bit):	5.129889606125713
Encrypted:	false
SSDEEP:	384:YRphBmwLK7NZyz7KAtXD29w6Nqg1Om+cm:YRPBmwO7Nkz+ARENq++v
MD5:	1100D5EAE1B8B24A41E2174C59B50A86
SHA1:	07E31A4F1AD9E4DABA82A16C3EFCB4FDADE0C649
SHA-256:	3B29EC4EF504D679C9FAC3312FEF45ECDC0625B0BC447592485ECECDF9DFA9D8
SHA-512:	4CAEE3C30B7A9606CF5C955351F0C577862BD0584C93CD6A3E69E2B17447B8EE5DAD05B82F23437F4130FAD202585D12C303ED83C480FD6F3202A554C26D14A5
Malicious:	false
Preview:	o.......).xd._.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......N)...Union..Tuple..Optional..Callable.....)...CTkCanvas)...CTkScrollbar)...ThemeManager)...DrawEngine)...CTkBaseClass)...CTkFont)...pop_from_dict_by_set..check_kwargs_emptyc........................sl...e.Z.d.Z.d.Z.d.Z.h.d...Z...........................d.d.e.d.e.d.e.d.e.e...d.e.e...d.e.d.e.e.e.e.e.f...f...d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.f...f.d.d...Z.d.d.d...Z.d.d.e.f.d.d...Z...f.d.d...Z.d...f.d d!..Z.d"d#..Z...f.d$d%..Z.d...f.d&d'..Z.d...f.d(d)..Z.de.d+e.f...f.d,d-..Z.d.d.e.d/e.d0e.e.e.f...f.d1d2..Z.d.d.e.d3e.f.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z.d.d<d=..Z.d.d>d?..Z d@dA..Z!dBdC..Z"d.dDdE..Z#dFdG..Z$d.dHdI..Z%dJdK..Z&dLdM..Z'dNdO..Z(dPdQ..Z)dRdS..ZdTdU..Z+dVdW..Z,dXdY..Z-dZd[..Z.d.d\d]..Z/d^d_..Z0d`d

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.237925918709482
Encrypted:	false
SSDEEP:	3:1LEV/hGsEWdNKBuXEka2yDXTxEV/hG6URXRvEUkaOEoUJEkaOEoGMfqyGwn:1LBlWdYBu6DDxBtwEREsswn
MD5:	C0058EFA13153B77549D7F3B4D2A6B39
SHA1:	5AE6A50E71CC7F459DAF59C6897168DEC7F54346
SHA-256:	7CA28AD1F5541C58AA992670D0664563418A809183B3C039397BD20440B7A928
SHA-512:	830B5F2F886C92ACA4704307F2B363E6DE5061F6BAAAEBF4D997255D72D38FB9FD3FC0C719556EE5ECAAF55EA91FE3F3E872E413BE713DA6C6DCE804C823FC18
Malicious:	false
Preview:	from .appearance_mode_base_class import CTkAppearanceModeBaseClass.from .appearance_mode_tracker import AppearanceModeTracker..AppearanceModeTracker.init_appearance_mode().

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	401
Entropy (8bit):	5.080024107576398
Encrypted:	false
SSDEEP:	6:y/WI/8eCkAaLlIa/VErUEylWdXnw3jM8su6yxn23d6ZUArsNNJSSEhUtcDk+:CSeCTy/WrUaNaMM0I2JNEhrD3
MD5:	DBE6123F4B4B7BD20F00FBE86A6660C5
SHA1:	E4E9BF0B833213D4410E438BAAB245B7B1DECF22
SHA-256:	4883A5671C6D20C2832F8E9F27E7E813E1E305633CAB801F6723F7011A62B6CC
SHA-512:	445FA2E734357D7220CFD8234BD8FCA2BB97F75E3C10FF0C4FE648DFD60AADBE434DEEFCE882AA1A94FA6DCBF6FDE3BCBAA50A193A46458220D7B1A15BC3FA11
Malicious:	false
Preview:	o.......).xd.........................@...s$...d.d.l.m.Z...d.d.l.m.Z...e.......d.S.)......)...CTkAppearanceModeBaseClass)...AppearanceModeTrackerN).Z.appearance_mode_base_classr....Z.appearance_mode_trackerr....Z.init_appearance_mode..r....r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/appearance_mode/__init__.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode\pycache\appearance_mode_base_class.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3113
Entropy (8bit):	5.215459808919251
Encrypted:	false
SSDEEP:	48:hzMoU5Yvq985aDdDN59aed+p/spwYvWqpolqbR71T9fMm8gyjiKGIQzk:nvE8mtN59zW0WRl+nR2gyjiPIp
MD5:	EF78C4F424F30C216F062D07394C25EF
SHA1:	F150C42BACB4460D32EA58880A9891ED57C81513
SHA-256:	0183C43E7EDBF2627AEEC1BE2B52CBFE1B823E8FEBCDC1F59C37CAA5B2C09648
SHA-512:	A10C924A584356861161E3C3FBA715FF3DE1F7F0ED3D8B95A3240041B762AC760E04500ABE20808AF5AC478F2B2C8A96E1123C4CA345C678D8A21E57874DE9D4
Malicious:	false
Preview:	o.......).xd*........................@...s2...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.S.)......)...Union..Tuple..List.....)...AppearanceModeTrackerc....................@...s\|...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.e.e.e.e.f...e.e...f...d.e.f.d.d...Z.e.d.d.e.d.e.f.d.d.....Z.d.S.)...CTkAppearanceModeBaseClassa..... Super-class that manages the appearance mode. Methods:.. - destroy() must be called when sub-class is destroyed. - _set_appearance_mode() abstractmethod, gets called when appearance mode changes, must be overridden. - _apply_appearance_mode() to convert tuple color.. c....................C...s....t...\|.j.\|.....t.....\|._.d.S...N).r......add.._set_appearance_modeZ.get_mode.,_CTkAppearanceModeBaseClass__appearance_mode....self..r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/appearance_mode/appearance_mode_base_class.py..__init__....s........z#CTkAppearanceModeBaseClass.__i

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode\pycache\appearance_mode_tracker.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3692
Entropy (8bit):	5.168436321099557
Encrypted:	false
SSDEEP:	96:/jOI9uI73QchZPhM84k7Ik8DIv3zDBjM3nE:/BuIjJ5M84sMD03xMnE
MD5:	50508426A53E9DF087F1AC93F9499E7F
SHA1:	8EEBACE6481042BD976096202BF7B13FB09693F1
SHA-256:	950EDA6EAF809428963D19876CB85B1E7B3D3A61CD15DE307A82E421F414EF65
SHA-512:	5ECD958364AF7EE2A1FFAC77625C7C706751C836FE80CF6C9286096D46C22E75F22232DF8108BEADECFEE22669220DF47446FB6BFA9380CC6303D946B91F3430
Malicious:	false
Preview:	o.......).xd.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.e.e.j...e.d...k.r0e.j...d.....e.j.d.k.r0e.....W.n...e.y?..Z...z.e...d.Z.[.w...e.yM......e.j...d.....Y.n.w.G.d.d...d...Z.d.S.)......N)...StrictVersion)...Callablez.0.3.1zWWARNING: You have to upgrade the darkdetect library: pip3 install --upgrade darkdetect...darwinzJcustomtkinter.appearance_mode_tracker warning: failed to import darkdetectc....................@...s....e.Z.d.Z.g.Z.g.Z.d.Z.d.Z.d.Z.d.Z.e.d.d.....Z.e.d.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.d.S.)...AppearanceModeTrackerF.......systemr....c....................C...s6...\|.j.d.k.r.\|.....}.\|.\|.j.k.r.\|.\|._.\|.......d.S.d.S.d.S.).Nr....)...appearance_mode_set_by..detect_appearance_mode..appearance_mode..update_callbacks)...cls..new_appearance_mode..r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widg

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode\appearance_mode_base_class.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2602
Entropy (8bit):	4.448769718641291
Encrypted:	false
SSDEEP:	48:EVsVU5YvqcLRvhivqcJbwCJZwbgGUKAP3:hvnOrJ5Zw0
MD5:	99F22B7548474E5476120CFE4154410C
SHA1:	EBBA924D5585EA2A6D869331890FC939422BDABC
SHA-256:	9D35C90B8BE9C23AE00A268EBF7576D3156FB64C4A47DA5527290892158A173F
SHA-512:	8A5E7C54B92571BD0B7DA188822DE70547D9625557BB261C85F76F1438B597632CC1C1525AC247E7C364FF16CB568607B67D5D9BE587AFA3F33E3D8B003C2128
Malicious:	false
Preview:	from typing import Union, Tuple, List..from .appearance_mode_tracker import AppearanceModeTracker...class CTkAppearanceModeBaseClass:. """. Super-class that manages the appearance mode. Methods:.. - destroy() must be called when sub-class is destroyed. - _set_appearance_mode() abstractmethod, gets called when appearance mode changes, must be overridden. - _apply_appearance_mode() to convert tuple color.. """. def __init__(self):. AppearanceModeTracker.add(self._set_appearance_mode, self). self.__appearance_mode = AppearanceModeTracker.get_mode() # 0: "Light" 1: "Dark".. def destroy(self):. AppearanceModeTracker.remove(self._set_appearance_mode).. def _set_appearance_mode(self, mode_string: str):. """ can be overridden but super method must be called at the beginning """. if mode_string.lower() == "dark":. self.__appearance_mode = 1. elif mode_string.lower() == "light":. self.__appearance_mode =

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\appearance_mode\appearance_mode_tracker.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4097
Entropy (8bit):	4.234256662609932
Encrypted:	false
SSDEEP:	48:klPwnHYseYCf8WjLhFqE6vmGKt59XPnV8WjjIujEO235MjIR5tjIkc:k6nHvmVUEIna9/fjIujES86
MD5:	F73BAA1DD90A746399B0D5F10D606F73
SHA1:	59A51C07C7869FA3F492224F89DA6D3EBBA6ECD9
SHA-256:	57BAFD80A1ACFEB55001C79A5EDDC5463F1661D8DF7A860BD737A5B79F0DB490
SHA-512:	24CCD856C16EBE23B12F1CE506A9D571A2E87A6D7A6C0DF1D9F02451702C2BFF3C19CE41C647D13DDF165F7D2FE0C72C1398E922071CB80D0CD874E5B7E64741
Malicious:	false
Preview:	import sys.import tkinter.from distutils.version import StrictVersion as Version.from typing import Callable..try:. import darkdetect.. if Version(darkdetect.__version__) < Version("0.3.1"):. sys.stderr.write("WARNING: You have to upgrade the darkdetect library: pip3 install --upgrade darkdetect\n"). if sys.platform != "darwin":. exit().except ImportError as err:. raise err.except Exception:. sys.stderr.write("customtkinter.appearance_mode_tracker warning: failed to import darkdetect")...class AppearanceModeTracker:.. callback_list = []. app_list = []. update_loop_running = False. update_loop_interval = 30 # milliseconds.. appearance_mode_set_by = "system". appearance_mode = 0 # Light (standard).. @classmethod. def init_appearance_mode(cls):. if cls.appearance_mode_set_by == "system":. new_appearance_mode = cls.detect_appearance_mode().. if new_appearance_mode != cls.appearance_mode:.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_rendering\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	324
Entropy (8bit):	4.667512219684699
Encrypted:	false
SSDEEP:	6:kyBH3BBv2JQzFWbwd6v4eyKAvF9sUF6FK++MOxq5xnxMOxq+:kyZ3Pzcbwd6v4ejCGUAeTq5xxTq+
MD5:	6E29C0BB8DA48237606D6163301FDB0B
SHA1:	FA8DBE60E0E26A2BA080F3EB6F90A5D2F1A9FCEA
SHA-256:	DB5D9635843DD3FE1863F401EB1D04FB10AAAA6517B167A034F43855E5D228ED
SHA-512:	31654FAA84A5689A26D7F9FEA8A04E73FDF5613409FE42220726B5D490CB620C85388798DE53D62F901B6E19ACBDC543D085C6359EB814511238FE29922EF275
Malicious:	false
Preview:	import sys..from .ctk_canvas import CTkCanvas.from .draw_engine import DrawEngine..CTkCanvas.init_font_character_mapping()..# determine draw method based on current platform.if sys.platform == "darwin":. DrawEngine.preferred_drawing_method = "polygon_shapes".else:. DrawEngine.preferred_drawing_method = "font_shapes".

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_rendering\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.278015574566511
Encrypted:	false
SSDEEP:	12:CS82Z0XrfPaV/uznR7zNupnk9qQqAI2JN5cDv:/eXDSsR7zNupnoqQqADn58
MD5:	AEA164924D4E57DEBC0A0CDAABA995D5
SHA1:	B94A55055202ABB6E0EB9EBEF0A9DB97DC3DD3AE
SHA-256:	624D6E5067C3918B4348E91BFB46170039FCFD9672B8F59A96E29BB0D5EA08A9
SHA-512:	CA704C9E6E496367E27778F7E2599E42B59AE4257FE8DD8355F5EDEC707182548DEECA9D69B39AD3E1E1487D89D93D39BE181200B092C2A9326AB11AB3F53245
Malicious:	false
Preview:	o.......).xdD........................@...sF...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.......e.j.d.k.r.d.e._.d.S.d.e._.d.S.)......N.....)...CTkCanvas)...DrawEngine..darwinZ.polygon_shapesZ.font_shapes)...sysZ.ctk_canvasr....Z.draw_enginer....Z.init_font_character_mapping..platformZ.preferred_drawing_method..r....r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/core_rendering/__init__.py..<module>....s..................

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_rendering\pycache\ctk_canvas.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	5.496797393428799
Encrypted:	false
SSDEEP:	96:apbDE6dB3jkTzByTCI5XcanYHkaYHhv1f5FcjkP9HqhqhqsHUEjEP8uNnCt09y4K:i3dBjSK9BYHkrt5btPpPuNCt0p4OYjsY
MD5:	3DA2C36F4DB43E478C544CC3859596CC
SHA1:	AD3AB794A03BC4A9AD18C4CC26D12AD756D24793
SHA-256:	5714BD6B1B32E372B4721A087AB8D082C3B170111DB50E13205BD9384A8F3F92
SHA-512:	D72247BDF6FCD1347F9B064B0C3F086B1000BBEFDB63F76CB775D2386259D87BE0F707E3D6965DA073964C74483732209426AB95884FDBCD7561BF5642AB5F5F
Malicious:	false
Preview:	o.......).xd.........................@...s6...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...G.d.d...d.e.j...Z.d.S.)......N)...Union..Tuplec........................s....e.Z.d.Z.U.d.Z.d.Z.e.e.d.<...f.d.d...Z.e.d.d.....Z.d.e.d.e.f.d.d...Z.d.d.d.e.j.f.d.e.d.e.d.e.d.e.d.e.d.e.e.e.e.d.f...f...d.e.d.e.f.d.d...Z...f.d.d...Z...f.d.d...Z.....Z.S.)...CTkCanvasa..... Canvas with additional functionality to draw antialiased circles on Windows/Linux... Call .init_font_character_mapping() at program start to load the correct character. dictionary according to the operating system. Characters (circle sizes) are optimised. to look best for rendering CustomTkinter shapes on the different operating systems... - .create_aa_circle() creates antialiased circle and returns int identifier.. - .coords() is modified to support the aa-circle shapes correctly like you would expect.. - .itemconfig() is also modified to support aa-cricle shapes... The aa-circles are created by choosing a character from th

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_rendering\pycache\draw_engine.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32373
Entropy (8bit):	5.299031656090363
Encrypted:	false
SSDEEP:	768:sZNFbY8T/Pn4z57sxa5ijq76lO+Vo/ES7t/Z7KtV29RYC7xQft9AV/FNtYb:cz/P8Tij8qS7RBaCVhy
MD5:	2DFD6E4483B2125297C5D48EA750FF0B
SHA1:	5F987D2865C7522BAF081DA76408C8709F3AF4A4
SHA-256:	99F9CCE3884412AD87BB5E899D1E547EABA666966F7B97D84655AB2764A5E61A
SHA-512:	89ECEA656A52F2FBC0BC5108697762F7FBF6C1256D5238F949080B103F1EA1FF3A622060D98BCDA9CEBE17031958886640A1D8FDBACF00AADDDEDE55804B5F16
Malicious:	false
Preview:	o.......).xd.c.......................@...sV...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...e.r"d.d.l.m.Z...G.d.d...d...Z.d.S.)......)...annotationsN)...Union..TYPE_CHECKING.....)...CTkCanvasc....................@...s....e.Z.d.Z.U.d.Z.d.Z.d.e.d.<.dRd.d...Z.dSdTd.d...Z.dUd.d...Z.dVd.d...Z...dWdXd.d...Z.dYd.d ..Z.dZd#d$..Z.dYd%d&..Z.d[d(d)..Z.d\d*d+..Z.d]d,d-..Z.d^d2d3..Z.d_d4d5..Z.d_d6d7..Z.d`d;d<..Z.dad=d>..Z.dad?d@..Z.dbdDdE..Z.dcdFdG..Z.dcdHdI..Z.dddLdM..Z.dedPdQ..Z.d.S.)f..DrawEnginea..... This is the core of the CustomTkinter library where all the drawing on the tkinter.Canvas happens.. A year of experimenting and trying out different drawing methods have led to the current state of this. class, and I don't think there's much I can do to make the rendering look better than this with the. limited capabilities the tkinter.Canvas offers... Functions:. - draw_rounded_rect_with_border(). - draw_rounded_rect_with_border_vertical_split(). - draw_rounded_pr

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_rendering\ctk_canvas.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5894
Entropy (8bit):	4.513679204304723
Encrypted:	false
SSDEEP:	96:E8dB3jkTzByTCI5XcaefSFcYnkqcxpAUpqRtJ6yX9OZFqEgKyGv:E2BjSK9Nb7oN25NDKyGv
MD5:	ED6548CC15069DFE7AC5F12A36C46155
SHA1:	C67ED2C78CC67674F1238187B5D5D5113B559BBF
SHA-256:	B971D8A9D4E7B352C0A7619869DC810DC2ADE4FA4D50791AFFB978695D63AAA8
SHA-512:	3503648EB81CB50B40F15671E92070645655E1EFBC97922DD3163CB6B6AEE990D9CDE02950D2D424004594EA697521234634F44B22141150F5CEBC116A9148F9
Malicious:	false
Preview:	import tkinter.import sys.from typing import Union, Tuple...class CTkCanvas(tkinter.Canvas):. """. Canvas with additional functionality to draw antialiased circles on Windows/Linux... Call .init_font_character_mapping() at program start to load the correct character. dictionary according to the operating system. Characters (circle sizes) are optimised. to look best for rendering CustomTkinter shapes on the different operating systems... - .create_aa_circle() creates antialiased circle and returns int identifier.. - .coords() is modified to support the aa-circle shapes correctly like you would expect.. - .itemconfig() is also modified to support aa-cricle shapes... The aa-circles are created by choosing a character from the custom created and loaded. font 'CustomTkinter_shapes_font'. It contains circle shapes with different sizes filling. either the whole character space or just pert of it (characters A to R). Circles with a smaller. radius need a sma

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_rendering\draw_engine.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	91030
Entropy (8bit):	4.3562559710133195
Encrypted:	false
SSDEEP:	384:mtDeqviV56G1Q6cW+rflSKGz3y/PDcW+owW5wZeijbcW+o9koXiqS7uXW+W9diAx:msRw/PVvijNLJS7VbV5lmbgAbO/Pd
MD5:	84D73BF36E7BF87252871310AB2D8333
SHA1:	A2366E6155E30A422070BB28856A20E6833508DD
SHA-256:	79E5E9B188820CEA94428E4FCF99C11C342A83DF5DAEDE100E33839AB75E7BCC
SHA-512:	445CF4DC93E591FD009025F495FD85563A333846257B2DFD7A08F332C3AC01EC72519A33A16CFFF76CDE47811DA7833CD0A4469B0CD72774C3EA4DE577F644D2
Malicious:	false
Preview:	from __future__ import annotations.import sys.import math.import tkinter.from typing import Union, TYPE_CHECKING..if TYPE_CHECKING:. from ..core_rendering import CTkCanvas...class DrawEngine:. """. This is the core of the CustomTkinter library where all the drawing on the tkinter.Canvas happens.. A year of experimenting and trying out different drawing methods have led to the current state of this. class, and I don't think there's much I can do to make the rendering look better than this with the. limited capabilities the tkinter.Canvas offers... Functions:. - draw_rounded_rect_with_border(). - draw_rounded_rect_with_border_vertical_split(). - draw_rounded_progress_bar_with_border(). - draw_rounded_slider_with_border_and_button(). - draw_rounded_scrollbar(). - draw_checkmark(). - draw_dropdown_arrow().. """.. preferred_drawing_method: str = None # 'polygon_shapes', 'font_shapes', 'circle_shapes'.. def __init__(self, canvas: CTk

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_widget_classes\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.507706447404279
Encrypted:	false
SSDEEP:	3:1LBVSf2oMRzFAo1GnFNKBoWDGn:1LB6Qzb1WYBoVn
MD5:	E160B45B56AFCB988FCBCF17CD6BB509
SHA1:	6ADE5F2E6DFD5B0A4A21548643809AB5871B1A99
SHA-256:	0EC1B7CE8E21CC05267456EDDDA5E07A7D15B3463DFA9A7270A4C87EB1D360C0
SHA-512:	BB6095274692CEF8D5B499FDDFDFB35B78FEE690618B1AF8A202E6C21F381E849578F2D8C6F6705F2D8A130940978D31387FF0E06019BA85D60EBC8D6DCB2744
Malicious:	false
Preview:	from .dropdown_menu import DropdownMenu.from .ctk_base_class import CTkBaseClass.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_widget_classes\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.084775913254557
Encrypted:	false
SSDEEP:	6:y/WIWGte5/QkAGlvlwSgBe78XWWrPuyxn23d6ZUArsNNJSSq3QD6g:CoGtehQTGFlwpBel5I2JNqAD6g
MD5:	1B95B61ACD0082BCF59BE905DCD03857
SHA1:	739016F0F6CE5FC589DBD5B8C862E00ECF07BB4C
SHA-256:	ACC8307E2BFC524CBF1E5C2D39AD2F7C9AC7014DC83FA540B88E4F4B784928CB
SHA-512:	E601DDCD8F26310CD947266865A3047958FC351977EFF690AC69FBDC26F7F6B6D663CDE58DE878A2E7F937A7FB4C9B3991155E3F84401262B6914078137ED405
Malicious:	false
Preview:	o.......).xdQ........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...DropdownMenu)...CTkBaseClassN).Z.dropdown_menur....Z.ctk_base_classr......r....r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/core_widget_classes/__init__.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_widget_classes\pycache\ctk_base_class.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12643
Entropy (8bit):	5.408207029508598
Encrypted:	false
SSDEEP:	192:YnvbKFWwQLf0E0BkSEfxc9nh6LamI0thoUsDiZe6o:YjKFWHqBaJonh6LHIgBo
MD5:	D204EA467B56AF19104E11085ADD8186
SHA1:	59A5687C06318FB8B2256C9A77DDFD1D56331ED6
SHA-256:	8994FD7C8A0BAC3FE7EF767288DC85BE789A42BDD04EA8C6DEA64371084D64FA
SHA-512:	6A1EDB79BA89D2948F39281CA40A3E0F5401DF5D1FB44CA8B172FA7E1666B0FDE38612A48BD39AE11D68FA38DC30765B59CDCF37952FFE531C356D9242D6AE8D
Malicious:	false
Preview:	o.......).xd.=.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y3......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......N)...Union..Callable..Tuple)...TypedDict.....)...windows.....)...ThemeManager)...CTkFont)...CTkImage)...CTkAppearanceModeBaseClass)...CTkScalingBaseClass)...pop_from_dict_by_set..check_kwargs_emptyc........................s~...e.Z.d.Z.U.d.Z.d.h.Z.e.e.d.<.d.Z.e.e.d.<.......dAd.e.d.e.d.e.d.e.e.e.e.e.f...f...f...f.d.d...Z.d.d...Z.dBd.e.f.d.d...Z.d.d...Z.dB..f.d.d...Z.d.e.f...f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d ..Z.d!d"..Z.dCd$e.e.e.e.e.f...f...f.d%d&..Z...f.d'd(..Z...f.d)d*..Z.dD..f.d+d,..Z.dEd-d...Z.dDd/d0..Z.d1d2..Z.dEd3d4..Z...f.d5d6..Z...f.d7d8..Z ..f.d9d:..Z!..f.d;d<..Z"..f.d=d>..Z#..f.d?d@..Z$....Z%S.)F..CTkBaseClassz. Base class of every CTk widget, handles the dimensions, bg_color,. appearance_mode changes, sc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_widget_classes\pycache\dropdown_menu.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6641
Entropy (8bit):	5.338090545728303
Encrypted:	false
SSDEEP:	192:Fa4v+85SV5C816BdCqw5xFvQAevI3+0Z8h1ZA0:F/vl5SV5C8KBwVv7uzh1i0
MD5:	C11E0AA6C51A48E5D240F3BDF8AC3A97
SHA1:	59790C7CC0891A19EBD873426E9650BDDCB6A9CD
SHA-256:	51D6F624EFD0C24E8782922251058E4371158B8054DBDD3B658754C9BE3942CA
SHA-512:	8814437A097B9299FC3D596A01D531E737263B85DC7501112AAFAF09B6F74B08C4BC4796AD9EAE344D65EA7217D4E191CBE55877BC1E3E5C3E3DF92E2C7DDE27
Malicious:	false
Preview:	o.......).xdD!.......................@...sv...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j.e.e...Z.d.S.)......N)...Union..Tuple..Callable..List..Optional.....)...ThemeManager)...CTkFont)...CTkAppearanceModeBaseClass)...CTkScalingBaseClassc........................s>...e.Z.d.Z.d.d.d.d.d.d.d.d...d.e.d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.e.e.f...f.....d.e.e.e.e.f.....d.e.e.d.f...d.e.e.e.....f.d.d...Z.d.d...Z...f.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.d.e.e.e.f...d.e.e.e.f...f.d.d...Z...f.d.d...Z.d.e.d.e.f...f.d.d ..Z.e.d.e.f.d!d"....Z...f.d#d$..Z...f.d%d&..Z.....Z.S.)'..DropdownMenu.....N)...min_character_width..fg_color..hover_color..text_color..font..command..valuesr....r....r....r....r....r....r....c....................O...s....t.j.j.\|.g.\|...R.i.\|.......t...\|.....t.j.\|.d.d.....\|.\|._.\|.d.u.r't.j.d...d...n.\|...\|...\|._.\|.d.u.r8t.j.d...d...n.\|...\|...\|._.\|.d.u.rIt.j.d...d...n.\|...\|...\|._.\|.d.u.rVt...n.\|...\|...\|._.t

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_widget_classes\ctk_base_class.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15788
Entropy (8bit):	4.554041443013056
Encrypted:	false
SSDEEP:	192:kojXQejXkFd3Pfo24r3c4XL9I0vbYy+t7DYFZjUqDWaqR:kGGuzA8I0sy+tIG7xR
MD5:	6B9717A6AC3F538904B120B70E596CD9
SHA1:	FAB8617D5C13D3979EB47DDC0EFDD1F39C772B92
SHA-256:	45C9AB1D138144795124C8B2338460E9CD7E5A7118A7FBB7C8F736772B57E0F1
SHA-512:	70D7E59104C4DAF552F071BD47D66EF3133D4C2918F804DA613D84AFC9F4E07538B80C3DF29886A762FE21DCBB5C42CCC12739AB572E07BEBB24E985082AD347
Malicious:	false
Preview:	import sys.import warnings.import tkinter.import tkinter.ttk as ttk.from typing import Union, Callable, Tuple..try:. from typing import TypedDict.except ImportError:. from typing_extensions import TypedDict..from .... import windows # import windows for isinstance checks..from ..theme import ThemeManager.from ..font import CTkFont.from ..image import CTkImage.from ..appearance_mode import CTkAppearanceModeBaseClass.from ..scaling import CTkScalingBaseClass..from ..utility import pop_from_dict_by_set, check_kwargs_empty...class CTkBaseClass(tkinter.Frame, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. """ Base class of every CTk widget, handles the dimensions, bg_color,. appearance_mode changes, scaling, bg changes of master if master is not a CTk widget """.. # attributes that are passed to and managed by the tkinter frame only:. _valid_tk_frame_attributes: set = {"cursor"}.. _cursor_manipulation_enabled: bool = True.. def __init__(self,.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\core_widget_classes\dropdown_menu.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8516
Entropy (8bit):	4.417939578942002
Encrypted:	false
SSDEEP:	96:E+l+JIJPJWAmA/YBG/0Js11j/auPsqk+peGGAZkQsrGGAb+r6KkkJN1LFOamIGln:EJ2NwY1jymfTMUpefPXUp0q
MD5:	676B6D4A0B91C9820801B611825415AB
SHA1:	60B0A7C33654A0B0C6862215998D5A345F49F8C9
SHA-256:	742FD211693F5D06D7E3B3632C3CA1B0A87C60A3723C59DDA08231A809CE1911
SHA-512:	60C2BBC958274FAD8A2C576AF879484A58D4F2C9FDC5EA8D90780A2E321C3AE37327DF1CDA669FFFE0249CBC52053265D22813EFB949BFD83F56167A7250CB16
Malicious:	false
Preview:	import tkinter.import sys.from typing import Union, Tuple, Callable, List, Optional..from ..theme import ThemeManager.from ..font import CTkFont.from ..appearance_mode import CTkAppearanceModeBaseClass.from ..scaling import CTkScalingBaseClass...class DropdownMenu(tkinter.Menu, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. def __init__(self, args,. min_character_width: int = 18,.. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. hover_color: Optional[Union[str, Tuple[str, str]]] = None,. text_color: Optional[Union[str, Tuple[str, str]]] = None,.. font: Optional[Union[tuple, CTkFont]] = None,. command: Union[Callable, None] = None,. values: Optional[List[str]] = None,. kwargs):.. # call init methods of super classes. tkinter.Menu.__init__(self, args, **kwargs). CTkAppearanceModeBaseClass.__init__(self). CTkScaling

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_button.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27663
Entropy (8bit):	4.386782780930411
Encrypted:	false
SSDEEP:	384:ET8O2aN8RXqWVzOSmb5yGEHPAPLKS+4xU2Yo:ETOS+4xUi
MD5:	2C9CEA4C3D1EEB63986F74D7C548DB36
SHA1:	5C45CBCB7E57FF3EE58B05E49506067B1E6A6378
SHA-256:	94ED73C9850E276B415DD3DC6FFD793E5216592E93B735A6839F42D9D45E2515
SHA-512:	A84BF40D51F359F774B0D3C10C3043B741D9C145DDC9FC7ED1BCDA3B1B3F26779F8014EC43E9005B1D2A7CBE8ECEC9409E65D00DC2F8FE8DF8AA807959734436
Malicious:	false
Preview:	import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont.from .image import CTkImage...class CTkButton(CTkBaseClass):. """. Button with rounded corners, border, hover effect, image support, click command and textvariable.. For detailed information check out the documentation.. """.. _image_label_spacing: int = 6.. def __init__(self,. master: any,. width: int = 140,. height: int = 28,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,. border_spacing: int = 2,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. hover_color: Optional[Union[str,

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_checkbox.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	22074
Entropy (8bit):	4.342559407436691
Encrypted:	false
SSDEEP:	96:EFp7IJwJIJkJZJPJIRJllCG/Ts73NmYAfzBzxcLB9FvVQYXS3g6qgw/90Bvv2ioL:EAO2aXN8DnMtzz4v/SGMl4nPlsBMQGm
MD5:	7E3C22BB90587320A77A2444763B6865
SHA1:	2715603B66EF39232BAD070626DE9EA71895CC39
SHA-256:	5F491E892EA070F7635456F55A66C32AE37EC934B967DF0A970BF2EB37D1BDCF
SHA-512:	E6D35C714223A48FF6BFDB34749ABE30C38538BE8860D672ECE112555BD4E4BBFCE4A7669E2A3F6F40BF5B0873458F9993A7F408357DD91A64EC72A83B00B462
Malicious:	false
Preview:	import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont...class CTkCheckBox(CTkBaseClass):. """. Checkbox with rounded corners, border, variable support and hover effect.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 100,. height: int = 24,. checkbox_width: int = 24,. checkbox_height: int = 24,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. hover_color: Optional[Union[str, Tuple[str, str]]] = None,.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_combobox.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	20598
Entropy (8bit):	4.371257409888585
Encrypted:	false
SSDEEP:	192:ERpOaYXLEzN84ifOFqGOBijdWA3K1+TQWJ0:ERpOaYXLEzN8d11L
MD5:	03F03C392CBECD0E743735E8DB23F455
SHA1:	F3F3FB0DB22884FE7ED1CCA654143AF2F03EB746
SHA-256:	15B2E6C8BD0D18F0DFCAA77DE0BA10102A428294C4040243ABE8246EE44AC4FF
SHA-512:	D526AD7FAE010AE5146FD1C39AA6BBE6751B91D8E6EA87D6124A9E295AD626657B73A77E435269A6C98C0FF86CF3B3A54BB8AA27746FE2EB5A17B361B2FCBA86
Malicious:	false
Preview:	import tkinter.import sys.import copy.from typing import Union, Tuple, Callable, List, Optional..from .core_widget_classes import DropdownMenu.from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont...class CTkComboBox(CTkBaseClass):. """. Combobox with dropdown menu, rounded corners, border, variable support.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 140,. height: int = 28,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Optional[Union[str, Tuple[str, str]]] = None,. button_color: Option

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_entry.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17893
Entropy (8bit):	4.402295132612985
Encrypted:	false
SSDEEP:	96:evK3yLYFJwJkJPJVJuFNbGf+OqPWbYhaScug8w8bjaBa4kRREJ8Tch/Nch02Eufr:GYJOaNDgFDsa4kyCUkOsymtaJQftyeT
MD5:	0FA76A5EC38FD340E932FD88F8899E19
SHA1:	1B2F4FC3A5927431553C64AB313BB129B1D7B1DF
SHA-256:	CB2B5B1E3529304D9BBFB30233524F75DA31B69A0C5D6C73D6E44E2C1296331A
SHA-512:	108BFA543402FBC2771C8CBEAD5C8F5B260743EA165AD5A9C6630B6E078B10AF8AFF6AFDBD50D641FEB2944AFCFBA96DB9F8C2A34F62A6184FD34D18217496B7
Malicious:	false
Preview:	import tkinter.from typing import Union, Tuple, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont.from .utility import pop_from_dict_by_set, check_kwargs_empty...class CTkEntry(CTkBaseClass):. """. Entry with rounded corners, border, textvariable support, focus and placeholder.. For detailed information check out the documentation.. """.. _minimum_x_padding = 6 # minimum padding between tkinter entry and frame border.. # attributes that are passed to and managed by the tkinter entry only:. _valid_tk_entry_attributes = {"exportselection", "insertborderwidth", "insertofftime",. "insertontime", "insertwidth", "justify", "selectborderwidth",. "show", "takefocus", "validate", "validatecommand", "xscrollcommand"}.. def __init__(self,. master: any,.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_frame.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9510
Entropy (8bit):	4.380953602148407
Encrypted:	false
SSDEEP:	96:q3X7qJwJkJRhJ+0XcG6Fruqirx/xYEi8w8iS8aK8dygj8K8Pqr5sqS5Fd5+u5w8x:lOaRg09LKKyx0Y
MD5:	C57AC5E5DE168E3153954D566935D5FC
SHA1:	2FB7C3C5A040C759C3D017FA41DC84BD927548AE
SHA-256:	A28BC63F0CD5AE940236AB240028774607A61B681D48082C2DF63E4D0106F868
SHA-512:	CC904775A60989FCE6DAB7844980FD2FE04794436E4FFDA9A4F2A7E84B2AD46FD4226E33710157401F56F7D5801021318B64A8DFD3A544593C5CE2A07BF979B9
Malicious:	false
Preview:	from typing import Union, Tuple, List, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass...class CTkFrame(CTkBaseClass):. """. Frame with rounded corners and border.. Default foreground colors are set according to theme.. To make the frame transparent set fg_color=None.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 200,. height: int = 200,. corner_radius: Optional[Union[int, str]] = None,. border_width: Optional[Union[int, str]] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Optional[Union[str, Tuple[str, str]]] = None,.. background_corner_colors: Union[Tuple[U

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_label.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12136
Entropy (8bit):	4.367197887783026
Encrypted:	false
SSDEEP:	96:60E/YaqNJwJPJJLcxGf8IYuWqeqMtErtDRufVirRK8PEx9nuwZfIS8K8vvH33fWg:tooONw4B/ZPyAWq3Sqc2wM
MD5:	CD1C2EC3C98D9F04059B35097A854ECC
SHA1:	1ED6B070B6DB479E20200AA2B6F33CCD246A8C83
SHA-256:	E841983156ED06CDE6E603CD81F8B85EB1852B95338A3F7D9365F84D398A1925
SHA-512:	CF785E651C67DC40D032C8A6C58E9A6777586B4C751B072793F881419111EEEC95C2BC60749E3575F8F1AD111D43AD47F0788725B3BF235010E55D50C6735822
Malicious:	false
Preview:	import tkinter.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont.from .image import CTkImage.from .utility import pop_from_dict_by_set, check_kwargs_empty...class CTkLabel(CTkBaseClass):. """. Label with rounded corners. Default is fg_color=None (transparent fg_color).. For detailed information check out the documentation... state argument will probably be removed because it has no effect. """.. # attributes that are passed to and managed by the tkinter entry only:. _valid_tk_label_attributes = {"cursor", "justify", "padx", "pady",. "textvariable", "state", "takefocus", "underline"}.. def __init__(self,. master: any,. width: int = 0,. height: int = 28,. corner_radius: Optional[int] = No

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_optionmenu.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	4.37619608513597
Encrypted:	false
SSDEEP:	192:okOYXN8LEzVc1pEUc0ChuA3HH+Tdexd46eQGm:okOYXN8LEzVLtHqU
MD5:	ACAE83EB3F24E705D20BEF02D68F0CF8
SHA1:	65BF6217C14950EFDF7CD3F9C10E3A43A2416141
SHA-256:	3DDD89C0E42631DF6AFF948054F49E590A78EB66F69BFEC1B101E287452BCDCC
SHA-512:	B675F97DA602B519A805925B4C83516E5B6D6AFE094093EC03B09901CBD4EF2A66434118AC1F7670C8CBFDC2656E0EB48062F6F02A4FFBC0F8BA32160FB795DA
Malicious:	false
Preview:	import tkinter.import copy.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .core_widget_classes import DropdownMenu.from .font import CTkFont...class CTkOptionMenu(CTkBaseClass):. """. Optionmenu with rounded corners, dropdown menu, variable support, command.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 140,. height: int = 28,. corner_radius: Optional[Union[int]] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. button_color: Optional[Union[str, Tuple[str, str]]] = None,. button_hover_color: Optional[Union[str, Tuple[str, str]]] = None,.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_progressbar.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14115
Entropy (8bit):	4.2201127319626455
Encrypted:	false
SSDEEP:	96:LVy7gJwJkJTJIHWzX8Zw0UKulDGcadYZ5NiN6VgZn3suWLqMKj8DK8KAe/lV8q8O:hOaZatJUEr3WKxo+uJtdNi2I3QR+
MD5:	2B822F1F33A2121AEE3DF67466261B12
SHA1:	7230903E521F1A23DC448A3963E49151EFCD52C8
SHA-256:	0EF3C67E97960AEAF592ABC69F6D2C0C2AA681C05E7A7FE9503E51F5FBC7622E
SHA-512:	C1F861AAE7ED2958C99F3B77F2FFF4E765DDF58ECDECD57E5458407FA25A77AE68E24FE9C6D010155F9BC5B43BB154A75AFD3B13A2984FCF2165828051AA26E6
Malicious:	false
Preview:	import tkinter.import math.from typing import Union, Tuple, Optional, Callable.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass...class CTkProgressBar(CTkBaseClass):. """. Progressbar with rounded corners, border, variable support,. indeterminate mode, vertical orientation.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: Optional[int] = None,. height: Optional[int] = None,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Optional[Union

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_radiobutton.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	20211
Entropy (8bit):	4.364521189856133
Encrypted:	false
SSDEEP:	96:EFm7sJwJIJkJPJIRJ34G/psZbYpyrRBhQchqGOvVQ8E8TS1P6VwC0BHv2AoedQ8I:EDO2aN83RGOEnHHjsNolW20qewQGm
MD5:	B4FEB4B83C68101BA0E93408CD427462
SHA1:	5AAF22F95A7B9C8AAE7CAE996D816E72288C89AB
SHA-256:	54DB4F49669FE0FEF7DDB7FD14DA83A7D36F2B416030EEC983E86057232EDFF9
SHA-512:	82BDE6BD5A3B856577C69C972ADD29A9E46B5D1189CA4316966BC285115A235E9F085FA40B05C2C3A915D993F373398ACB749DC6100AD55225BC627FF898A4CB
Malicious:	false
Preview:	import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont...class CTkRadioButton(CTkBaseClass):. """. Radiobutton with rounded corners, border, label, variable support, command.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 100,. height: int = 22,. radiobutton_width: int = 22,. radiobutton_height: int = 22,. corner_radius: Optional[int] = None,. border_width_unchecked: Optional[int] = None,. border_width_checked: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_scrollable_frame.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15116
Entropy (8bit):	4.560932084397119
Encrypted:	false
SSDEEP:	192:/dOakxakYORkNkqgbZ4aOTxoNiTuOD9zKh:/dOakxakYaZpmq
MD5:	4AD5FFE06DDAD41EB933DB8990795D53
SHA1:	3B0666692EC5E1065484F6422E047D99CD092B1A
SHA-256:	BD167E92A7A7D29D7FD8F740D92C2B5719D1D6BA00086DAD7185A8152116E43B
SHA-512:	F1747B2B0EED8D8757B37064928CA9D12143EF9BF34C0555C9673717FEE9781E6BE78E6E905BC812B9553B3E1E66675BEE4E648E8C51027EBC2DC7F0DF7BF43D
Malicious:	false
Preview:	from typing import Union, Tuple, Optional.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal.import tkinter.import sys..from .ctk_frame import CTkFrame.from .ctk_scrollbar import CTkScrollbar.from .appearance_mode import CTkAppearanceModeBaseClass.from .scaling import CTkScalingBaseClass.from .core_widget_classes import CTkBaseClass.from .ctk_label import CTkLabel.from .font import CTkFont.from .theme import ThemeManager...class CTkScrollableFrame(tkinter.Frame, CTkAppearanceModeBaseClass, CTkScalingBaseClass):. def __init__(self,. master: any,. width: int = 200,. height: int = 200,. corner_radius: Optional[Union[int, str]] = None,. border_width: Optional[Union[int, str]] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Opti

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_scrollbar.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13856
Entropy (8bit):	4.368884054796356
Encrypted:	false
SSDEEP:	96:kFfO47NdJwJuJtJMpXiRGMUxg2Y2QEr8w8ABr28DK8owkwGBibDDB+M8u8BvBxFZ:kNNOYXCp6IHXAuWtDLjh3Yw
MD5:	83F92CE68C240053894C74EF2D4C5B59
SHA1:	F52634DD2252642F1859DF2E9A8F7180140C4B2F
SHA-256:	92AD12A65A8CEF8C6C06A5F5E76B3DFFBB7C6986029A394AA4727241089C600F
SHA-512:	FEB75FD00E39CECE478D77BFE042AD2D8A11A4C54461AE5481DB50223CF6552C1E768D5EC11B8CFA472E2687CEB5DA26BF22367609543B246EFEB2AE514B2AE7
Malicious:	false
Preview:	import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass...class CTkScrollbar(CTkBaseClass):. """. Scrollbar with rounded corners, configurable spacing.. Connect to scrollable widget by passing .set() method and set command attribute.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: Optional[Union[int, str]] = None,. height: Optional[Union[int, str]] = None,. corner_radius: Optional[int] = None,. border_spacing: Optional[int] = None,. minimum_pixel_length: int = 20,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. button_color: Optional[Union[str, Tu

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_segmented_button.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	19712
Entropy (8bit):	4.422200952233737
Encrypted:	false
SSDEEP:	192:4Ovgm1N8P5k7DGzJCzYBYX1yHMgYJEzwR:4Ovgm1N8PAOyOW1yH0v
MD5:	0608AA71F7C0D88702060415359A29E4
SHA1:	6F88BD8DA1738E89BC4D1DF54F3238A1F1305AF0
SHA-256:	1E39596CFA08472C0BA89ABBA0D0715487FAAE1D4EC3D07D92D042F98FA4733C
SHA-512:	F5C118ABBA968AFDF0F1859954DEE97CA26DCF3669B55C61279D2C92BE5C7E42DD34A9D21D7CD05774ADC5230311FF600FE4AF15EA125672F3C168D80539A002
Malicious:	false
Preview:	import tkinter.import copy.from typing import Union, Tuple, List, Dict, Callable, Optional.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal..from .theme import ThemeManager.from .font import CTkFont.from .ctk_button import CTkButton.from .ctk_frame import CTkFrame...class CTkSegmentedButton(CTkFrame):. """. Segmented button with corner radius, border width, variable support.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 140,. height: int = 28,. corner_radius: Optional[int] = None,. border_width: int = 3,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. selected_color: Optional[Union[str, Tuple[str, str]]] = None,. selected_hover_color: Optional[Union[str,

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_slider.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	18308
Entropy (8bit):	4.323410791193899
Encrypted:	false
SSDEEP:	96:EFh7KJwJZJEJuJtJEI2X0iw1EGc1Jo1Fx152Y1XY1P1x1WcvQqMEfDBK8DK8c115:E+OjCYXKEnW+xnwNLBV8gWJGQujRo
MD5:	8C74C3085C6DF7B7D414279DB39BE9F8
SHA1:	65497FA74918AA227A0A5410856F6C73CBF0C34F
SHA-256:	D7D96DE8711CA82935B96C1BCB78FAB81A6550EF6AD60DE04C6D4045B63735E6
SHA-512:	C264253D66659DD611435D70DC6F8062140D2B371A88B60F93B54F04A69A9C9F67545C9ACF228D2D3F61E12B13A4A3850A6FD92730C0B719C96CAEE6BF7BDA85
Malicious:	false
Preview:	import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass...class CTkSlider(CTkBaseClass):. """. Slider with rounded corners, border, number of steps, variable support, vertical orientation.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: Optional[int] = None,. height: Optional[int] = None,. corner_radius: Optional[int] = None,. button_corner_radius: Optional[int] = None,. border_width: Optional[int] = None,. button_length: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Union[str, Tupl

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_switch.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23416
Entropy (8bit):	4.2892154097672615
Encrypted:	false
SSDEEP:	192:EuOjCYXN84ciSBv7L1/1GllIni/MvWueQGm:EuOjCYXN8N1/1GlpU
MD5:	A7D1C05E2E551C8AFE083C675BAFA5D8
SHA1:	53A622DCB79119C34817F9E5C32FDA83E8E5D772
SHA-256:	50FE57164ADB3E5B67E9E6372252A128B10CE49AAB230C964E5CE950E82A10AF
SHA-512:	1FA868B4731428C343ADAFA36123703EE3AE948F3C5F68071F46C6D6625A87B2F941725A6125FA6427F00E6E593AFD7841CD02FCAFB4FB9F58C6B0B1E638CC8C
Malicious:	false
Preview:	import tkinter.import sys.from typing import Union, Tuple, Callable, Optional..from .core_rendering import CTkCanvas.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont...class CTkSwitch(CTkBaseClass):. """. Switch with rounded corners, border, label, command, variable support.. For detailed information check out the documentation.. """.. def __init__(self,. master: any,. width: int = 100,. height: int = 24,. switch_width: int = 36,. switch_height: int = 18,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,. button_length: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,. border_color: Union[str, Tu

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_tabview.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17700
Entropy (8bit):	4.336974833536321
Encrypted:	false
SSDEEP:	96:ES8hcJwJkJrJfJwJ2JlJBJIRJXXcGuruqipYEAcMCIYunDKjR8EK8w23GKCyTp+q:fOaVR6Uz38zXH4t3e8pBC
MD5:	66BE61C1AE0F854DE5D8AE0890A1EAAA
SHA1:	13FE9C090160793AF59F85014ED7E57E3475F6B5
SHA-256:	9F1AE7E68A319DD707196152EC4469C7E2BB3C46B8D7BD621A34BC707258CEC8
SHA-512:	4AB5C4EB40A6478B4796A4ACB687A397B2804224C48B6EC43FE1A93F28501B8D3503170DEDB2E1875ED11DEACB6BD8DA199C0F83690723805DA39B434F72129C
Malicious:	false
Preview:	import tkinter.from typing import Union, Tuple, Dict, List, Callable, Optional..from .theme import ThemeManager.from .ctk_frame import CTkFrame.from .core_rendering import CTkCanvas.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .ctk_segmented_button import CTkSegmentedButton...class CTkTabview(CTkBaseClass):. """. Tabview.... For detailed information check out the documentation.. """.. _top_spacing: int = 10 # px on top of the buttons. _top_button_overhang: int = 8 # px. _button_height: int = 26. _segmented_button_border_width: int = 3.. def __init__(self,. master: any,. width: int = 300,. height: int = 250,. corner_radius: Optional[int] = None,. border_width: Optional[int] = None,.. bg_color: Union[str, Tuple[str, str]] = "transparent",. fg_color: Optional[Union[str, Tuple[str, str]]] = None,.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\ctk_textbox.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24566
Entropy (8bit):	4.443682403341899
Encrypted:	false
SSDEEP:	192:ScphOaNYyFIT0SI08+/H+NP3EEp4mFDTe3mVFIIhu6m4:frOaNYydqex35lta3mV2Ihuy
MD5:	E296A878640A08951903328EE82AF3B6
SHA1:	6878368DDF3222F23C220B3F3A3E9207FD8BCC41
SHA-256:	FC39AB015BCF0B5C0BB815E961AE7289556E9285CC2492AC065CF5F9F8041C73
SHA-512:	81AA47FFBE5F40B679967F860A8C51B64C71491565E675D9D9B4F5115915C4C844D27F8F41995CCAA7555CD68D6628015860A5BCC182B822EF00ADC5ECB20BEB
Malicious:	false
Preview:	import tkinter.from typing import Union, Tuple, Optional, Callable..from .core_rendering import CTkCanvas.from .ctk_scrollbar import CTkScrollbar.from .theme import ThemeManager.from .core_rendering import DrawEngine.from .core_widget_classes import CTkBaseClass.from .font import CTkFont.from .utility import pop_from_dict_by_set, check_kwargs_empty...class CTkTextbox(CTkBaseClass):. """. Textbox with x and y scrollbars, rounded corners, and all text features of tkinter.Text widget.. Scrollbars only appear when they are needed. Text is wrapped on line end by default,. set wrap='none' to disable automatic line wrapping.. For detailed information check out the documentation... Detailed methods and parameters of the underlaying tkinter.Text widget can be found here:. https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html. (most of them are implemented here too). """.. _scrollbar_update_time = 200 # interval in ms, to check if scrollbars are needed..

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\font\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	4.72180420551579
Encrypted:	false
SSDEEP:	24:ZWdFq6YCyGZga9i+a7c+azEWp+axbqKUddEZTF9y6h3iTqT:ZDgyGZga9ZizbWgeWlox90eT
MD5:	1217381B00226D289C9087B60D89020B
SHA1:	33B904549147621E3009DBA7F2D5FF4963D939AF
SHA-256:	CD8952B091FEF2B2FBEEDEDD933D2F5CEA1F1E1F0D76222E3102B857C99F20D3
SHA-512:	73C65C0BD0F2C1C2C21C8D04EB8D1DC7D4252B9D4D626373930DADCE9143063EC5082A7CB99D62B4A2EC25BAFBF4A05BE79375F134BFFD944C0F7EC4E10FF901
Malicious:	false
Preview:	import os.import sys..from .ctk_font import CTkFont.from .font_manager import FontManager..# import DrawEngine to set preferred_drawing_method if loading shapes font fails.from ..core_rendering import DrawEngine..FontManager.init_font_manager()..# load Roboto fonts (used on Windows/Linux).customtkinter_directory = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))).FontManager.load_font(os.path.join(customtkinter_directory, "assets", "fonts", "Roboto", "Roboto-Regular.ttf")).FontManager.load_font(os.path.join(customtkinter_directory, "assets", "fonts", "Roboto", "Roboto-Medium.ttf"))..# load font necessary for rendering the widgets (used on Windows/Linux).if FontManager.load_font(os.path.join(customtkinter_directory, "assets", "fonts", "CustomTkinter_shapes_font.otf")) is False:. # change draw method if font loading failed. if DrawEngine.preferred_drawing_method == "font_shapes":. sys.stderr.write("customtkinter.windows.widgets.fon

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\font\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	5.526979451028274
Encrypted:	false
SSDEEP:	24:T482pn2OOfuQR5eZ+mxrJddEZ2F9ybhuiLxMX9ZptqulvDnJbh:faou+5eZ+Gr1ow9HExMtZpoqvDJbh
MD5:	A83EF756B9512630A175F9B60AB35343
SHA1:	C3117AB8B8A71400920DAE3BECCF76EE7C1DBB23
SHA-256:	0591277541DE1798D14CA984C519E874FEE3C08DA2B3DFF4A0B7926AE999FAA9
SHA-512:	EE7F342D9CF80E3814E43B160F5C96BF701CD0B9DB9E3DEEE75945E2ADE16862D6E44B85E415DD9D004750C70593809D4B1651ACFE4B7255135B2AED06716C18
Malicious:	false
Preview:	o.......).xd.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.......e.j...e.j...e.j...e.j...e.j...e...........Z.e...e.j...e.d.d.d.d.......e...e.j...e.d.d.d.d.......e...e.j...e.d.d.d.....d.u.rle.j.d.k.rne.j...d.....d.e._.d.S.d.S.d.S.)......N.....)...CTkFont)...FontManager.....)...DrawEngineZ.assetsZ.fontsZ.Robotoz.Roboto-Regular.ttfz.Roboto-Medium.ttfz.CustomTkinter_shapes_font.otfFZ.font_shapesz.customtkinter.windows.widgets.font warning: Preferred drawing method 'font_shapes' can not be used because the font file could not be loaded..Using 'circle_shapes' instead. The rendering quality will be bad!.Z.circle_shapes)...os..sysZ.ctk_fontr....Z.font_managerr....Z.core_renderingr....Z.init_font_manager..path..dirname..abspath..__file__Z.customtkinter_directoryZ.load_font..joinZ.preferred_drawing_method..stderr..write..r....r.....wC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/font/__init__.py..<mo

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\font\pycache\ctk_font.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3874
Entropy (8bit):	5.3527610764973454
Encrypted:	false
SSDEEP:	48:eHJCcNlKLc4jKtqoiu5UJD1cQYD4t4n4LaeY6GL9YLOhmPsxvad7/PH:eHJCgKY0ciukD1mf4QPxYLOgPsSxPH
MD5:	657895DE104E1DFE5CA64AE846DF6810
SHA1:	D2A4EA0C2234375574A51162763AB9C1F55D1A47
SHA-256:	7ED1C62E10E1D64AECEA297D204DF1568D99A4554E240D21E200609E7538FC29
SHA-512:	D286236F21145173D6B46B09A5D3BDDFEB29FDF2F2C44826A5D4E0EEF4FBEA1ACD0BA7BDFD7ED4FC20A37C92C381861E4BF4E8D8CA35839373AC60E8F06D226E
Malicious:	false
Preview:	o.......).xd.........................@...s\|...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y-......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...FontN)...List..Callable..Tuple..Optional)...Literal.....)...ThemeManagerc........................s....e.Z.d.Z.d.Z.............d!d.e.e...d.e.e...d.e.d...d.e.d...d.e.d.e.f...f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.d.e.e.e.e.f...f.d.d...Z.d.d...Z...f.d.d...Z.d.e.d.e.f...f.d.d...Z.d"d.d ..Z.....Z.S.)#..CTkFonta..... Font object with size in pixel, independent of scaling.. To get scaled tuple representation use create_scaled_tuple() method... family.The font family name as a string.. size.The font height as an integer in pixel.. weight.'bold' for boldface, 'normal' for regular weight.. slant.'italic' for italic, 'roman' for unslanted.. underline.1 for underlined text, 0 for normal.. overstrike.1 for overstruck text, 0 for normal... Tkinter Font: https://anzeljg.github.io/rin2/book2/24

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\font\pycache\font_manager.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2219
Entropy (8bit):	5.494873760795154
Encrypted:	false
SSDEEP:	48:vrNy9IcId+Yc7pGDHhAKM1hZ2ZaGgl6RWumDshvdRNRZQ9V8dt:J+YHBA11bQ9Rdm4hvrN8D8dt
MD5:	3E928465EC07ACC145F18C37418D23DF
SHA1:	B3ED9DE2867A8AA3E74F18450E35CC1E7723DEAF
SHA-256:	14C5D1F44880B2475F2C331C034BCFEC002CF9025DFEBE6C0294A9000778F7FB
SHA-512:	6003859C6C8B23332569C608C566D8092F1B817CB211427C9A2880732E26C41822DC157F405EA1A8DB012B0B262A212646F2BC57A34507681302C2E733C9FC16
Malicious:	false
Preview:	o.......).xd.........................@...s6...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.d.S.)......N)...Unionc....................@...sZ...e.Z.d.Z.d.Z.e.d.d.....Z.e.d.d.e.e.e.f...d.e.d.e.d.e.f.d.d.....Z.e.d.e.d.e.f.d.d.....Z.d.S.)...FontManagerz.~/.fonts/c....................C...s....t.j...d...r>z.t.j...t.j...\|.j.....s.t...t.j...\|.j.......W.d.S...t.y=..}...z.t.j...d.t.\|.....d.......W.Y.d.}.~.d.S.d.}.~.w.w.d.S.).N..linuxT..FontManager error: ...F)...sys..platform..startswith..os..path..isdir..expanduser..linux_font_path..mkdir..Exception..stderr..write..str)...cls..err..r.....{C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/font/font_manager.py..init_font_manager....s..........................z.FontManager.init_font_managerTF..font_path..private..enumerable..returnc....................C...s....d.d.l.m.}.m.}.m.}.m.}...d.}.d.}.t.\|.t...r.\|.\|...}.\|.j.j.}.n.t.\|.t...r,\|.\|...}.\|.j.j.}.n.t.d.....\|.r4\|.n.d.\|.s9\|.n.d.B.}.\|.\|.\|...\|.d..

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\font\ctk_font.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	4.6136808628861585
Encrypted:	false
SSDEEP:	96:YzcYbLHLqLGw2mkGFkbFfbhN0VlGSDb3Tu1:AbriGw27Gib9UHGSDb3Tu1
MD5:	8D7B56F87315A79919D6E4DF5E046672
SHA1:	820AC45EB8E11D2527BC326EAF954DD71384B7CF
SHA-256:	88C87D369CC1979571A6DFB705423AAA7DCA11EE8E53941E1CE38D76FD3A2F1B
SHA-512:	62EE9013AF66BEFCC6A023D4599B1BF9B04A5ABED413F82A9496036B41D5704CDF108526C56AC8611F16AE5E8507CDEE5F46DB28018D796A4D61DD973EE3FE87
Malicious:	false
Preview:	from tkinter.font import Font.import copy.from typing import List, Callable, Tuple, Optional.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal..from ..theme import ThemeManager...class CTkFont(Font):. """. Font object with size in pixel, independent of scaling.. To get scaled tuple representation use create_scaled_tuple() method... family.The font family name as a string.. size.The font height as an integer in pixel.. weight.'bold' for boldface, 'normal' for regular weight.. slant.'italic' for italic, 'roman' for unslanted.. underline.1 for underlined text, 0 for normal.. overstrike.1 for overstruck text, 0 for normal... Tkinter Font: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html. """.. def __init__(self,. family: Optional[str] = None,. size: Optional[int] = None,. weight: Literal["normal", "bold"] = None,. slant: Litera

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\font\font_manager.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2268
Entropy (8bit):	4.554633557295692
Encrypted:	false
SSDEEP:	48:k7ovB8Sx68Fdt1rH22ZaGg8JKqBzE16ykAgyevuKfpgQSCprFdJP:k+B8T8J1rH2QAqBo1PPCuKBgQd5x
MD5:	6D903A86D2C8D5E27DA5CA8592EF6507
SHA1:	1E219345E695FD811615C5FD7F37438BFC5191CB
SHA-256:	8F0A6EEB5674D27A2AD1459C15A1DFB40311BD78262901C4990883ABE0ABA8DC
SHA-512:	E78FA637B1F7EB3BD15DDBD5F7E6BFD2DE5928D61A02FD15ED8781C4F362D830695FEE2A59ECEE5ADEB8077A16D1863AC63E667C9F6E92248408619AF723D770
Malicious:	false
Preview:	import sys.import os.import shutil.from typing import Union...class FontManager:.. linux_font_path = "~/.fonts/".. @classmethod. def init_font_manager(cls):. # Linux. if sys.platform.startswith("linux"):. try:. if not os.path.isdir(os.path.expanduser(cls.linux_font_path)):. os.mkdir(os.path.expanduser(cls.linux_font_path)). return True. except Exception as err:. sys.stderr.write("FontManager error: " + str(err) + "\n"). return False.. # other platforms. else:. return True.. @classmethod. def windows_load_font(cls, font_path: Union[str, bytes], private: bool = True, enumerable: bool = False) -> bool:. """ Function taken from: https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309#30631309 """.. from ctypes import windll, byref, create_unicode_buffer, create_string_buffer.. FR_PRIVATE =

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\image\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.101409765557392
Encrypted:	false
SSDEEP:	3:1LGJj+CKn:1Lm9Kn
MD5:	F5FFADF6FB333AD7009300C683004912
SHA1:	9BBF3490BBFD69F815D1043085E0639AD385CA47
SHA-256:	A736F0948015E0E13E0A4771248AE5D442DC460EEF6D02A40BA1DA1CB183348F
SHA-512:	F5DD84862DEB63F5DDA9FA5441EF9745C82E5B9F916FFEB9B39FC15EE3037791E8A3AFAE65F7E30458AA4896A30BDBE29C2DDF663D22C6213D6659B1C70C9E99
Malicious:	false
Preview:	from .ctk_image import CTkImage.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\image\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	255
Entropy (8bit):	4.983746669617539
Encrypted:	false
SSDEEP:	6:y/WIr0e1/QCFOMgNyxn23d6ZUArsNNJSS5D0:C+e9QYMI2JN5D0
MD5:	D883460756422CFA5580540F5BAEA075
SHA1:	7A91603D4FD29FBF9501761CC342F7315933FD40
SHA-256:	0D33788BDC9652F9275C83C49EC63278E13C2D20A594A425B5C0C07092A9B8A3
SHA-512:	E6968DC08B9D0B6EE129D12F8F9AF6151319D780E035664BE0A8DC518462D9C02C744A085639D4AC78E49902935DA5493A02F2D7B210A34C1CC527B90980FC6E
Malicious:	false
Preview:	o.......).xd ........................@...s....d.d.l.m.Z...d.S.)......)...CTkImageN).Z.ctk_imager......r....r.....xC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/image/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\image\pycache\ctk_image.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4462
Entropy (8bit):	5.312049882788875
Encrypted:	false
SSDEEP:	48:aUJ5M0XlGWt4yG/rE1yG5yqzDxBGWufIuRxtuR+iGQInfQ4fT7G3TG2tuTxXLwVc:a65rXlGqLurIv5F3xXQULGoITRgPtUR
MD5:	D1722B989F56E1D2EF83F2F883335819
SHA1:	0EA297B062FBA5B2583D1487DADB32875F1B8FE1
SHA-256:	2D6A7B9E6B63E27D400577B1EDEE1EF4C8A481299FF0E5FCC89240B0C197FC5D
SHA-512:	730A3652C6C0A887CD1A1993B037079B3597E69541159698DFD7D60EAF652095DFCC307053A58ED43687330019DCB28776706675B4E90ADB4A73E91F2B36E65C
Malicious:	false
Preview:	o.......).xd.........................@...sR...d.d.l.m.Z.m.Z.m.Z.m.Z...z.d.d.l.m.Z.m.Z...W.n...e.y.......Y.n.w.G.d.d...d...Z.d.S.)......)...Tuple..Dict..Callable..List)...Image..ImageTkc....................@...s....e.Z.d.Z.d.Z.d.Z.......d&d.d.d.d.d.e.e.e.f...f.d.d...Z.e.d.d.....Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.d...Z.d.e.d.e.f.d.d...Z.d.d...Z.d.e.d.e.e.e.f...f.d.d...Z.d.e.e.e.f...d.d.f.d.d ..Z.d.e.e.e.f...d.d.f.d!d"..Z.d.e.d#e.d.d.f.d$d%..Z.d.S.)'..CTkImageaY.... Class to store one or two PIl.Image.Image objects and display size independent of scaling:.. light_image: PIL.Image.Image for light mode. dark_image: PIL.Image.Image for dark mode. size: tuple (<width>, <height>) with display size for both images.. One of the two images can be None and will be replaced by the other image.. FN.......r......light_imagez.Image.Image..dark_image..sizec....................C...s>...\|.j.s.\|.......\|.\|._.\|.\|._.\|.......\|.\|._.g.\|._.i.\|._.i.\|._.d.S...N)..._checked_PIL_import.._check_pil_imp

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\image\ctk_image.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5306
Entropy (8bit):	4.5619072078694565
Encrypted:	false
SSDEEP:	96:3JBLur+hdR7FqVFf97bISTEEhA3hLLXUV:Ms7kVhJTErh8
MD5:	4BC2952539F8DFB4B35BBE26565AF2A1
SHA1:	CA21C9A364609BB34A93DE732D82E5A1B63162FB
SHA-256:	B8BFE826B96AF19D77E2A8E28A2E382E0D37BAD11349FEEB049EA480F1DE6339
SHA-512:	6C490C3772D8BF106BDAE17B2CAF205322CDEF05F148A959F2E19407E53025BD15F9DA2F141F51E72215C9A93331219562E66137224D5356B7CC6465F1629FD2
Malicious:	false
Preview:	from typing import Tuple, Dict, Callable, List.try:. from PIL import Image, ImageTk.except ImportError:. pass...class CTkImage:. """. Class to store one or two PIl.Image.Image objects and display size independent of scaling:.. light_image: PIL.Image.Image for light mode. dark_image: PIL.Image.Image for dark mode. size: tuple (<width>, <height>) with display size for both images.. One of the two images can be None and will be replaced by the other image.. """.. _checked_PIL_import = False.. def __init__(self,. light_image: "Image.Image" = None,. dark_image: "Image.Image" = None,. size: Tuple[int, int] = (20, 20)):.. if not self._checked_PIL_import:. self._check_pil_import().. self._light_image = light_image. self._dark_image = dark_image. self._check_images(). self._size = size.. self._configure_callback_list: List[Callable] = []. self._scaled_ligh

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	287
Entropy (8bit):	4.778729031604742
Encrypted:	false
SSDEEP:	6:kyByUI6YBLA6DDxyC6H8UZuewRAcc2cDfosPAKOLUvGUZeawfrov:kyYZtL3DIC6cqz1bD4K8gwfra
MD5:	F8FF5F614E2A57680C5B09CBB1EFE99A
SHA1:	9E99B989470C8182B65F32857823AB7A4B5E410C
SHA-256:	D868DE1B6FC0E20ABC83BA5138A3F0E904769881FB6FA8910D0BD3DBAAB3F11E
SHA-512:	4E558E7B1D38CD1CF5D6117CC6021B710649841197DFC3801594FDD4655BB5938EC0B603FCB81A17C914CBD24BBF975CFBC3C49C2B6D78848A7E26C125C0806B
Malicious:	false
Preview:	import sys..from .scaling_base_class import CTkScalingBaseClass.from .scaling_tracker import ScalingTracker..if sys.platform.startswith("win") and sys.getwindowsversion().build < 9000: # No automatic scaling on Windows < 8.1. ScalingTracker.deactivate_automatic_dpi_awareness = True.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	492
Entropy (8bit):	5.3314015173990175
Encrypted:	false
SSDEEP:	12:C262Z011rySV/SJ5HyOmssiPKZ6swfgWzI2JNMcDh:le11DkJ5SI1SZ6sYg2DnMC
MD5:	80C6A0D81611C82826AF9DFE13213595
SHA1:	6D1A7DADDF9ABB82F062EE02032017357DF7BFE4
SHA-256:	C1362EBBAE9B7FD03D0E80F80B7D83540C47FEFB4B039C4E5C49946862441288
SHA-512:	3C75D7112A2783C98DC0A96B5B12826DB140A6FBDEEE9419825BAC9D1CD360438E801CCEA69F72593EFEA19D2537B4E2108B5FD3B26684C2955126DC70918E5D
Malicious:	false
Preview:	o.......).xd.........................@...sL...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j...d...r"e.....j.d.k.r$d.e._.d.S.d.S.d.S.)......N.....)...CTkScalingBaseClass)...ScalingTracker..wini(#..T)...sysZ.scaling_base_classr....Z.scaling_trackerr......platform..startswith..getwindowsversion..buildZ"deactivate_automatic_dpi_awareness..r....r.....zC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/scaling/__init__.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling\pycache\scaling_base_class.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6440
Entropy (8bit):	5.382925465632151
Encrypted:	false
SSDEEP:	96:yJIyP84paoddkbH6R0iQNJjgBesVlnGD1nEDC8buXGPIbHFtbH4bHpgSDXLisvJV:G84pE5NJjh8AvRDyqSnme+s
MD5:	A5765AEC4C666F3B4E5C2AC873AC7855
SHA1:	FC63BC2BCED6FDC1208E1B6F3EE0DB093905E3F7
SHA-256:	BB0410D2796AC438C2B89651A3BAA124CFBA418480FB7F086AABC3CE7E0AB32B
SHA-512:	C6A5AA698C83C95F14073AD78F411575362C4FF2291DFD8C3CC551BE486451F3422DBE5E3ECA28853FA4BF9E74D686E4E1C4AF98FCF99E48A2B04FAD6999061B
Malicious:	false
Preview:	o.......).xd.........................@...sz...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y'......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.S.)......)...Union..TupleN)...Literal.....)...ScalingTracker.....)...CTkFontc....................@...s&...e.Z.d.Z.d.Z.d)d.e.d...f.d.d...Z.d.d...Z.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.e.e.f...d.e.e...f.d.d...Z.d.e.e.e.f...d.e.e...f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.e.d e.d.e.f.d!d"....Z.d e.d.e.f.d#d$..Z.d%e.d.e.f.d&d'..Z.d(S.)*..CTkScalingBaseClassaa.... Super-class that manages the scaling values and callbacks.. Works for widgets and windows, type must be set in init method with. scaling_type attribute. Methods:.. - _set_scaling() abstractmethod, gets called when scaling changes, must be overridden. - destroy() must be called when sub-class is destroyed. - _apply_widget_scaling(). - _reverse_widget_scaling(). - _apply_window_s

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling\pycache\scaling_tracker.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	5.283382581037849
Encrypted:	false
SSDEEP:	96:3F7rL4SPZuw+DLrtyXmcyF5e50Hg7M83ZYMT7HayfEI+uoCbLGknMRPJIUo592K9:ZzZZQpbtHgwsZh9fmRCGkna1iOAN83le
MD5:	5C83864413CD623C2B58F10AA1E926AA
SHA1:	2AF5E377D34ACA5E5FDB3766329749FE1494CEE6
SHA-256:	D0565A759E0D7A6A1DA4183EDBC69DE7348AB774B30D6A0630594F9C1F549EEF
SHA-512:	64652E1E8AD4A3055A57856793A0D05A832AB96DD7AA387403EDECEFCB7EEDF8B073E148758155EC0DC002748616BAB79F42E4E901D1F7D878B2E31408DB2296
Malicious:	false
Preview:	o.......).xd)".......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.d.S.)......N)...Callablec....................@...s....e.Z.d.Z.d.Z.i.Z.i.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.e.f.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d ....Z.e.d.e.f.d!d"....Z.e.d#d$....Z.d%S.)&..ScalingTrackerF......d...i......returnc....................C........\|...\|...}.\|.j.\|...\|.j...S...N)...get_window_root_of_widget..window_dpi_scaling_dict..widget_scaling)...cls..widget..window_root..r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/scaling/scaling_tracker.py..get_widget_scaling.............z!ScalingTracker.get_widget_scalingc....................C...r....r....).r....r......window_scaling).r......windowr....r....r....r......get_window_scaling....r....z!ScalingTracker.get_window_scaling..widget_scaling_factorc...................

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling\scaling_base_class.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7060
Entropy (8bit):	4.665375963721016
Encrypted:	false
SSDEEP:	96:OEaoddkbH69gRWkSpWVj6i8RpiDzGbHu8L6xiOfu8EvJ71Sj7vVAvZR8vkRlP:BEn0V3J71cxaft
MD5:	121A95D8CDC15C00C91404FC96855B34
SHA1:	80BA7033362304FDC22F3B5B1D624F0E9C0FC626
SHA-256:	55BCF303D18FBA33986C42630EC4119EFA18EAFED14A2B59C2BDFB95902493FF
SHA-512:	6A0D7EF54D9AF4D5A466E9F813E6BA07F6DD8C65AFB11C6D6A9477DEFAFB63246665D3403FC10DD3B9FD7D156ABFB0C5FF1B2A640466ECC8AD190E4F9E86DE6E
Malicious:	false
Preview:	from typing import Union, Tuple.import copy.import re.try:. from typing import Literal.except ImportError:. from typing_extensions import Literal..from .scaling_tracker import ScalingTracker.from ..font import CTkFont...class CTkScalingBaseClass:. """. Super-class that manages the scaling values and callbacks.. Works for widgets and windows, type must be set in init method with. scaling_type attribute. Methods:.. - _set_scaling() abstractmethod, gets called when scaling changes, must be overridden. - destroy() must be called when sub-class is destroyed. - _apply_widget_scaling(). - _reverse_widget_scaling(). - _apply_window_scaling(). - _reverse_window_scaling(). - _apply_font_scaling(). - _apply_argument_scaling(). - _apply_geometry_scaling(). - _reverse_geometry_scaling(). - _parse_geometry_string().. """. def __init__(self, scaling_type: Literal["widget", "window"] = "widget"):. self.__scaling_type = scaling_type..

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\scaling\scaling_tracker.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8745
Entropy (8bit):	4.46611971013542
Encrypted:	false
SSDEEP:	96:ED5H48qEo5nWSG6UfGQXkSRydC1RbnmNej2u8LAtN0YzUlzktIuDEBIEB:El3cHUf7XkddARbW08LAttzUlBuwBVB
MD5:	5ADAC9A94E921B8D2729FF3FDB9C5340
SHA1:	B10940AAFEFE204ADA7DE8D34F471470288B011C
SHA-256:	72E8A55C47924CECA580344D7F6921F9E0D04A1BA9FA2D8D73BA0E70BA3756DC
SHA-512:	915493CAFCCD77041B13F3F3507EF2CAA24FEB98A9F6DB377DB67AA3A66C83E12A02015E90CED69EF421B319A0A05D0AF72678393E8BFAAD027B8C2BF700B880
Malicious:	false
Preview:	import tkinter.import sys.from typing import Callable...class ScalingTracker:. deactivate_automatic_dpi_awareness = False.. window_widgets_dict = {} # contains window objects as keys with list of widget callbacks as elements. window_dpi_scaling_dict = {} # contains window objects as keys and corresponding scaling factors.. widget_scaling = 1 # user values which multiply to detected window scaling factor. window_scaling = 1.. update_loop_running = False. update_loop_interval = 100 # ms. loop_pause_after_new_scaling = 1500 # ms.. @classmethod. def get_widget_scaling(cls, widget) -> float:. window_root = cls.get_window_root_of_widget(widget). return cls.window_dpi_scaling_dict[window_root] * cls.widget_scaling.. @classmethod. def get_window_scaling(cls, window) -> float:. window_root = cls.get_window_root_of_widget(window). return cls.window_dpi_scaling_dict[window_root] * cls.window_scaling.. @classmethod. def set

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\theme\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	471
Entropy (8bit):	4.662469420102873
Encrypted:	false
SSDEEP:	12:1XB9iJkTi+72Mj5C0Tx0uvHKVOXFCNUqormAOXX:12u2LYPTx0uc43tqA4X
MD5:	2084248A69E54AEBB11565EA3A962262
SHA1:	0A20ABD2C4274E5C6FC3CA4066580F74943EB9A7
SHA-256:	899E93E8EFAFDFD84E2DF4CBB8D6D32EDD1703FADA098B71C069E6A8D0762E69
SHA-512:	B613F37D583AAA72B76820EC740FEE47CA0EE5DF0AEE33E490C717F25E903BB4FAC03B7D786423F3FF9EC2CF91D79280652EB6E60C720FA796EAD1F32775A950
Malicious:	false
Preview:	from .theme_manager import ThemeManager..# load default blue theme.try:. ThemeManager.load_theme("blue").except FileNotFoundError as err:. raise FileNotFoundError(f"{err}\nThe .json theme file for CustomTkinter could not be found.\n" +. f"If packaging with pyinstaller was used, have a look at the wiki:\n" +. f"https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exe").

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\theme\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	612
Entropy (8bit):	5.535745356249021
Encrypted:	false
SSDEEP:	12:CaE6EWTrkF+3GxcJ/KVOXFCNcxormAOXuLUUo+dzI2JN96LQD4ArL:JA+3GxcJM4XmqA4U62Dn6qrL
MD5:	C2595C1C3D022A53595F245D6B95737E
SHA1:	5E42F833748FCB311F5C638F04CB26FFF32C7E90
SHA-256:	E25189D884434695546338D2DB4F6CBE728375BE06607290F6E76EFF27E55F05
SHA-512:	5CCA21224890D8FD29BA853277874C0B02114090558A7B9F04485A8558B98D93F3030DD2F8FBDEF217FA5A87E8EBB51D0914D5AEE6E4A12FE157C32DE11D7A50
Malicious:	false
Preview:	o.......).xd.........................@...sL...d.d.l.m.Z...z.e...d.....W.d.S...e.y%..Z...z.e.e...d...d...d.......d.Z.[.w.w.)......)...ThemeManager..bluez<.The .json theme file for CustomTkinter could not be found..zAIf packaging with pyinstaller was used, have a look at the wiki:.z`https://github.com/TomSchimansky/CustomTkinter/wiki/Packaging#windows-pyinstaller-auto-py-to-exeN).Z.theme_managerr....Z.load_theme..FileNotFoundError..err..r....r.....xC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/theme/__init__.py..<module>....s..........................

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\theme\pycache\theme_manager.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1838
Entropy (8bit):	5.411080646904243
Encrypted:	false
SSDEEP:	48:zawwdKNgSfzbZ8lxKDsXDQ5MBiL1vMP0sgbXb:TwY7wxjQ5Hy0fr
MD5:	64A61F884FE7977468E90EE4081E583C
SHA1:	27DE0BB1FE08894951B8AA7105F00FD96BB3791B
SHA-256:	4C29FB8D19F4663B6F3CDAB94931A614AEFB925D39C0797D01A14BF8B30B74E7
SHA-512:	08548711BCBAEDCAB22133A78629B02F9075531992B6C4B70B7EA5C036462BD67CCBBC60E51DE3E7C73B84D1971F7C46F56F0D1B8DD9630E099FC3EC0BE2AF79
Malicious:	false
Preview:	o.......).xdr........................@...sB...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...G.d.d...d...Z.d.S.)......N)...List..Unionc....................@...s`...e.Z.d.Z.U.i.Z.e.e.d.<.g.d...Z.e.e...e.d.<.d.Z.e.e.d.f...e.d.<.e.d.e.f.d.d.....Z.e.d.d.....Z.d.S.)...ThemeManager..theme)...blue..greenz.dark-blueZ.sweetkind.._built_in_themesN.._currently_loaded_theme..theme_name_or_pathc....................C...s2...t.j...t.j...t.....}.\|.\|.j.v.r=t...\|...j.j.j.}.t.t.j...\|.d.d.\|...d.....d.....}.t...\|...\|._.W.d.........n.1.s7w.......Y...n.t.\|.d.....}.t...\|...\|._.W.d.........n.1.sSw.......Y...\|.\|._.\|.j.....D.]6}.d.\|.j.\|.......v.r.t.j.d.k.r{\|.j.\|...d...\|.j.\|.<.q`t.j...d...r.\|.j.\|...d...\|.j.\|.<.q`\|.j.\|...d...\|.j.\|.<.q`d.S.).NZ.assets..themesz..json..r..macOS..darwin..win..Windows..Linux)...os..path..dirname..abspath..__file__r......pathlib..Path..parent..open..join..json..loadr....r......keys..sys..platform..startswith)...clsr....Z.script_directoryZ.customtkinter_path..f..key..r%....}C:\Users\dat

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\theme\theme_manager.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1906
Entropy (8bit):	4.384053703612958
Encrypted:	false
SSDEEP:	48:k9xlrll+gSOEoN9AJ0UnySg/pFKztgN+ASVS9jS58Siw:k9/rllAO0nf8KBgN+dAIviw
MD5:	EBE003D8A30B03A8A287DAF28BE7B64A
SHA1:	B228C656868988412964395368AE6A745ECF3D35
SHA-256:	EDCE6FF8A32B8C9DC00E21BA420E9283641F65973BE1CC09209377E688A46614
SHA-512:	421678401C731EDF8E0143C31E32B11FAFD52EA1F6742D2BCBB957B1964435F51AEFF0DD3F59318D1C15DAA44FFF765C94440C2D24AEF8B49DEEC2CD1B562269
Malicious:	false
Preview:	import sys.import os.import pathlib.import json.from typing import List, Union...class ThemeManager:.. theme: dict = {} # contains all the theme data. _built_in_themes: List[str] = ["blue", "green", "dark-blue", "sweetkind"]. _currently_loaded_theme: Union[str, None] = None.. @classmethod. def load_theme(cls, theme_name_or_path: str):. script_directory = os.path.dirname(os.path.abspath(__file__)).. if theme_name_or_path in cls._built_in_themes:. customtkinter_path = pathlib.Path(script_directory).parent.parent.parent. with open(os.path.join(customtkinter_path, "assets", "themes", f"{theme_name_or_path}.json"), "r") as f:. cls.theme = json.load(f). else:. with open(theme_name_or_path, "r") as f:. cls.theme = json.load(f).. # store theme path for saving. cls._currently_loaded_theme = theme_name_or_path.. # filter theme values for platform. for key in cls.theme.k

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\utility\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.398511114409896
Encrypted:	false
SSDEEP:	3:1LQRMC6ZNMXBSVo2MGR6Dz6Ao6v:1LA66Bmgan6v
MD5:	2BCBAB49EADEC63DE47AF34806EFA7EA
SHA1:	E5887D011B676349D15BEB6DB80BA58B58F48F37
SHA-256:	493B20390BD3840A146AB57DA2F33A338D1AADA4140CD53F4269876F231A471D
SHA-512:	B76A52096170EF9712F2539178C5BB432DCD61E81519C4AFB42B1766586A123CD50FCBBD2F616524F75C3BD097889EFD05689D07EF3D1B89A73AFF64DEE5CF67
Malicious:	false
Preview:	from .utility_functions import pop_from_dict_by_set, check_kwargs_empty.

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\utility\pycache\init.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	306
Entropy (8bit):	5.037235333176978
Encrypted:	false
SSDEEP:	6:y/WIol/ex4ZvhgxQn6L/Ev3q+uyxn23d6ZUArsNNJSS0ciDo:CSteyYQCEUI2JN0Do
MD5:	23E7D921F2554376D277E3F77397AE3E
SHA1:	95821CFA6D9BD4991000631DB38A590B24CCF195
SHA-256:	8E16F9A5E751D581FC1605FEF1EE171F8FD936B808F5C7E6A46EC0558333418A
SHA-512:	C574ADECE47287114C3B2BD2E4132FC4B53DC8C2D909E0F62F61DFA4D2EDE780FAA36F5218D5FAE76FC76D72501476FF7ADF27BB9186C2592C417F9380060234
Malicious:	false
Preview:	o.......).xdH........................@...s....d.d.l.m.Z.m.Z...d.S.)......)...pop_from_dict_by_set..check_kwargs_emptyN).Z.utility_functionsr....r......r....r.....zC:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/utility/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\utility\pycache\utility_functions.cpython-310.pyc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	975
Entropy (8bit):	5.235090033577134
Encrypted:	false
SSDEEP:	24:GsqiHdSZLBZDn9uQBoGVeBcQm38wAYhe0IhWV:HqmAZnD9u/8eBcQmsOvn
MD5:	CA35193A6596590871E07F50EF2C70DA
SHA1:	1E02AECE9BCEFF272AE6743EA5C7F24568E2218E
SHA-256:	C7E4AA8B15F9A10D84FA5365638E31E66BCA89B797154ECB78C85A955DF817D8
SHA-512:	6B3AA9CC49E7DABEFD85E831F7B24540A9B76E1D1251560E88F7A90D5EFDF03BA446D9F11B601E486A2F5A01B5A54125B71F11A4A750449C33E3E9C3EDDDD32D
Malicious:	false
Preview:	o.......).xd.........................@...s*...d.e.d.e.d.e.f.d.d...Z.d.d.e.f.d.d...Z.d.S.)...dictionary..valid_keys..returnc....................C...s0...i.}.t.\|.......D.].}.\|.\|.v.r.\|...\|...\|.\|.<.q.\|.S.).z[ remove and create new dict with key value pairs of dictionary, where key is in valid_keys )...list..keys..pop).r....r....Z.new_dictionary..key..r......C:\Users\datun\AppData\Local\Programs\Python\Python310\Lib\site-packages\customtkinter/windows/widgets/utility/utility_functions.py..pop_from_dict_by_set....s................r....Fc....................C...s....t.\|...d.k.r.\|.r.t.t.\|.........d.......d.S.d.S.).zN returns True if kwargs are empty, False otherwise, raises error if not empty .....zP are not supported arguments. Look at the documentation for supported arguments.TF)...len..ValueErrorr....r....).Z.kwargs_dictZ.raise_errorr....r....r......check_kwargs_empty....s..............r....N).F)...dict..setr......boolr....r....r....r....r......<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\utility\utility_functions.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	766
Entropy (8bit):	4.463169082971207
Encrypted:	false
SSDEEP:	12:8Mf8ujS53n2yKfdTfOq5syKGDVHQwK5MDB+jpNQAe648wjBPMjUUX6gBlm36uX/m:8YSZZIdjOqiy3DCw8GAVeBbTUKgnm3ve
MD5:	63C5279B2AFA10D8416E96ABD788B6A5
SHA1:	51DF4126B656806C4AF168CCC048B3B3A7B87EAD
SHA-256:	7745A3E408A8C616F7AAD0B4213B8D6478F07C51DE8147CAF9B7E40D7AEBB9F9
SHA-512:	C5D6BB05DD0C14C8ED47F4B7CBC4ADCD622F55389C669940A5ED11706CDA3E42536542B5E900E16E39A5708BE3122DEA1151D0E188CD161CD97FB5D110452A28
Malicious:	false
Preview:	.def pop_from_dict_by_set(dictionary: dict, valid_keys: set) -> dict:. """ remove and create new dict with key value pairs of dictionary, where key is in valid_keys """. new_dictionary = {}.. for key in list(dictionary.keys()):. if key in valid_keys:. new_dictionary[key] = dictionary.pop(key).. return new_dictionary...def check_kwargs_empty(kwargs_dict, raise_error=False) -> bool:. """ returns True if kwargs are empty, False otherwise, raises error if not empty """.. if len(kwargs_dict) > 0:. if raise_error:. raise ValueError(f"{list(kwargs_dict.keys())} are not supported arguments. Look at the documentation for supported arguments."). else:. return True. else:. return False.

C:\Users\user\AppData\Local\Temp\_MEI12922\pystray\init.py

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2108
Entropy (8bit):	4.798329477412705
Encrypted:	false
SSDEEP:	48:SISbAyExGGp4upe3+xAUMsu8OTJ+gBjtV:8bgLieAUMsu8OTogBRV
MD5:	9EBBF9F5410C89AE4BDC310E907CBC5D
SHA1:	318BE19377FC67196427FDBBF458EF2FA1713FA2
SHA-256:	C8E2B76AEF6862992334ECA1CC88B319B70DB64DC9A391EA41C55A675C1FC20D
SHA-512:	5DD8B9406235C030AC57FF86F2A4118DABCC723539C2A71E37B378353BFD93B7D4620EFA721AE54126F57FEDB7F83179437994B5AED1334B8550EC01CFC647BC
Malicious:	false
Preview:	# coding=utf-8.# pystray.# Copyright (C) 2016-2022 Moses Palm.r.#.# This program is free software: you can redistribute it and/or modify it under.# the terms of the GNU Lesser General Public License as published by the Free.# Software Foundation, either version 3 of the License, or (at your option) any.# later version..#.# This program is distributed in the hope that it will be useful, but WITHOUT.# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS.# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more.# details..#.# You should have received a copy of the GNU Lesser General Public License.# along with this program. If not, see <http://www.gnu.org/licenses/>...import os.import sys...def backend():. """Returns the backend module.. """. def dummy():. from . import _dummy as backend; return backend. def appindicator():. from . import _appindicator as backend; return backend. def darwin():. from . impor

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp852.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.4509005787389877
Encrypted:	false
SSDEEP:	24:CPHVBUlJvRj7SOVbusZhAMiZyi77q7EUsOtycwQIc+922V:mMlBVnrAMiwMmwvOtycwQIc+9R
MD5:	48402B424B5101BDEEB0192BBA96DB7D
SHA1:	C9EB93A37AF70F4134AA9CF05D914A30FB3201DD
SHA-256:	F3A18A8C7934F6586F023477E08D3F9D5EAD9A45E9E58A3F8D018AF9BB13F868
SHA-512:	4EE615605BFF3D94A7FC4FE23D8288F0F20F6792C8C69ECACABAE82F1A334D8417C5DFFC0DA3702E2DB09B7BE1E5FF19C6A0F460C9A5EC84D1856BB9C8061CA5
Malicious:	false
Preview:	# Encoding file: cp852, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E4016F010700E7014200EB0150015100EE017900C40106..00C90139013A00F400F6013D013E015A015B00D600DC01640165014100D7010D..00E100ED00F300FA01040105017D017E0118011900AC017A010C015F00AB00BB..2591259225932502252400C100C2011A015E256325512557255D017B017C2510..25142534252C251C2500253C01020103255A25542569256625602550256C00A4..01110110010E00CB010F014700CD00CE011B2518250C258825840162016E2580..00D300DF00D40143014401

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp855.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.4277025591531864
Encrypted:	false
SSDEEP:	24:CoHVBUlJvRj7SOVbusZhAMiZyi77qLHVWjwk/rMZC032SLnD2JbD:hMlBVnrAMiwMmx8whM03VLDy
MD5:	8B8AA56F83BA750EB73FAE542E76FF1A
SHA1:	2F3C3BA4B854A7D6B0A3D27BC519EE66A042E05A
SHA-256:	E64FD2E639DA6F654D9BFBB2266F9432259A6A55941622F5CDDC3797E382EB0A
SHA-512:	8B4061176663F7AC01B3969D25F680B5870A8EAD864CFAD897F18E75409CE721E6CC367A88EBABAF72E77D4542EE1894F2A6EE47A43FB3D4C650CFA18DFD3D71
Malicious:	false
Preview:	# Encoding file: cp855, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0452040204530403045104010454040404550405045604060457040704580408..04590409045A040A045B040B045C040C045E040E045F040F044E042E044A042A..0430041004310411044604260434041404350415044404240433041300AB00BB..259125922593250225240445042504380418256325512557255D043904192510..25142534252C251C2500253C043A041A255A25542569256625602550256C00A4..043B041B043C041C043D041D043E041E043F2518250C25882584041F044F2580..042F044004200441042104

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp857.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.364496856690505
Encrypted:	false
SSDEEP:	24:CaHVBUlJvRj7SOVbusZhAMiZyi77qZpu6uUV5Dw5LeBCVHjzA:jMlBVnrAMiwMmyUVFw5SYdI
MD5:	BA52A031DE1B1A6ED1C41BED8946750C
SHA1:	BD54C0E2F62FD36675892A61FD8B340A56845D20
SHA-256:	B6CD5C6F2B54D89142679D599ED0A5DEE6955A3B3F6B6673E46AFE7A5A303CDC
SHA-512:	5F915AABE39F31CE9337B4B9B0239DF8ADA898D2D9F111DD09D97689DB89CF45B093AC187FC28484CFB213D14B0D8F58C5668D0A59726282D6F52D5D24697816
Malicious:	false
Preview:	# Encoding file: cp857, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE013100C400C5..00C900E600C600F400F600F200FB00F9013000D600DC00F800A300D8015E015F..00E100ED00F300FA00F100D1011E011F00BF00AE00AC00BD00BC00A100AB00BB..2591259225932502252400C100C200C000A9256325512557255D00A200A52510..25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4..00BA00AA00CA00CB00C8000000CD00CE00CF2518250C2588258400A600CC2580..00D300DF00D400D200F500

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp860.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.506813480871637
Encrypted:	false
SSDEEP:	24:CMHVBUlJvRj7SOVbusZhAMiZyi77qij4Axlt49Y18wDyV8mK:VMlBVnrAMiwMm/g+9Y1LmK
MD5:	C416471B57FB894DC45D30C31B4BD2E2
SHA1:	BA378F8122280992AE51245A06814D8155564220
SHA-256:	804EFA345C5BBBAD2449C318A7A3F5B31F4234712AAD23DC49B3FB5AA33B7A57
SHA-512:	E7CDE706CFE573525C2DE319AD5783AE9D97C4F6D28B14A77A729F281540B0DAFAD4C14879EF76473BFDEBC38499C65CA228470983F2D1BC31938A91A2486522
Malicious:	false
Preview:	# Encoding file: cp860, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E300E000C100E700EA00CA00E800CD00D400EC00C300C2..00C900C000C800F400F500F200DA00F900CC00D500DC00A200A300D920A700D3..00E100ED00F300FA00F100D100AA00BA00BF00D200AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp861.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5174672833207183
Encrypted:	false
SSDEEP:	24:ClHVBUlJvRj7SOVbusZhAMiZyi77qZpORVPnA2Gm18wDyV8mK:8MlBVnrAMiwMmiVPAA1LmK
MD5:	4997979FD1692063E2B9AA9870E0BE4C
SHA1:	919012354B99BBEF4C85517E89A2C9CD340FCE49
SHA-256:	4B7E76AEB75289FACA76434EA6E9874E9504AD2BC3D8D47550EADBCC8294857E
SHA-512:	C122A1AE2DE79CB97E5989535B7478A76D905CDE60B01F80F5B84EDB9DF08BE6829E1811AF19608971DA048B8DA24F40DE0217A8054AC612EC2D8B3560500FBE
Malicious:	false
Preview:	# Encoding file: cp861, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800D000F000DE00C400C5..00C900E600C600F400F600FE00FB00DD00FD00D600DC00F800A300D820A70192..00E100ED00F300FA00C100CD00D300DA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp862.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5573268031592717
Encrypted:	false
SSDEEP:	24:CdMHVBUlJvRj7SOVbusZhAMiZyi77q36AqE18wDyV8mK:iMMlBVnrAMiwMmq3E1LmK
MD5:	9B4D1B95B20BD67555517DCC3007B22A
SHA1:	2C0D6121DB49CDAB6FBAA81398BE2E44BE4E1110
SHA-256:	6C15CB256B1C22170292589C6F589E64E164EB36EC7E84F0BD48149BABB7C5FC
SHA-512:	34C3E401364D579E8AC7A4E1F1F7A29A84C62E1D5146D7664832639EA3997227DC4BAF1B64DC605E6574D680E61B55D0C69C329E35B1BEC41501FC68C5B634B7
Malicious:	false
Preview:	# Encoding file: cp862, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..05D005D105D205D305D405D505D605D705D805D905DA05DB05DC05DD05DE05DF..05E005E105E205E305E405E505E605E705E805E905EA00A200A300A520A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp863.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.518080906819747
Encrypted:	false
SSDEEP:	24:CXHVBUlJvRj7SOVbusZhAMiZyi77qwGuXVFq5EC18wDyV8mK:eMlBVnrAMiwMmw3VFu1LmK
MD5:	C93CCDF65F7F349F22855745660F02AE
SHA1:	604888B1FB3C57DF47277CDD1153597BA89E8C36
SHA-256:	232D6FE34D7151920232EAAE9C515F36400AB64136DCC5B802D6245AC6F5D56B
SHA-512:	D5B65AE7353F694A37AF29177BF1A95477918FC5A002C2FE199624BD5B391698807BAECF54225BC40F62B3CA7912C7066A4AAF01B9E3E399133831CAA342BF4F
Malicious:	false
Preview:	# Encoding file: cp863, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200C200E000B600E700EA00EB00E800EF00EE201700C000A7..00C900C800CA00F400CB00CF00FB00F900A400D400DC00A200A300D900DB0192..00A600B400F300FA00A800B800B300AF00CE231000AC00BD00BC00BE00AB00BB..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp864.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.72017408907567
Encrypted:	false
SSDEEP:	24:CwHVBUlJvRj7YOVbusZhAMiZyi77qcHj92OibcDQAyUjSG:5MlrVnrAMiwMmSsNcDQvcSG
MD5:	146E0D1779D50E070E0EF875E8374DF8
SHA1:	B51E5598712598BC387DD79AE80BD879F139140D
SHA-256:	81BEBFD9A61E9F17495763B68D57742FAB2A1A43871015699A2C8E5FDED4EC19
SHA-512:	1F0DAD8E77712C5A018894332BE72FF5C546C92F481421CCB8553AD6F1E9A18617765C8CEE4187265CCCB1AB073E221289D34C9AB1F0501231D52C81FC1C932B
Malicious:	false
Preview:	# Encoding file: cp864, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00200021002200230024066A0026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00B000B72219221A259225002502253C2524252C251C25342510250C25142518..03B2221E03C600B100BD00BC224800AB00BBFEF7FEF8009B009CFEFBFEFC009F..00A000ADFE8200A300A4FE8400000000FE8EFE8FFE95FE99060CFE9DFEA1FEA5..0660066106620663066406650666066706680669FED1061BFEB1FEB5FEB9061F..00A2FE80FE81FE83FE85FECAFE8BFE8DFE91FE93FE97FE9BFE9FFEA3FEA7FEA9..FEABFEADFEAFFEB3FEB7FEBBFEBFFEC1FEC5FECBFECF00A600AC00F700D7FEC9..0640FED3FED7FEDBFEDFFE

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp865.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5193842128126676
Encrypted:	false
SSDEEP:	24:CsKHVBUlJvRj7SOVbusZhAMiZyi77qZpuHVBnAFj18wDyV8mK:gMlBVnrAMiwMm+VRAFj1LmK
MD5:	150B2E00B3F84F8075F3653ED7A4C8E0
SHA1:	7131DC656EFE1F2277B19DA72F0EEB46B4EC54A0
SHA-256:	ADA1A52064EE93EBE6F8A5D101D01F8776038E12F21A5CA1C006EE833577C705
SHA-512:	AC56EEB0220826BF8FF6CA52768DB63961AAC46095A2F3EEBA11B5973CC92AF52DFBBE9E85A0DD04CAB8998212FA2599EDD83BAAA7FB2D394E330FF2F7C015DB
Malicious:	false
Preview:	# Encoding file: cp865, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5..00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D820A70192..00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00A4..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..03B100DF039303C003A303

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp866.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5038992968715266
Encrypted:	false
SSDEEP:	24:CCHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9aRme3cB18wDyVNZkR:bMlBVnrAMiwMm8YnsB1wZy
MD5:	FC33B5F773E87696A69E8798446E9772
SHA1:	4FC5589C1DD88BB8171758BC173A63B3A5687AE5
SHA-256:	32A45DEBA933C7ED99141535087A4C99BA79802175E3F762ACA6EB941157F85A
SHA-512:	332D2FEC532192F58F792441E61D675A8692C36BECF768D07F64B8C31561CC1A2DF402625A4719E758A9B59DE4228FFE9F94F067E7DC0D82F9DA2D6500E50304
Malicious:	false
Preview:	# Encoding file: cp866, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..259125922593250225242561256225562555256325512557255D255C255B2510..25142534252C251C2500253C255E255F255A25542569256625602550256C2567..2568256425652559255825522553256B256A2518250C25882584258C25902580..0440044104420443044404

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp869.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.5261138894265507
Encrypted:	false
SSDEEP:	24:CtHVBUlJvRj7SOVbusZhAMiZyi77qii+lh2o5+hdVMQFhWgCDrKE:EMlBVnrAMiwMmXY2o5+hdVMQFhWf3f
MD5:	4A2C66AA630D4AE2BF1E7546DCE2DAE5
SHA1:	FABB672957D21CA2B4E0EACA5FCE6093BAACF77A
SHA-256:	AFE6ED6EB5D07C45B6B928A48BC5EF57EFCF61602D36FF9FBDE4A8EA3FA6DF75
SHA-512:	A548002EB7AF8735DBBBCC9883B44B326F261C02A3C7CE65C373755DD92212A66740112EAE0FC556CAD5B86911709C6DF12167DC5B6AD1E01C6F1EB5AB16DB37
Malicious:	false
Preview:	# Encoding file: cp869, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850386008700B700AC00A620182019038820150389..038A03AA038C00930094038E03AB00A9038F00B200B303AC00A303AD03AE03AF..03CA039003CC03CD039103920393039403950396039700BD0398039900AB00BB..25912592259325022524039A039B039C039D256325512557255D039E039F2510..25142534252C251C2500253C03A003A1255A25542569256625602550256C03A3..03A403A503A603A703A803A903B103B203B32518250C2588258403B403B52580..03B603B703B803B903BA03

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp874.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	3.33737382140564
Encrypted:	false
SSDEEP:	24:CSyHVBUlJvRj7SOVbusZhAMiZyi77qVQEHmEU4AyqU+TWwdd:CMlBVnrAMiwMmWr4AyqUSd
MD5:	FC8C876B4738236FC71A1AF96E4566D0
SHA1:	DDFDC3F62D99A6BD705CF0719B50F66449C8808A
SHA-256:	4F05F31CA026BBFEEEE49ED86504CB060784137A9CFAE0E5954D276E837AB5DE
SHA-512:	5BF58A810E029840825FFF3318E90415E6F2B7E46032FD428B4971923D41A64C127A6F438E4894E80EC9604CD34F1D47B4F9A02ABAB3E7D6351611811DC1F2B9
Malicious:	false
Preview:	# Encoding file: cp874, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC008100820083008420260086008700880089008A008B008C008D008E008F..009020182019201C201D20222013201400980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E440E

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp932.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	49008
Entropy (8bit):	3.5144574650895364
Encrypted:	false
SSDEEP:	768:R/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSY83+JRS:RVUidzJCurDGSYvW
MD5:	EF4508C84A025095B183E6BAD67B1ECD
SHA1:	D12D5381D50D578AA8687671DC542C462A7F490D
SHA-256:	6D1B512110BEAF2CD1296AC878F51D567848AB4A1CED4F18C72806BB136B3D23
SHA-512:	E695E7E6F4A11D5E8D62982E26B69B87DB2F1F3D6B6DCCD5F1DF51879F5C4533265CBD7B785E1F2652D8CA3FC913D4F862E7575F67C636314A6E6956FD96E023
Malicious:	false
Preview:	# Encoding file: cp932, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp936.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	134671
Entropy (8bit):	3.5217328918779645
Encrypted:	false
SSDEEP:	1536:+CwDua7D90Jz1aDJmnMfEGniOQdH6prJs3inqlW6/t9Qwf+zCt5:j1WVRpe3rpt9hf+Gt5
MD5:	CF9CFD6329A4FB6C402052B9417DAC3A
SHA1:	75CE13FE1E5898D47B67F951C0C228851F1CC04D
SHA-256:	B6EC2BE0504CA62B9D1B6857F6BAA13FFAC5A567D4432F4EAB98ADC830F5D9C3
SHA-512:	7E19607EEA5342ECFE92D56DAAE82827DE147AE5AFDA8E9D67FD0970F528902CDE20A8A07CF2F341B926E59BB4FF792872976F1C7C5CD351959A71A8B6A1924A
Malicious:	false
Preview:	# Encoding file: cp936, multi-byte..M..003F 0 127..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..20AC000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp949.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	132551
Entropy (8bit):	3.100976362851161
Encrypted:	false
SSDEEP:	1536:2UO8ecy5KnSMsDlOmNpkQ4oQHnTApv+ngLbiyEY:2U/etc/sBRZp//r
MD5:	03E19A4DE3490A7DC50D04EC1F558835
SHA1:	9DFECAE08C98109EAA358F5920AED647888F722B
SHA-256:	477F8B79B67F4A22C963EE65B9B387DBD8E4B8F62D800B0A51D2276580C6ADBB
SHA-512:	7D6AD30AF75A3AA6332A860C6ABF87BF725EB6B4AF3B37699043A10EF3235471C63D0ECB4D437D5AD9438DF5DA646EB55117A9BB8B55EF6868F71E49035C18B7
Malicious:	false
Preview:	# Encoding file: cp949, multi-byte..M..003F 0 125..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\cp950.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	93330
Entropy (8bit):	3.319807723045599
Encrypted:	false
SSDEEP:	768:aAHU3LIkZlmXrd/uQ0ao98ggKSTEvZPHb6qRL5NpiadDp0ZBFR6YR/fW:aVduBGf9PgFMT6q95GDRBfW
MD5:	1D84B025DAB127F2073947D764D307B6
SHA1:	4E3D3CBD96D084836F1FE6F2AA497E3FAA463B9B
SHA-256:	F80E05533D1A1494C32F9412E9AD2D9C11FAF9AE0668A6F9D1FA5CEEDC6870E2
SHA-512:	188D649F9717F20524AFF47F85C3B23AEC3E7825BF54975285D06C17587D581DC24A3F6A7CAB1703DE7AD5521FE2FE2572DE627A81E6A48049A47BB219ED4AF8
Malicious:	false
Preview:	# Encoding file: cp950, multi-byte..M..003F 0 88..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\dingbats.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1113
Entropy (8bit):	3.7780987266961663
Encrypted:	false
SSDEEP:	24:vJMHkUlJvRjmf9RCsUBOdXsCbbNviANpk3m1XFAoE4xSF5HrBPkdn:vKvlA9RCs6CXrViAN51XFA9eSvdPKn
MD5:	90FE0C57BBC6C2D8A3324DEB7FD45F3D
SHA1:	06B95BE43E4C859A0F1B01384EDD26500C6C1F9E
SHA-256:	EB9B262E4D179268E6F017C0D4EF0E7034E31A5B4893595D150640CA1F6A1C45
SHA-512:	6A5E67D9F3EC6046C42793E1437B8A6E50EBD72D8EC67FEFEB6DAD6FAB6A5B5C74F939363587D5A6529E217AF54FB8A9CF0F768E114DD931C57887451CACE56E
Malicious:	false
Preview:	# Encoding file: dingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A327A

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\ebcdic.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	3.0039861897954805
Encrypted:	false
SSDEEP:	24:XXBcIhJZDgEoQkNCGz0Jyh9lZk3Vmd2QhZLXPiALV3d:dTcNCJEhfZk3Vzox/iqVN
MD5:	F7B3771D43BDE6AFF897683BED2FE6AD
SHA1:	E70C2C0902413536CB6163752D70F3AE4AF6A967
SHA-256:	165BE658AB7D61FFC3DF1E2F1438C2F9FCEE6808A756316302157F44E6D3ACD7
SHA-512:	F87DC718EB2DD95237B144FDA090BB636121B9479E492AC94E4F7EBDD88171F070B9E9F6165BDA7B7E2BA2A3E6188B1108D8F91AA5F142CCCFDAD317628DD941
Malicious:	false
Preview:	S..006F 0 1..00..0000000100020003008500090086007F0087008D008E000B000C000D000E000F..0010001100120013008F000A0008009700180019009C009D001C001D001E001F..0080008100820083008400920017001B00880089008A008B008C000500060007..0090009100160093009400950096000400980099009A009B00140015009E001A..002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C..002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F..002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F..00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022..00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1..00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4..00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE..00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7..00F900410042004300440045004600470048004900AD00F400F600F200F300F5..00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF..00D900F70053005400550056005700580059005A00B200D400D600D200D

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\euc-cn.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	86971
Entropy (8bit):	2.3925661740847697
Encrypted:	false
SSDEEP:	768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
MD5:	C5AA0D11439E0F7682DAE39445F5DAB4
SHA1:	73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
SHA-256:	1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
SHA-512:	EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
Malicious:	false
Preview:	# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\euc-jp.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	83890
Entropy (8bit):	2.350315390677456
Encrypted:	false
SSDEEP:	768:2GhX8nuQ635vlHptHzh0abNQPQA0OMS2HhFV3:2GikvRpMuNQ4P73
MD5:	F2DE0AE66A4E5DD51CC64B08D3709AAB
SHA1:	97558A51A6DD6C56FC7A42A4204141A5639021FD
SHA-256:	A3C916BA16BCAC9FAA5A1CCC62ACA61452D581CD8BA3EE07EC39122C697274C9
SHA-512:	0EAA90100527FF150D2653D7BB57647D69E592BE53B714DDD867114CFCC71E3A76882772F4FAECE040DF09FA8971D1C22DECC497E589B4CA827A6890497A48D9
Malicious:	false
Preview:	# Encoding file: euc-jp, multi-byte..M..003F 0 79..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D0000008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\euc-kr.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	95451
Entropy (8bit):	2.4080588863614136
Encrypted:	false
SSDEEP:	768:4/vO7UlClqAd8XfpUqv+mCoKRuLbtMjnIxz0DY:4nO4N9fpv+ngLbiyEY
MD5:	103843B3A57168BD574F6CACC550D439
SHA1:	982652EA2B0DCFBB55970E019A4EDFBFCFAF9C24
SHA-256:	5448643398685456A11CBB93AF2321F70B8659E2FFF3CCC534B4D53BD2F38C89
SHA-512:	27A8DE6F97DB4A96E5D0132692A32A99DAB8A6C98973A0C4E50A219F2D2F364E63D657E5E8478B2706CA33C45C376F55B5BFCC9459E06AEA88BFCD4F0E32525C
Malicious:	false
Preview:	# Encoding file: euc-kr, multi-byte..M..003F 0 90..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\gb12345.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	88033
Entropy (8bit):	2.3790651802316996
Encrypted:	false
SSDEEP:	768:o4Is/C+0IwpRK1CkinIKUyNiNBzxOC4T/:LIsR0/RKckiIgNiDtOxT
MD5:	1A8E55DEA98B6D5EAC731ED233D3AD7C
SHA1:	1335FC0FC2AAE7E7F5EC42AC17A4168368B4A64D
SHA-256:	B4894AEDD2D5B5AE54B6D2840F7C89A88E9308EFD288F179E65936E172EF4B0D
SHA-512:	9DDCE366BA1196EB9FB913ACFDE8516BC9BB8D51894866D2E7E8CB313DC4D6C6D33C5A9E78142E83594DC423D10DA6F8DE211E69844B939198BC7DB9AED808F0
Malicious:	false
Preview:	# Encoding file: gb12345, double-byte..D..233F 0 83..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\gb1988.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.270324851474969
Encrypted:	false
SSDEEP:	24:qrmHVBUlJvRj76OVbusZhAMiZyi77qN8VmKfkiJt0RMFS:qSMlZVnrAMiwMmNPYPFS
MD5:	D06664ACAA478BDEB42B63941109A4E3
SHA1:	4A6196FCC1BDE988C1A23EAA69745A9979F1AEFF
SHA-256:	ACD50951F81566C8D823670F9957B2479102EB5AE4CF558453E1D8436A9E31FF
SHA-512:	CB51A36B851FFDB5C6F9B9D0333EEA6A14CEF3796E0A60530198C16999D64E638047E873333630360299C9126F79CEDDA2D9F169028CED1FC04B1D3C55FFFC5B
Malicious:	false
Preview:	# Encoding file: gb1988, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..002000210022002300A500250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\gb2312-raw.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	85912
Entropy (8bit):	2.3945751552930936
Encrypted:	false
SSDEEP:	768:D47/S+i8vdx3Tz+hpHcBrQqKtrebjMIGCx8jE:0c873T6DHcBrbKtrVlE
MD5:	9357E05C74D6A124825F46A42B280C14
SHA1:	E5106ABE12D991AFE514F41E3B9E239202A4ADFE
SHA-256:	C445E4C9F676AE997D2DDA2BBC107B746F3547D85F39479951C56F46275EE355
SHA-512:	B2187D70A92FB38572BA46F3C3443233BEED1A4ABBFBA1B860F4BBAE6B3D8C16B8C9F52A20DAA12B2B8B40972E52F816860427B743530177E4CF0D8BA34EF381
Malicious:	false
Preview:	# Encoding file: gb2312, double-byte..D..233F 0 81..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300230FB02C902C700A8300330052015FF5E2225202620182019..201C201D3014301530083009300A300B300C300D300E300F3016301730103011..00B100D700F72236222722282211220F222A222922082237221A22A522252220..23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235..22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605..25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\gb2312.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	86971
Entropy (8bit):	2.3925661740847697
Encrypted:	false
SSDEEP:	768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
MD5:	C5AA0D11439E0F7682DAE39445F5DAB4
SHA1:	73A6D55B894E89A7D4CB1CD3CCFF82665C303D5C
SHA-256:	1700AF47DC012A48CEC89CF1DFAE6D1D0D2F40ED731EFF6CA55296A055A11C00
SHA-512:	EEE6058BD214C59BCC11E6DE7265DA2721C119CC9261CFD755A98E270FF74D2D73E3E711AA01A0E3414C46D82E291EF0DF2AD6C65CA477C888426D5A1D2A3BC5
Malicious:	false
Preview:	# Encoding file: euc-cn, multi-byte..M..003F 0 82..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso2022-jp.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.949409835601965
Encrypted:	false
SSDEEP:	3:SOd5MNXVSVLqRIBXS4ovLE9sDXMVyXK9ow1Deq9Ts5dRPMSXcRA0kcR4X9cL+TXI:SVNFS0oyisLMsXK9okTw/BDSVKNw
MD5:	D3AC33390D31705FA4486D0B455247DF
SHA1:	2EE8613DC04A6FA84AB38FD5F3A2AA3FE330625B
SHA-256:	98074C85650A420A095ADA9138DA3A8A0AA4027BE47EA1E97A596F319EB084E9
SHA-512:	CB265B753C84968E2D1D6E706906DA9A7BB796D08F626290BCCA8F089771AFD176A9DC912773E8BA390D2AEC08592AD535C7D254E1DF92CF04848601481D4EFE
Malicious:	false
Preview:	# Encoding file: iso2022-jp, escape-driven..E..name..iso2022-jp..init..{}..final..{}..ascii..\x1b(B..jis0201..\x1b(J..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso2022-kr.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	122
Entropy (8bit):	4.978693690727393
Encrypted:	false
SSDEEP:	3:SOd5MNXVTEXIBXS4ovLE9sDXNvdwUHEQwqc6XWxVUNOov:SVNFSoyisL/Zzc6mYNHv
MD5:	057CB0AA9872AC3910184F67AC6621BC
SHA1:	BBA47F9D76B6690C282724C3423BD94E2C320A04
SHA-256:	234811FC8B0F8FF2B847D9CC3982F1699DF1D21A43C74DCE45BA855D22520007
SHA-512:	019F187D2D16FB51BF627ACB7E67778857E56D4C160E0E5ACA6ABC05EC5FDB624CE2715CB9E0DAD73BFF9D697982BE0D539BC55BCCD368FC7C8EE0FFC04E9F61
Malicious:	false
Preview:	# Encoding file: iso2022-kr, escape-driven..E..name..iso2022-kr..init..\x1b$)C..final..{}..iso8859-1.\x0f..ksc5601..\x0e..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso2022.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.95909788984399
Encrypted:	false
SSDEEP:	6:SVNFUXoyisLNcs9ozc6W4Twk0sRBDSVKN6tWIHRy:oUYcLNcTzczbwRYRy
MD5:	BB186D4BE3FA67DD3E2DEE82DD8BD628
SHA1:	93CE8627038780CFFF8C06E746DD5FB2B041115C
SHA-256:	741B4C842557EED2952936204D0AE9C35FA3A0F02F826D94C50C46976291797C
SHA-512:	4921E7AA3DB8E33609603FE129B97275DFF80CFB06648D2068FA7950246C67B9B530B74827638F69F4DFB8F55CDD4AA952EA72EAEB6ABB527D52F20C6B46FB51
Malicious:	false
Preview:	# Encoding file: iso2022, escape-driven..E..name..iso2022..init..{}..final..{}..iso8859-1.\x1b(B..jis0201..\x1b(J..gb1988..\x1b(T..jis0208..\x1b$B..jis0208..\x1b$@..jis0212..\x1b$(D..gb2312..\x1b$A..ksc5601..\x1b$(C..jis0208..\x1b&@\x1b$B..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-1.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.236046263464657
Encrypted:	false
SSDEEP:	24:iyHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkL+rSMH+tKv:iyMlBVnrAMiwMmTmokLz0
MD5:	3538A970CD098BF5CE59005FE87B6626
SHA1:	285A96CC40D7CCE104FB4B407C7F0C400AA8F9CB
SHA-256:	A9CB4F4CA111608F882729BC5EB1C2F15530C515EF02DD2CA62F2D8DC5A210CF
SHA-512:	A6A6F2D8B5C22E240D195D168A604887062508FF3340D24E13BFCBD6C2E687347F2CFE724FA2ED12F36915B55EE2CFD901EC3F08E2B0A2FFD3BC2A98BBD12A50
Malicious:	false
Preview:	# Encoding file: iso8859-1, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E300

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-10.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.319750415373386
Encrypted:	false
SSDEEP:	24:jHVBUlJvRj7SOVbusZhAMiZyi77qimXG2yM6q7KytC:jMlBVnrAMiwMmTXG2gytC
MD5:	CBDE40170FECD2496A9DA3CF770FAB7B
SHA1:	3E1D74DF6AFEB6CDE8ECBDAC8F81F2F9C64150DE
SHA-256:	48F4A239C25354F0E9F83A39F15D4632BB18A9C33E60C671C67307159917ECED
SHA-512:	A26B56A4CFE29E5A0A0B3A55283A7767397693388E2DEEC342C69B6F718FAE2407EB8D5ADE538FAE6947CBB8B052943C3A52F2D046ABAC7A3DAA86D730DC293F
Malicious:	false
Preview:	# Encoding file: iso8859-10, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A..00B0010501130123012B0129013700B7013C011101610167017E2015016B014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF..00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF..010100E100E200E30

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-11.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.3206399689840476
Encrypted:	false
SSDEEP:	24:6HVBUlJvRj7SOVbusZhAMiZyi77qimwHmEU4AyqU+TWwdd:6MlBVnrAMiwMmTf4AyqUSd
MD5:	E2A0BCB83BFC3F435CDCFC20D5CF2E0C
SHA1:	CFD18B5B5DB4EE46E63D912B8FD66D513C4C8D39
SHA-256:	21E769C5A66E4D12D6E7DB24022E92AF1EC0D0331FE3C8C605654F239C0F3640
SHA-512:	C86F9180F2F4A177F1EA10E26B0903ABEAFDDE0317C332A48F8D1BB586DAC91C68800E2E4FA2CD739C435419B106CBA4BEFC049F2BCD720E9FC2C0AE8436CFAC
Malicious:	false
Preview:	# Encoding file: iso8859-11, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-13.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.338879965076632
Encrypted:	false
SSDEEP:	24:olHVBUlJvRj7SOVbusZhAMiZyi77qim2w4kBUioGnd2:olMlBVnrAMiwMmT/WNI2
MD5:	21CEBB723D47B1450A7FB21A82470B97
SHA1:	A40FD3AFE1ECE89E3F682D527D281BC563DB3892
SHA-256:	3271D39D7B4DCD841E8E5D5153D1B8837718B88FEFEC73DC37D314816EEFE5E5
SHA-512:	3A0E033A4D93C679215F672C6C4FE425D63E1DE157AA671E7400639165EC3EB498E4EEB030D6FB8FF8BE2FD8C986D341036A8CED9FA094D092CF2822D5DC065B
Malicious:	false
Preview:	# Encoding file: iso8859-13, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6..00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6..0104012E0100010600C400C501180112010C00C90179011601220136012A013B..01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF..0105012F010101070

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-14.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.3670559016263915
Encrypted:	false
SSDEEP:	24:vHVBUlJvRj7SOVbusZhAMiZyi77qimhw6COlk1fKMH+tiH:vMlBVnrAMiwMmT/tlkQz0
MD5:	FDAA88946DE4EB4E6D37F2B6AFCF6CAF
SHA1:	56FC4773941E7457EA04EDA92C883642DE45D100
SHA-256:	F0A5675027FB1CA34B4E4128D24C2968CD275890569A32A86AFA4994CE4983E0
SHA-512:	92658A6FEB42A41B3CFFC377C4A9A3F6780A79FC596D3FEDBA6D3B3D75A9F40E859A2CE8DC579A278BAEEDEEFA2408E2B7853D99D5C2D14AACF63C521FE2BB86
Malicious:	false
Preview:	# Encoding file: iso8859-14, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178..1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF..00E000E100E200E30

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-15.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.260398494526282
Encrypted:	false
SSDEEP:	24:mHVBUlJvRj7SOVbusZhAMiZyi77qimmRf4kL+rSMH+tKv:mMlBVnrAMiwMmTmCkLz0
MD5:	D779D5E2A0083C616A226B2D82ABF0EB
SHA1:	D1657DB5E2989EBA80BAB98A1E1217CFFFBB19DB
SHA-256:	C74E8E23A0FF0D5DEA7C318CA20DC817DA4E57B0DD61B3361FC0D5098A9316FE
SHA-512:	26E62BE8AE793ED3B725BF0D1BABF4D6ED63A6F3772ABD48955FC4394BDE5A47614D1FF89A21A828676BF1302F3C9361B557B0FBF0DF8561FB7E66542FE94CDC
Malicious:	false
Preview:	# Encoding file: iso8859-15, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF..00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF..00E000E100E200E30

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-16.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.3065938185320918
Encrypted:	false
SSDEEP:	24:dHVBUlJvRj7SOVbusZhAMiZyi77qim0SmmPkYTtyL:dMlBVnrAMiwMmTttPkYpyL
MD5:	74FDEDDAF670023DA7751FB321E345A0
SHA1:	0677FED67C1333A9A74D50642E5214701A57E2AF
SHA-256:	640D977EC1D22B555C5075798DA009E3523E8F55F29BE22A3050CD1B4EF7B80E
SHA-512:	AC02FD95159A856A9DDEF4E6A8216B958DC07311B553FF39403DC5B77E1AFF2A2C4C03F5F26A2BB7AD5DB6800BEE03E895554556DBBFBE89426286796ADE55AC
Malicious:	false
Preview:	# Encoding file: iso8859-16, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B..00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C..00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF..0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF..00E000E100E201030

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-2.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.340505173539446
Encrypted:	false
SSDEEP:	24:UHVBUlJvRj7SOVbusZhAMiZyi77qim/ssm5VO6ys2K:UMlBVnrAMiwMmT/ssYTys2K
MD5:	9B87850646FFE79F3C8001CBCB5BB3A1
SHA1:	8F97576F3FB3B5DBEF71DC2C9314AB5E530974D6
SHA-256:	76949B03F57041B07F41902BD7505AB3594D79AA8F7BDEED5F0481004B10CBC3
SHA-512:	101A28AF0799E7E0A5723E5DD76D5EF0FEEF584AC479A88F499CB3B7D2AA93767D72F8E51C76F7547F08FF8DD3CBBA7FF444BD07F99A92755526E75C596109EF
Malicious:	false
Preview:	# Encoding file: iso8859-2, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B..00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C..015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E..01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF..015500E100E2010300

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-3.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.2507537230559977
Encrypted:	false
SSDEEP:	24:tHVBUlJvRj7SOVbusZhAMiZyi77qimw2g0kgTJMkFtoD:tMlBVnrAMiwMmTo0kgTJDoD
MD5:	CBD0B9CDCD9BC3D5F2429A760CF98D2F
SHA1:	6DEF0343E0357E0671002A5D2F0BFC2E00C8BCF9
SHA-256:	1F51E7BDA64D466C16FEE9A120BBE3353A10CEB9DAB119FFA326779BA78D8C5D
SHA-512:	88DB6D23B53F4A78133C794ED42FA3F29A4ABAD35DE4B022040FA187AA59B00664CC13F47AFF4507D72F4CB2166F026144213EE760AB0FD67CDD2FA5906F434A
Malicious:	false
Preview:	# Encoding file: iso8859-3, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B..00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C..00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF..000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF..00E000E100E2000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-4.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.3413832766873073
Encrypted:	false
SSDEEP:	24:KHVBUlJvRj7SOVbusZhAMiZyi77qimX4AsD/njR7Ky8hA:KMlBVnrAMiwMmTXBs3EyuA
MD5:	8B620EDECAC2DF15A024C2CE15FB64A5
SHA1:	65C5EE5D08964E37393E6A78ABA0DB16D51240E2
SHA-256:	66B3CF994F0B5E0103D13E812958320AFB555C91E3F81B579D4CBF231E6A0805
SHA-512:	93391325405D3AEA0A913F5EA8EA0391920D10F234C26AB1DA70992702889A3AF7B85E11A1FCA554690942B238CE313DD460798E59C5B1F4069036E7B0F24F44
Malicious:	false
Preview:	# Encoding file: iso8859-4, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF..00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B..010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A..01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF..010100E100E200E300

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-5.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.342721205983665
Encrypted:	false
SSDEEP:	24:zHVBUlJvRj7SOVbusZhAMiZyi77qimq5+SAJlz9aRme3cJbx:zMlBVnrAMiwMmTqeYnsJbx
MD5:	6FBEFDC3DEC612B7B2CC903D8C53F45B
SHA1:	14EC3C166DC411149C32C262DBE8E327F6186669
SHA-256:	3130BF26DA0C840C1E02203A90C3B1C38966FB203130E2FBB3DD7CB3865A3539
SHA-512:	F3F15AD8B6C9D9B4C9C994FE3235B4463E59BE7DCE79CF3F7AA77905D6F4DC2C4AABB79B440767DB13D357B13F09EA34983FCA7BC92D0AFA15FB6CBEDDD04E38
Malicious:	false
Preview:	# Encoding file: iso8859-5, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0040104020403040404050406040704080409040A040B040C00AD040E040F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..0430043104320433043404350436043704380439043A043B043C043D043E043F..044004410442044304

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-6.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	2.992219341429816
Encrypted:	false
SSDEEP:	24:YHVBUlJvRj7SOVbusZhAMiZyi77qimEZjyG/KE:YMlBVnrAMiwMmTEs6KE
MD5:	52F025D943A45EE840D9C3DFD06E4D79
SHA1:	571EA14B49FA6150BFD2ABA79E52799955D9FA10
SHA-256:	CB71909BF01A3A7A4C7396359DA06D206B58A42AD68192CE37169D6640D46E13
SHA-512:	77FF9DC785A63CA59A7D58BB25C7D2C16F364E525F9B939177385EF80F7DE37734C8774F1BC829CF0270FD66257A4D31689654C8037DB0A86A0291FFDE637B90
Malicious:	false
Preview:	# Encoding file: iso8859-6, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000000000000000A40000000000000000000000000000060C00AD00000000..00000000000000000000000000000000000000000000061B000000000000061F..0000062106220623062406250626062706280629062A062B062C062D062E062F..0630063106320633063406350636063706380639063A00000000000000000000..064006410642064306

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-7.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.393893260854861
Encrypted:	false
SSDEEP:	24:TMyHVBUlJvRj7SOVbusZhAMiZyi77qim2OBHK9QQSqiWeIDDdn:TlMlBVnrAMiwMmT1hKyQSqiWeIVn
MD5:	4BFB0A35D971A9D4C5EA8D8099E93C37
SHA1:	8FED2CBB1343E5B4442748242B5F89A76110592D
SHA-256:	76F6BC85FC9CB89BC3F94D36275AB23C740BA17FD36EC8907479DA3A885415EA
SHA-512:	C9CE1E9EA57A1DEF62BBC60A115C06325C6EE8F92021695459E1ADAF1193A559BC5F0229191BFC2E344296DC137583ED4A9A61A65890F99F4CF97B3864C7AF0F
Malicious:	false
Preview:	# Encoding file: iso8859-7, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A02018201900A320AC20AF00A600A700A800A9037A00AB00AC00AD00002015..00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F..0390039103920393039403950396039703980399039A039B039C039D039E039F..03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF..03B003B103B203B303

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-8.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.0494739426493567
Encrypted:	false
SSDEEP:	24:uHVBUlJvRj7SOVbusZhAMiZyi77qimieGlnvs26Kcv:uMlBVnrAMiwMmTirv87
MD5:	5F69EAF54E7A1E8AC81C9E734DBE90D8
SHA1:	BA509C88A4FC03922EF5CDC887FAA7B594A9BC5A
SHA-256:	865E3665743B5FABA3E1AD6AA55515A666BD05DA6266879D9B66C98905DAFF3C
SHA-512:	D9924FBE59CB571AF721CA602DBE58CAD0D9310610EDF544F8FC0FBF3D1CE4E99597D0198E4E7C802107012786346FE4C1B9C6C3A76D5F60B9A83981B0EDA24D
Malicious:	false
Preview:	# Encoding file: iso8859-8, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000002017..05D005D105D205D305

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\iso8859-9.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	3.2591070910715714
Encrypted:	false
SSDEEP:	24:XHVBUlJvRj7SOVbusZhAMiZyi77qimmvGNNlkBSMH+tA/b:XMlBVnrAMiwMmTmokgzAD
MD5:	0B99E605E73B7D8DEFD8D643F5729748
SHA1:	F30E7CCBCD9C539126E8D6CA0886E4B2BD54E05D
SHA-256:	CF51E867DDE2F19553D98FEEC45A075C4B4F480FB1EDADB3D8DAD1EBEA9299F3
SHA-512:	DA0487CD7F2143195E80697C17FFDB61AFD464C888DDF84813B2B5D1BAB24D96466DA7A7F77C8E4A9D0D53F34D72928923380AFC1B92A96C0A3BFF46006A4E19
Malicious:	false
Preview:	# Encoding file: iso8859-9, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF..00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF..00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF..011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF..00E000E100E200E300

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\jis0201.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	3.2708615484795676
Encrypted:	false
SSDEEP:	24:zBHVBUlJvRj7SOVbusZhAMiZyi77qN8VmKfkiJt0RMFS:zBMlBVnrAMiwMmNPYPFS
MD5:	4E21F24F8D9CC5DF16B29CACD997AC69
SHA1:	064E723EFB82EF1C303E5267496304288821E404
SHA-256:	61B14A7C312366F79BB45F02C6B7EE362E6F51CBAD5E479E563C7F7E785DB654
SHA-512:	AF8FAEB47EFB51F2537139F7C4254ABED119E477FD2B5E83B90B7A903B43C4E02DDF43A7DDB044A0A9601E9F9ADE91B02EE7C0EC87FF5DDCF9951B9601A90435
Malicious:	false
Preview:	# Encoding file: jis0201, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D203E007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..00000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\jis0208.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	81772
Entropy (8bit):	2.3571626869060776
Encrypted:	false
SSDEEP:	768:AigXM6CwL/9pV7Hl6+Yko9gZxErA3/MS/8xqg8:AZ/tp1Hl2KZxUfr8
MD5:	F0661E22C7455994AA1F6EC1EDA401B4
SHA1:	928B2AC46A9FDE61A81F56BE225E6138B40C22E5
SHA-256:	F6B1C6AC5F5FC4E990A7A1AAC16A406012040936431BEFE7D2B6CD1DA9E422C4
SHA-512:	917CC58678A9E9F5CBE860D30828846ABA4EA8CDFAB7DD1AE6A66C47ECBB85CF67DD97BC3E6F95341DD30F4E757B2CEA571708D5B4CED18A29F19904C3138AE0
Malicious:	false
Preview:	# Encoding file: jis0208, double-byte..D..2129 0 77..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8..FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F..FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D..FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7..00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5..FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\jis0212.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	72133
Entropy (8bit):	2.3455261548208055
Encrypted:	false
SSDEEP:	768:9F/D7CH2puD5CdzU3nAkP5dHn7s391fmOarFaVQ:H/D7CHbozU3nAk3H7sXm3FgQ
MD5:	07CE2C135BE17DBAFA558AA5949A53DB
SHA1:	5D9DBEFCCB44E76C1A4E61360C6FCED8DCC8EF4D
SHA-256:	785CFC5F5D9CB06DB8061730AB0016A0F70D0B59F6787D2A3CBB8D5779C99706
SHA-512:	E954D7198D58ACEDEB4C8E5F466107767C3DA43763A5F6CDDFCF567226F9B22B4C2DE27564F28CD125D7F1BA7CB9C6DE6DEC4065EC2676572C793BE458FDDD9D
Malicious:	false
Preview:	# Encoding file: jis0212, double-byte..D..2244 0 68..22..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000000000000000000000000000000000000000000000000000000000002D8..02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000..0000000000A100A600BF00000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000BA00AA00A900AE2122..00A4211600000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\koi8-r.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.531149521168141
Encrypted:	false
SSDEEP:	24:KcJ5mHVBUlJvRj7SOVbusZhAMiZyi77qpSzIa9qVRS3YcEchJh3MAxSl:KmmMlBVnrAMiwMmAzIxVgBE6cAxQ
MD5:	96F54CC639ACA8E466FB8058144C9350
SHA1:	0B9530D6080F2BAACABD5AA0D48BFF316FCCEF64
SHA-256:	0E43244BFC4F33FACB844B9E00270A1A4C24DC59B8A9B95104E2D788BB2F59FD
SHA-512:	5B7859325E5E34C9D4558B1198795BB9C6A8EF783EB97193EA80BA76C38AFE9BDD1B526B77401DF5456B7A0E85E942191FFD4B4F2B9F0C8168A7093EE452802E
Malicious:	false
Preview:	# Encoding file: koi8-r, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204512553255425552556255725582559255A255B255C255D255E..255F25602561040125622563256425652566256725682569256A256B256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\koi8-u.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.5076564572101714
Encrypted:	false
SSDEEP:	24:K+HVBUlJvRj7SOVbusZhAMiZyi77qpSzIaU3dmVRS3YcEchJh3MAxSl:K+MlBVnrAMiwMmAzI/EVgBE6cAxQ
MD5:	4B755EF2288DFC4009759F8935479D68
SHA1:	C3BDF0D9DF316DE8919DAA4329275C5AA81D61B4
SHA-256:	ED04D5B977B8C8944D8760B713FF061292DA5634BCBB67CDFB1C3A6FF5378C81
SHA-512:	3F1E1CC47327054FB9C54157ED10514230F10BFCD4BD9FDAFA02D7B238137DC7442CA2661B0739D8EEA3181E187D3B639A2C8118A0DE272C96000908121B6CFB
Malicious:	false
Preview:	# Encoding file: koi8-u, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..25002502250C251025142518251C2524252C2534253C258025842588258C2590..259125922593232025A02219221A22482264226500A0232100B000B200B700F7..25502551255204510454255404560457255725582559255A255B0491255D255E..255F25602561040104032563040604072566256725682569256A0490256C00A9..044E0430043104460434043504440433044504380439043A043B043C043D043E..043F044F044004410442044304360432044C044B04370448044D04490447044A..042E04100411042604140

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\ksc5601.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	94393
Entropy (8bit):	2.4104200953565513
Encrypted:	false
SSDEEP:	768:XbjO7Uw6uKdosXRxps9a+ut/BmZPwkpT9A0T03o:XfO4ZBRxpV+4wPwKloo
MD5:	366C09E4A4CC10006E593F5B3F3461D7
SHA1:	A0DABFBEEB66E26FB342844EA41772D7A1D19C24
SHA-256:	9B27FE7E7054F36E279993F19E52E18AC03360D117AE80C42B4E984A97C590AA
SHA-512:	670F32D698C7992038E736D3AD40098D8589C0C5A1379E32A0F02A02FAF251B1312CAD131DDADC3F80B23A3821A91689F2E310309028BDDDF227D532EB505A20
Malicious:	false
Preview:	# Encoding file: ksc5601, double-byte..D..233F 0 89..21..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..000030003001300200B72025202600A8300300AD20152225FF3C223C20182019..201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7..00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640..222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6..25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D..221D2235222B222C2208220B2286228722822283222A222922272228FFE20000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macCentEuro.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.4295694929963667
Encrypted:	false
SSDEEP:	24:8jHVBUlJvRj7SOVbusZhAMiZyi77qHVPJSf2FcVDu1LEe4qPPMl2J89:8jMlBVnrAMiwMmHEmJ4IMgi9
MD5:	10850BCFB943318284D6191494EBD7D5
SHA1:	237D5DDF7969A422991F17021244D13A2BB0DE92
SHA-256:	81ECA6840B87F2DEF9FCDD171A55C2D71A49386D88401CE927AE57D7DDD7AAAA
SHA-512:	D797781C228B70D2D83DB8ABA08F840CE49846C9473CC89A2E316900D9E08A63142E68AD9ABBB2EF67BF9F1D392772FAB36CCC09632022A1437AE27C11F2284F
Malicious:	false
Preview:	# Encoding file: macCentEuro, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179..017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC..202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E..012F012A22642265012B0136220222110142013B013C013D013E0139013A0145..0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C..20132014201C201D2018201900F725CA014D0154015501582039203A01590156..01570160201A201E

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macCroatian.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.3992482002374516
Encrypted:	false
SSDEEP:	24:8ULyHVBUlJvRj7SOVbusZhAMiZyi77qsTMdKxOZwwL+KR5D/jlJy6QWky:8ULyMlBVnrAMiwMmOsL+KR5DblE85
MD5:	A60FBDE33D13C732095713D1AB6713AB
SHA1:	4B0EB443F2D0E4B8DB7D0435F9311E5F9A625123
SHA-256:	BBE6F5EBB5EAB08C91DF7D524FAF39B03AA8B9F84C67ABA0553A84EC56668CB9
SHA-512:	3EEBA6BA3FCD875AFBD5DF41EDC21E872416A48D03343232904CC99CAF913045DAF7B1A1ACD0949EF794AD7B6C9AE8F93808423FFC4B67718E732B2FF5D9B6D7
Malicious:	false
Preview:	# Encoding file: macCroatian, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8..221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8..00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153..01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB..201300B7201A201E

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macCyrillic.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.4178221849964903
Encrypted:	false
SSDEEP:	24:8dHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJY:8dMlBVnrAMiwMm8Y6zUk+UVsJY
MD5:	C390D66441AC61CCF0A685CA5EE0BC1C
SHA1:	FCAE825B54400B9D736EF22A613E359E3F0FA6C2
SHA-256:	76EFE571ADDA7AED467F146CB0BD3A2351F2A720508EA0642C419F5347789CAA
SHA-512:	C891DB15E0F600965885DE6745EDD2A4E3A6A20CA30A9AAE89CBD8C429F8455C4AF7F2FC053FB3D730D8544AB6A6E78E769DB93DAD7B29868B746FA10373F021
Malicious:	false
Preview:	# Encoding file: macCyrillic, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..0430043104320433

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macDingbats.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.870022681111701
Encrypted:	false
SSDEEP:	24:87JMHkUlJvRjmf9RCsUBOdXsCbbNviANpkDP1XFAoE4xSF5HrBPkdn:87KvlA9RCs6CXrViANUP1XFA9eSvdPKn
MD5:	DCE78527E3A7B7CB1DE9EE5FAF12AFC6
SHA1:	20F4A3F4DB6B3422C04EBB6B21A568E4C173F9C1
SHA-256:	062E31D48DC33160999074E49205E08C3655DFF91C2C87F254522E6EBCE2DD96
SHA-512:	627F5FD2F12B341F2D7EE9032946FE057C4AC74D99687178CEA98B3E150307BB6AA2495B0FA46400760D467E2BF589BE31E998E25CE1D1E8465DA61F22047345
Malicious:	false
Preview:	# Encoding file: macDingbats, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..00202701270227032704260E2706270727082709261B261E270C270D270E270F..2710271127122713271427152716271727182719271A271B271C271D271E271F..2720272127222723272427252726272726052729272A272B272C272D272E272F..2730273127322733273427352736273727382739273A273B273C273D273E273F..2740274127422743274427452746274727482749274A274B25CF274D25A0274F..27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F..F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..0000276127622763276427652766276726632666266526602460246124622463..2464246524662467246824692776277727782779277A277B277C277D277E277F..2780278127822783278427852786278727882789278A278B278C278D278E278F..2790279127922793279421922194219527982799279A279B279C279D279E279F..27A027A127A227A3

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macGreek.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1113
Entropy (8bit):	3.4954458011071323
Encrypted:	false
SSDEEP:	24:8dOHVBUlJvRj7SOVbusZhAMiZyi77qJlbaBMD2aSY5us36Ekp1ysOSU2imR:8kMlBVnrAMiwMm7aKPVusqx1ysOJjmR
MD5:	0CC92F685A4132BE4B030006670D81CE
SHA1:	13B1074A90055E9EA061A6206A9C004DA29967A9
SHA-256:	1AABE561B5C944ABD11C293D4ACAC0F3A4A5A9E84A0342D066F4E3E992348895
SHA-512:	E1AF3D47D681CD68B6063DEC1241631CABE86FE835232FA73D855AC74D0175540D46511282BE7198A67A37970A5D05CDECF55C10424ED9C1413C108F116094D9
Malicious:	false
Preview:	# Encoding file: macGreek, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8..00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC..2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7..039100B12264226500A503920395039603970399039A039C03A603AB03A803A9..03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153..20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F..03CD03B103B203C803B

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macIceland.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.3991839018654573
Encrypted:	false
SSDEEP:	24:8KHVBUlJvRj7SOVbusZhAMiZyi77qscqMVmOZmk/LYRldjY/g4JyMWG:8KMlBVnrAMiwMmzqi/LYRlYBEXG
MD5:	747ADBE54D6992467415E322326FA1B9
SHA1:	5E3967B5DDF3A6DBF07E90ED6B9B9C2F3F3F35FE
SHA-256:	6FD08CE6FBA521D51E8058DE5C2DBD6583B80306A8BE7D015361F76314E70A35
SHA-512:	A04B946993985BF1F8FBA3A7A9AD3838F43F8F27F69B1FB1015D9DC8612AAFCE24E30CBC1FCABBDFB359FD487D51F70F18DA0CDA4A87749A2C82309CEB054849
Malicious:	false
Preview:	# Encoding file: macIceland, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE..00FD00B7201A201E2

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macJapan.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	48813
Entropy (8bit):	3.3767502114972077
Encrypted:	false
SSDEEP:	768:K/RPrUHiJrKWkyY/W2wHiwWnwWOORY+gutSJi:KVUidzJCurDGSk
MD5:	3DCD22325E0194AAD4959C939B1DE24D
SHA1:	ABEF1372FBDA83714CE29E015D9A198D4B37B21C
SHA-256:	47007D9EBF4D34C6CE3599E50AFC7C1CF8129B88994DE2C2A857C09003F9CD2B
SHA-512:	B8ADFD2315EA38E5F7D4DED219759380069AAB539F1B5AAA5626CE32428CBBEB5E8215AD8351E023BCF72FA4DC30AB40CF59D6D45E33B6D1A6B41BEBFD4BD4C2
Malicious:	false
Preview:	# Encoding file: macJapan, multi-byte..M..003F 0 46..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macRoman.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1113
Entropy (8bit):	3.4060725247347516
Encrypted:	false
SSDEEP:	24:8THVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldjBpmg4JyMWG:8TMlBVnrAMiwMmOi/LYRlTsBEXG
MD5:	34691FADC788B85D98F63159640C7DD0
SHA1:	C8B3D084D3E831EFF6ECEF71B2029545F214C3D4
SHA-256:	C83D971D6BC0284EF323C197896E38C57A5FF44784E451EC2997EDA70C0DD85C
SHA-512:	77D5676F9B7AF7FD1D612A1C426889D8F2C0191887E180B78C4AA42202928A1B3078B76BD3C5F5ABB2A5CE1AE913E3CA6EFDE0483D2A2B0EFC173EF25EAE1D67
Malicious:	false
Preview:	# Encoding file: macRoman, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02..202100B7201A201E203

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macRomania.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.412326247178521
Encrypted:	false
SSDEEP:	24:8tHVBUlJvRj7SOVbusZhAMiZyi77qsTMVZ5OZwYRldj/T9g4JyMWG:8tMlBVnrAMiwMmOA7YRlFT9BEXG
MD5:	04E25073BFB0019D8381B72F7B433F00
SHA1:	B63B0AD9F10A44B0DDD12A3BDBCDEB2992D6D385
SHA-256:	0B805DAF21D37D702617A8C72C7345F857695108D905FF378791F291CEA150F0
SHA-512:	0514EC054676C15C65B01B02747CDBAD79BC89FD1A24A17797A8729752FB748FEDBE920E7BBFF41A6DA4BA99002E3B8DB674D53E30485DC36F6BF737EAF11702
Malicious:	false
Preview:	# Encoding file: macRomania, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E..221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163..202100B7201A201E2

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macThai.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	3.6062142626989004
Encrypted:	false
SSDEEP:	24:88HVBUlJvRj7SOVbusZhAMiZyi77qqJipJwHmEU4AyqU+TpH:88MlBVnrAMiwMmqJ8Jf4AyqUe
MD5:	06DC6BA6E4A75CD7FF2D7A4248912C61
SHA1:	23FB16763A8F11EF48E805E4F453C2F812D48FC4
SHA-256:	A1802A2FEB01B255EC7C17425EEE4525372DF8CE226F4047D149172EB438F913
SHA-512:	41A487EC5C36C17B2746C5DC770882A836E6E75CF6A14C31595EB211022F0476BD3B953497C447F21554769F127C3A56E5B6EF8FB3C20A8AFF8C67E0CC94359D
Malicious:	false
Preview:	# Encoding file: macThai, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899..FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD..00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F..0E400E410E420E430E44

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macTurkish.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.422718883614008
Encrypted:	false
SSDEEP:	24:8QjHVBUlJvRj7SOVbusZhAMiZyi77qsTMVmOZmk/LYRldD8g4JyS:88MlBVnrAMiwMmOi/LYRlWBES
MD5:	4EA94A0DB35BED2081A2CC9D627A8180
SHA1:	AB2AC3ADA19F3F656780FF876D5B536A8DCE92C6
SHA-256:	AFB66138EBE9B87D8B070FE3B6E7D1A05ED508571E9E5B166C3314069D59B4E4
SHA-512:	7888F560D3728732BE1B7DCE49ECB61F3399CEF11191F4116C891E1D147B2A90ED8FB4A5E7B51904A001C47750BD9EB1B15EA5BA5B4EC5D69CDE7704B69529AD
Malicious:	false
Preview:	# Encoding file: macTurkish, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8..00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC..202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8..221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8..00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153..20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F..202100B7201A201E2

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\macUkraine.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	3.4157626428238723
Encrypted:	false
SSDEEP:	24:8TzHVBUlJvRj7SOVbusZhAMiZyi77qb+SAJlz9a4piS1yk+5yye3cJd:8PMlBVnrAMiwMm8Y6zUk+UVsJd
MD5:	A5B48D6F2678579CBE6EA094A4655071
SHA1:	A13A41D530B21CE8443AFD7E811286537C5BA9C7
SHA-256:	F7E11736C9FF30102B31EC72272754110193B347433F4B364921E8F131C92BF0
SHA-512:	612F9D528CE940B5CA9E67CB127013A104655207511F4CF39C8696A127E6A8F4867F5603DCFB78C25A55668C6EE70F2997A8D1626F6F1DD44B19260967F17097
Malicious:	false
Preview:	# Encoding file: macUkraine, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0410041104120413041404150416041704180419041A041B041C041D041E041F..0420042104220423042404250426042704280429042A042B042C042D042E042F..202000B0049000A300A7202200B6040600AE00A9212204020452226004030453..221E00B122642265045600B504910408040404540407045704090459040A045A..0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455..20132014201C201D2018201900F7201E040E045E040F045F211604010451044F..04300431043204330

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\shiftjis.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	42552
Entropy (8bit):	3.5565924983274857
Encrypted:	false
SSDEEP:	768:w/RPrUHiJrwWkyY/W2wHiwWnwWOORY+gutSX:wVUid5JCurDGSX
MD5:	EEB45AF9D7104872FE290D1EC18AB169
SHA1:	A80CF4EA46301F0B8B4F0BC306270D7103753871
SHA-256:	4A15ED210126BCDAE32543F60EB1A0677F985F32D49FCE923B9FAE8C5BCF3DA4
SHA-512:	C359042B04441AA50E536B23EEA0C6C7B2C1893DFB9CDB5459D3B46945D3BB50FD7A32A4F4E26A83622E76D3D2BB0DBBC3D1F3FB87AAF40520A243165B82AB34
Malicious:	false
Preview:	# Encoding file: shiftjis, multi-byte..M..003F 0 40..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E007F..0080000000000000000000850086008700000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F..FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F..FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F..FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F..0000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\symbol.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	3.73983895892791
Encrypted:	false
SSDEEP:	24:SdHkUlJvRjvRV7ZQsoRmSds2AsSemxUs+Jw1Viv6ObTXyn:avlJV7ZQsoRmosGSPxU/JOm6wTXyn
MD5:	D59E748D863A5FAEF0CEEC2564E041A3
SHA1:	4FFF3BE37F50C090FFC581F1C7769E20281E90C3
SHA-256:	9660537A7B62996478555C6F57C1962C78FB3972F19370B2E395C44842818A1F
SHA-512:	BF8FD0CF1CC55564C46976F53F441B26819ADBA7AB7BB04FF3FF5A313366FC3049DF29A839CCCB05EDEF4A7ECBB49FFCA62518EDA90AF2D7781874A8435073AE
Malicious:	false
Preview:	# Encoding file: symbol, single-byte..S..003F 1 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002122000023220300250026220D002800292217002B002C2212002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..22450391039203A70394039503A603930397039903D1039A039B039C039D039F..03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F..F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF..03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F..0080008100820083008400850086008700880089008A008B008C008D008E008F..0090009100920093009400950096009700980099009A009B009C009D009E009F..000003D2203222642044221E0192266326662665266021942190219121922193..00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5..21352111211C21182297229522052229222A2283228722842282228622082209..2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3..22C42329F8E8F8E9F8EA2

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\encoding\tis-620.enc

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	3.0553142874336943
Encrypted:	false
SSDEEP:	24:ZlHVBUlJvRj7SOVbusZhAMiZyi77qsDHmEU4AyqU+TWwdd:PMlBVnrAMiwMmss4AyqUSd
MD5:	467A67DE6809B796B914F5BFF98EF46D
SHA1:	C62418071A6C9CB0DCE3F67E130BFD2FB7AB0B58
SHA-256:	50B62381D6EDD4219F4292BFDC365954491B23360DE7C08033E7218A3D29C970
SHA-512:	BF98305AA7D759A087B9EABDC404714D8DC6B4F1BEED4ED0E1FFE646641E1AECA307673D64CF95FD09546D977B3409D6C04F56DCCA1D6332B0D9B6DD460B77A9
Malicious:	false
Preview:	# Encoding file: tis-620, single-byte..S..003F 0 1..00..0000000100020003000400050006000700080009000A000B000C000D000E000F..0010001100120013001400150016001700180019001A001B001C001D001E001F..0020002100220023002400250026002700280029002A002B002C002D002E002F..0030003100320033003400350036003700380039003A003B003C003D003E003F..0040004100420043004400450046004700480049004A004B004C004D004E004F..0050005100520053005400550056005700580059005A005B005C005D005E005F..0060006100620063006400650066006700680069006A006B006C006D006E006F..0070007100720073007400750076007700780079007A007B007C007D007E0000..0000000000000000000000000000000000000000000000000000000000000000..0000000000000000000000000000000000000000000000000000000000000000..00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F..0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F..0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F..0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F..0E400E410E420E430E44

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\history.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8235
Entropy (8bit):	4.855903177272536
Encrypted:	false
SSDEEP:	192:Hf8PxPu7pUHBpqyzmY5rEk/fvs+AokFlTGHts1H/tsEGZPBtsLIVn++G:H6Pu7ELJTtyli8Ozz+L
MD5:	8609B624CD3EC63DD02DBF89455C3A9B
SHA1:	B3E1843E34C38AA668FFDDF435A1A65D55449CA0
SHA-256:	5123DB837EADF45712EA7D449BC40BFD3E8E16D3D71E7D0CE9A32F164973D767
SHA-512:	B20B75473F34209888F38EE570B8A96061760E88466DFC2EC55C814968DC7F67D92D255E8635188B60455B88F2D1D517747613AD0F366D60412D2D6ECE231B0E
Malicious:	false
Preview:	# history.tcl --..#..# Implementation of the history command...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.....# The tcl::history array holds the history list and some additional..# bookkeeping variables...#..# nextid.the index used for the next history list item...# keep..the max size of the history list..# oldest.the index of the oldest item in the history.....namespace eval ::tcl {.. variable history.. if {![info exists history]} {...array set history {... nextid.0... keep.20... oldest.-20...}.. }.... namespace ensemble create -command ::tcl::history -map {...add.::tcl::HistAdd...change.::tcl::HistChange...clear.::tcl::HistClear...event.::tcl::HistEvent...info.::tcl::HistInfo...keep.::tcl::HistKeep...nextid.::tcl::HistNextID...redo.::tcl::HistRedo.. }..}.....# history --..#..#.This is the main history command. See the

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\http1.0\http.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10066
Entropy (8bit):	4.806771544139381
Encrypted:	false
SSDEEP:	192:kipkqA3KsZMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsZ8kGJ4kIWPaDFzTd
MD5:	C2092F8CA2D761DFA8C461076D956374
SHA1:	90B4648B3BC81C30465B0BE83A5DB4127A1392FB
SHA-256:	8C474095A3ABA7DF5B488F3D35240D6DE729E57153980C2A898728B8C407A727
SHA-512:	09CE408886E2CEADDF70786A15D63AF9A930E70CAC4286AC9DDD2094C8EDCF97A2ADC2D3D2659B123F88719340D3B00D9F96E9BC7C8B55192735C290E7D24683
Malicious:	false
Preview:	# http.tcl..# Client-side HTTP for GET, POST, and HEAD commands...# These routines can be used in untrusted code that uses the Safesock..# security policy...# These procedures use a callback interface to avoid using vwait,..# which is not defined in the safe base...#..# See the http.n man page for documentation....package provide http 1.0....array set http {.. -accept /.. -proxyhost {}.. -proxyport {}.. -useragent {Tcl http client package 1.0}.. -proxyfilter httpProxyRequired..}..proc http_config {args} {.. global http.. set options [lsort [array names http -*]].. set usage [join $options ", "].. if {[llength $args] == 0} {...set result {}...foreach name $options {... lappend result $name $http($name)...}...return $result.. }.. regsub -all -- - $options {} options.. set pat ^-([join $options \|])$.. if {[llength $args] == 1} {...set flag [lindex $args 0]...if {[regexp -- $pat $flag]} {... return $http($flag)...} else {... return -code er

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\http1.0\pkgIndex.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	746
Entropy (8bit):	4.711041943572035
Encrypted:	false
SSDEEP:	12:jHx5XRsLzhjJS42wbGlTULuUAZb3KykszLl7+HkuRz20JSv6C3l5kMn:bHRsRJS42wbGlTUcZ+yk2Lli1z2jxXkM
MD5:	A387908E2FE9D84704C2E47A7F6E9BC5
SHA1:	F3C08B3540033A54A59CB3B207E351303C9E29C6
SHA-256:	77265723959C092897C2449C5B7768CA72D0EFCD8C505BDDBB7A84F6AA401339
SHA-512:	7AC804D23E72E40E7B5532332B4A8D8446C6447BB79B4FE32402B13836079D348998EA0659802AB0065896D4F3C06F5866C6B0D90BF448F53E803D8C243BBC63
Malicious:	false
Preview:	# Tcl package index file, version 1.0..# This file is generated by the "pkg_mkIndex" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}]..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\init.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	25633
Entropy (8bit):	4.8854383645737895
Encrypted:	false
SSDEEP:	768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
MD5:	982EAE7A49263817D83F744FFCD00C0E
SHA1:	81723DFEA5576A0916ABEFF639DEBE04CE1D2C83
SHA-256:	331BCF0F9F635BD57C3384F2237260D074708B0975C700CFCBDB285F5F59AB1F
SHA-512:	31370D8390C4608E7A727EED9EE7F4C568ECB913AE50184B6F105DA9C030F3B9F4B5F17968D8975B2F60DF1B0C5E278512E74267C935FE4EC28F689AC6A97129
Malicious:	false
Preview:	# init.tcl --..#..# Default system startup file for Tcl-based applications. Defines..# "unknown" procedure and auto-load facilities...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2004 Kevin B. Kenny. All rights reserved...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# This test intentionally written in pre-7.5 Tcl..if {[info commands package] == ""} {.. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]"..}..package require -exact Tcl 8.6.12....# Compute the auto path to use in this interpreter...# The values on the path come from several locations:..#..# The environment variable TCLLIBPATH..#..# tcl_library, which is the directory containing this init.tcl script...# [t

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\af.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	4.10054496357204
Encrypted:	false
SSDEEP:	12:4EnLB383Hcm0hH9BncmtR7tK9dUVxMmALfpKIdzVJLd3xfjTuLM+vzkHWZ6tH9H0:4aR838HH9ekCkMmEfpK2xx2jiWZ0VbY
MD5:	DA8BA1C3041998F5644382A329C3C867
SHA1:	CA0BD787A51AD9EDC02EDD679EEEEB3A2932E189
SHA-256:	A1EACA556BC0CFBD219376287C72D9DBBFAB76ECF9BF204FD02D40D341BAF7DA
SHA-512:	4F086396405FDFE7FBDA7614D143DE9DB41F75BDBD3DB18B1EE9517C3DCCED238DD240B4B64829FD04E50F602DBF371D42A321D04C4C48E4B8B2A067CA1BAF2E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Ma"\.. "Di"\.. "Wo"\.. "Do"\.. "Vr"\.. "Sa"].. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \.. "Sondag"\.. "Maandag"\.. "Dinsdag"\.. "Woensdag"\.. "Donderdag"\.. "Vrydag"\.. "Saterdag"].. ::msgcat::mcset af MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset af MONTHS_FULL [list \.. "Januarie"\.. "Februarie"\.. "Maart"\.. "April"\.. "Mei"\.. "Junie"\.. "Julie"\.. "Augustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""].. ::msgcat::mcset af AM "VM

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\af_za.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.925537696653838
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xouFygMouFqF3v6ay/5ouFy9+3vR6HyFvn:4EnLB383RAgeYF3v6ay/RAI3voSVn
MD5:	1B9DCD1C6FCDDC95AE820EA8DA5E15B8
SHA1:	E8160353FD415BAB9FD5ACCA14E087C5E6AE836E
SHA-256:	1548988458BBF0DFCCC23B7487CEC0E9C64E4CC8E045723E50BEC37C454A8C81
SHA-512:	532AF060B95AED5E381B161BE56BC88D91A8F3DF2ACFD835491991F99FE752ADB4A3F93AB6D4E68F7042C28A3C1DD87A6312DFD9FFFAFD6ECE3F1B76837C5B7F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y".. ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ar.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2018
Entropy (8bit):	4.477377447232708
Encrypted:	false
SSDEEP:	24:4aR83gr/fsS/Sm8p4M/n1KsPktE30AiJcAxi9CEzdEvSCHvMSV:43UkiSm8p3nX0EzdCSCPV
MD5:	D264D01B46D96455715114CAEDF9F05E
SHA1:	A3F68A4C6E69433BD53E52B73041575F3B3AC3F2
SHA-256:	B69D0061A728D59F89FF8621312789CD9F540BF2E2ED297804D22F6278561D85
SHA-512:	A4163DAA6821B293EADD5D499E0641A8B7C93180C710D6B364AE8681A8FF6F35EC948C8DDBE960A8466AF1ACABC15B0D465A08B084617E8005D708459F7E74D3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \.. "\u062d"\.. "\u0646"\.. "\u062b"\.. "\u0631"\.. "\u062e"\.. "\u062c"\.. "\u0633"].. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar MONTHS_ABBREV [list \.. "\u064a\u0646\u0627"\.. "\u0641\u0628\u0631"\.. "\u0645\u0627\u0631"\.. "\u0623\u0628\u0631"\.. "\u0645\u0627\u064a"\.. "\u064a\u0648\u0646"\.. "\u064a\u0648\u0644"\.. "\u0623\u063a\u0633"\.. "\u0633\u0628\u062a"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ar_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.872222510420193
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoKNvfcoKU3v6xyFjoKNo+3vfXM68vn:4EnLB3831vfD3v6g9F3vfc6+n
MD5:	430498B4AB1E77C86BC1311A49747581
SHA1:	684EAD965D9010C2A6E73DCACB2224FDE585F9FF
SHA-256:	2E04B96DA002519D28125918A22FF2BB9659A668A7BCAD34D85DDDECEC8DC0B4
SHA-512:	9F85A88A383DCFC54DAA6253D94C307A14B1CC91D5C97AF817B8122AF98025AB2430D0B2D656EBED09E78FB854D1F9CF99F3B791A6ECB7834112012739140126
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y".. ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ar_jo.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.08645484776227
Encrypted:	false
SSDEEP:	24:4aR83sxS/Sm819+es/Ii/R91bpH0+U0c+es/Ii/R91bpH0+UO:43wiSm815MbJbHgMbJbp
MD5:	5C62D606F4F14BC8994B28F9622D70DD
SHA1:	E99F8CC5D330085545B05B69213E9D011D436990
SHA-256:	5ADBB3D37C3369E5FC80D6A462C82598D5A22FAEF0E8DF6B3148231D2C6A7F73
SHA-512:	81AC9200459B0896E27A028BD089A174F7F921B0367BC8FF1AB33D3E561417B6F8EC23DAB750ECB408AC8A11CDFDBFA4F890F9E723BB8607B017C9FEE00928A0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ar_lb.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.083347689510237
Encrypted:	false
SSDEEP:	24:4aR83LxS/Sm8S9+es/Ii/R91bpH0+U/c+es/Ii/R91bpH0+UO:431iSm8S5MbJbQgMbJbp
MD5:	6FC1CC738207E2F8E0871103841BC0D4
SHA1:	D2C62C7F6DA1EF399FCBE2BA91C9562C87E6152F
SHA-256:	1FC13070CF661488E90FECE84274C46B1F4CC7E1565EAB8F829CCAA65108DFCA
SHA-512:	E547D5CBB746654051AFDA21942075BC2224C2FF75D440C6C34C642AD24CF622E520FF919B8BD4AFC0116D9CE69B3ABA4E81EE247C1388F3C5741150201F5C60
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ar_sy.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.084701680556524
Encrypted:	false
SSDEEP:	24:4aR83lxS/Sm8M9+es/Ii/R91bpH0+UBc+es/Iv/I91bpH0+UO:43LiSm8M5MbJbSgMo0bp
MD5:	8188C37CA44FEFFF8D895AAD503AD4F6
SHA1:	C48F2E3B9FC055704D2DAFDC67E9D08EE6897D45
SHA-256:	294F3E46C55453EDAD44567E1330F9B43E69A07FA0655B24DD2780A4490C1194
SHA-512:	F86FCFC7C460473D46C472041AB2E1F9388CF34BCA9050295D1DAE454E35A2A0320D0C61D5E8CBB832AF74FFDD1A7511AF32EA2A53B481F39A1CBCF5F086D514
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\be.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	4.27810535662921
Encrypted:	false
SSDEEP:	48:43PI8IKQGQ8mA/XxQJxQnA9QJlPyI/tbCaQICMIcQ8InVI5tNIzQFIQQLtChjsI4:2PItK5BSb9ajfycCW5IzdQNxK
MD5:	6334BDDFC1E0EAE4DBB2C90F85818FD8
SHA1:	085EDC3D027D6B5A6A6A2561717EA89C8F8B8B39
SHA-256:	A636A82C7D00CCDC0AF2496043FFA320F17B0D48A1232708810D3BB1453E881E
SHA-512:	18ADB77314FCFD534E55B234B3A53A0BC572AB60B80D099D2F3B20E0C5FE66179FDC076AA43200DB3CA123BC6216989EC41448FA624D3BA9633413AD8AD6034C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0430\u0442"\.. "\u0441\u0440"\.. "\u0447\u0446"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \.. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\.. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\.. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\.. "\u0441\u0435\u0440\u0430\u0434\u0430"\.. "\u0447\u0430\u0446\u0432\u0435\u0440"\.. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset be MONTHS_ABBREV [list \.. "\u0441\u0442\u0434"\.. "\u043b\u044e\u0442"\.. "\u0441\u043a\u0432"\.. "\u043a\u0440\u0441"\.. "\u043c\u0430\u0439"\.. "\u0447\u0440\u0432"\.. "\u043b\u043f\u043d"

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\bg.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	4.4251657008559935
Encrypted:	false
SSDEEP:	48:43EUAIlnQf/QVdQ81mnEZqEavWQEQ3QvQrQL0QjQTtQDCQSY4tqP:27xMk+nEZqE3biIYbUi+C9y
MD5:	E5225D6478C60E2502D18698BB917677
SHA1:	52D611CB5351FB873D2535246B3A3C1A37094023
SHA-256:	CFE4E44A3A751F113847667EC9EA741E762BBDE0D4284822CB337DF0F92C1ACA
SHA-512:	59AB167177101088057BF4EE0F70262987A2177ECB72C613CCAAE2F3E8D8B77F07D15DA5BE3B8728E23C31A1C9736030AA4036A8CD00A24791751A298B3A88B3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0434"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u043b\u044f"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0421\u0440\u044f\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\.. "\u041f\u0435\u0442\u044a\u043a"\.. "\u0421\u044a\u0431\u043e\u0442\u0430"].. ::msgcat::mcset bg MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset bg MO

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\bn.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2335
Entropy (8bit):	4.107102006297273
Encrypted:	false
SSDEEP:	24:4aR835e/MWrD//6HFEVcVVcCVcTUTVckVEVcT7VcEEVcby/Vcn0VcMr/0VcM8VcQ:43ktX++QalMObalMZ6IE6V
MD5:	5D25E7FC65824AC987535FEA14A4045C
SHA1:	85C10F05823CD3263FC7B3EC38796BEC261B3716
SHA-256:	890EA6521DEB1B3C3913CCD92562F6360E064DAEE2E2B0356A6DD97A46264A1F
SHA-512:	5D8A88ACAEBBF3CD721F288FA0F1FEE517EE568CA5482E30CFA1E36CD37DF011C449090E2D9041F1D046A191F13D4C5C4B6F9E2F16FD259E63CE46ECC4E4F81F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \.. "\u09b0\u09ac\u09bf"\.. "\u09b8\u09cb\u09ae"\.. "\u09ae\u0999\u0997\u09b2"\.. "\u09ac\u09c1\u09a7"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\.. "\u09b6\u09c1\u0995\u09cd\u09b0"\.. "\u09b6\u09a8\u09bf"].. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \.. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\.. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\.. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\.. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\.. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\.. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"].. ::msgcat::mcset bn MONTHS_ABBREV [list \.. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\.. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\bn_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.868201122972066
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xovtvfluo/E3v6xyFjovto+3vflm68vn:4EnLB383UtvfltE3v6g8tF3vflm6+n
MD5:	B91BB2ABC23B90962D2070B9588F2AB5
SHA1:	CBB4E9CD600773792C6E9F3E6B27E99C1846B44F
SHA-256:	B3D8A4632290B0F3DA690E47C1FDF06A8B9E171A96E938AFDB0DD52CF806CE54
SHA-512:	932FC4B8C3CA72731187D56012AD7DD7777C4D447F16EEB17B9D68235C9590DF99992FD22B8D7C85A843A610F93CD36FAFA993C34C441255A1C0A93C73BC5FE4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ca.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.2880653012847985
Encrypted:	false
SSDEEP:	24:4aR83FMVBNfPg+g+RjMu5+C6MB4zdiwvWvn:432g6jh65zd3gn
MD5:	72DDD60C907DD235BCE4AB0A5AEE902C
SHA1:	06150F793251687E6FBC3FDA3BC81BCBFC7DE763
SHA-256:	3BE295DCC8FCDC767FED0C68E3867359C18E7E57D7DB6C07236B5BC572AD328E
SHA-512:	3B0A85003692F1E46185D5CC09236D2DA5E6D29166C9812D07A7D6BF6AC6C3B0708F91C6899768D4DBA3528081B8B43E09F49622B70F1CF991AFAC5352B6BA37
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \.. "dg."\.. "dl."\.. "dt."\.. "dc."\.. "dj."\.. "dv."\.. "ds."].. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \.. "diumenge"\.. "dilluns"\.. "dimarts"\.. "dimecres"\.. "dijous"\.. "divendres"\.. "dissabte"].. ::msgcat::mcset ca MONTHS_ABBREV [list \.. "gen."\.. "feb."\.. "mar\u00e7"\.. "abr."\.. "maig"\.. "juny"\.. "jul."\.. "ag."\.. "set."\.. "oct."\.. "nov."\.. "des."\.. ""].. ::msgcat::mcset ca MONTHS_FULL [list \.. "gener"\.. "febrer"\.. "mar\u00e7"\.. "abril"\.. "maig"\.. "juny"\.. "juliol"\.. "agost"\.. "setembre"\.. "octubre"\.. "novembre"\.. "desembre"\.. ""].. ::msg

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\cs.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	4.466447248030554
Encrypted:	false
SSDEEP:	24:4aR83U4nZ4yJTkkG3mYWEZqO1R3DNBEVG+PYhxrU4UF3ecCvt7/v3e6:43TJTGmnEZqE5/EVEDOGtDp
MD5:	F32EAD82CC26754C5A8E092873A28DB3
SHA1:	325124660F62242B24623B4B737CB4616F86CFF3
SHA-256:	AFEA12A16A6FA750EA610245133B90F178BA714848F89AEC37429A3E7B06BE1A
SHA-512:	04E335AAFBF4D169983635FC87BCFFE86FBA570A3E1820D20240EF7B47E7A3CD94AE3598543DCE92A1F82B5146CAAD982EFE9490EFD9E581D58515CFC3930581
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "\u00dat"\.. "St"\.. "\u010ct"\.. "P\u00e1"\.. "So"].. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \.. "Ned\u011ble"\.. "Pond\u011bl\u00ed"\.. "\u00dater\u00fd"\.. "St\u0159eda"\.. "\u010ctvrtek"\.. "P\u00e1tek"\.. "Sobota"].. ::msgcat::mcset cs MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset cs MONTHS_FULL [list \.. "leden"\.. "\u00fanor"\.. "b\u0159ezen"\.. "duben"\.. "kv\u011bten"\.. "\u010derven"\.. "\u010dervenec"\.. "srpen"\.. "z\u00e1\u0159\u00ed"\.. "\u0159\u00edjen"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\da.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	4.315504392809956
Encrypted:	false
SSDEEP:	24:4aR83wV0tBVYuorIsmZ5meAxyISjTHU92WFVwpwvbvT:43w+DiuorreAY0zw8rT
MD5:	27A6A8BE8903AEF9D0BE956906A89583
SHA1:	EE29FDF67CB3AE150DF6BBBE603C1C3F5DA28641
SHA-256:	0D422A991BCA13FE9033118691CFEDAB0F372222EBB0BC92BAF8E914EE816B84
SHA-512:	0E702A679AD94BF479226B7DE32077562F3F95210F6453AE564138386DBB179941BA5359AEE9AC532F4A6E5BE745D6962D6B638A21DD48B865716F2FD2A0CB01
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset da MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset da MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marts"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset da B

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\de.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	4.349293509679722
Encrypted:	false
SSDEEP:	24:4aR83cFNSsZKKgXum47fpK2OaSIui7dHqWZ0ZIBFJWJvvvWIn:43InZKKgXoOqx1W67W9XWIn
MD5:	EE3963A5F7E29C05C9617BE3FD897114
SHA1:	0F978CA174DF596817F872B5EF1B447B9DFE651C
SHA-256:	4C27733502066E8391654D1D372F92BF0484C5A3821E121AE8AA5B99378C99AE
SHA-512:	EA933709C68F8199858A1CC1FFDA67EE7458CC57A163E672535EB0B4C37BFDC200604C7506748DAC3158B6CA63C2F076A2C6252B2A596E59F83D3B1D4BC9C901
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Mo"\.. "Di"\.. "Mi"\.. "Do"\.. "Fr"\.. "Sa"].. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mrz"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de BCE "v.

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\de_at.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	847
Entropy (8bit):	4.412930056658995
Encrypted:	false
SSDEEP:	24:4aR831sMm47fpK2++SIui7dHqWZ0ZItovGvzvW:431h+mx1Wm+QjW
MD5:	A6227CD4F7434952D093F1F3C64B4378
SHA1:	0DDB9A49CB83DDF2396B2ECA85093260710496C2
SHA-256:	1C02D14140196623297F858E2EEF00B4159E1C6FAFE044EC65A48C9C24D46540
SHA-512:	D63F34024356F5CE0335D14EA557F4BBF238CCA8265DD27C039C70F7F28FE737F368B030DEE10B2C536512D2815E1F5B19838D08745C6A76A39050D573597EB3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_AT MONTHS_ABBREV [list \.. "J\u00e4n"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_AT MONTHS_FULL [list \.. "J\u00e4nner"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset de_AT TIME_FORMAT "%T".. ::msgcat::mcset de_AT TIME_FORMAT_12 "%T".. ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\de_be.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	4.389082225723362
Encrypted:	false
SSDEEP:	24:4aR83B8VSysVB8VsZKKgJ5Mm47fpK26aSIui7dHqWZ0ZIlj5VevjevbDvW:43Bt1VBbZKKgJs6qx1Wc5VojobzW
MD5:	C351057D8E5328C0790901D1F4DBEC9F
SHA1:	F73DE8AEF7F8083B0726760AA003E81067A68588
SHA-256:	532845CD15EC821C1939D000C648694A64E8CA8F0C14BAD5D79682CF991481CE
SHA-512:	8152AD082D0A6A4EBE7E1CCA9D4A5F2E48ABE3F09F4385A517C523A67CA3B08E0F20C193D0F6850F37E55ED0CD6FBD201FE22CC824AF170976D04DB061212F2D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \.. "Son"\.. "Mon"\.. "Die"\.. "Mit"\.. "Don"\.. "Fre"\.. "Sam"].. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de_BE MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_BE MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::m

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\el.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	4.371322909589862
Encrypted:	false
SSDEEP:	24:4aR833v+ZYYWtv+nWfFyL1NYOg+EKVJQ19tWQYmYaYRn9sWuSAJIJ6eRa6WrmdlX:43/pZyLjY0uYR9QmdkjC9r
MD5:	7DD14B1F4FF532DCAF6D4C6F0DF82E9A
SHA1:	707875FEF4207EBB71D066FDC54C7F68560C6DAD
SHA-256:	8B23E0E2F0F319BB9A2DFDCCDC565FF79A62FA85094811189B6BC41594232B6B
SHA-512:	5ECA072DE5DD7890270AE268C7C8D40EE2DB6966643604D16E54194DB0AD74FDA8D04848331E61B387E8B494AF18252E38671D939069EC4C90C672A629563B88
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \.. "\u039a\u03c5\u03c1"\.. "\u0394\u03b5\u03c5"\.. "\u03a4\u03c1\u03b9"\.. "\u03a4\u03b5\u03c4"\.. "\u03a0\u03b5\u03bc"\.. "\u03a0\u03b1\u03c1"\.. "\u03a3\u03b1\u03b2"].. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \.. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\.. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\.. "\u03a4\u03c1\u03af\u03c4\u03b7"\.. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\.. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\.. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\.. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"].. ::msgcat::mcset el MONTHS_ABBREV [list \.. "\u0399\u03b1\u03bd"\.. "\u03a6\u03b5\u03b2"\.. "\u039c\u03b1\u03c1"\.. "\u0391\u03c0\u03c1"\.. "\u039c\u03b1\u03ca"\.. "\u0399\u03bf\u

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_au.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.896073290907262
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoCwmGjbmvFjoCws6W3v1oCws6W3v6p6HyFjoCwmT+3vjbe:4EnLB383QrmdSs6W3vss6W3v6QSoJ3ve
MD5:	5B31AD8AC0000B01C4BD04BF6FC4784C
SHA1:	F55145B473DDCAE38A0F7297D58B80B12B2A5271
SHA-256:	705C66C14B6DE682EC7408EABDBA0800C626629E64458971BC8A4CBD3D5DB111
SHA-512:	1CCE6BCAE5D1F7D80E10687F0BCA2AE1B2DD53F04A0F443DC9B552804D60E708E64326B62BA4E3787325D89837B4AC8CCCA9AF6F39CBD654BCC8A9C27EA63BB8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_be.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.870560620756039
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoCr3FuoCsX3vtfNrsoCsX3v6YNIdjoCs+3v3FnN9vn:4EnLB383H3Fb3vtNN3v6y43v3FnNNn
MD5:	DDA87ACED97F9F7771788A1A0A1E4433
SHA1:	E221653CD659C095098180344654770FF059331B
SHA-256:	BC87754A253C1036E423FA553DA182DBC56F62A13EDA811D8CD9E8AFA40404A6
SHA-512:	BB95D9241B05686CA15C413746DD06071635CB070F38847BE9702397A86C01A3D54DEBE1ACAA51834AB74DB8D0F75E353995183864E382721425756EE46B0B1E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z".. ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_bw.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.915769170926952
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xosmGMoss6W3v6ay/5osmT+3vR6HyFvn:4EnLB383hr8s6W3v6ay/hJ3voSVn
MD5:	4CBF90CE15ECCB6B695AA78D7D659454
SHA1:	30C26ADB03978C5E7288B964A14B692813D6E0B8
SHA-256:	EC48F18995D46F82B1CC71EA285174505A50E3BA2017BCCE2D807149B7543FD0
SHA-512:	CC809EBD1B2B5D9E918C2E2CE4E7075DFB0744C583F17C1C234D8437EF0C34654D2F09FF77544AD3430CEC78ABC70AA5F85F71AD1489A687B8087FCDFE07B088
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_ca.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.87629705076992
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoAhgqyFjoAZF3vX5oAZF3v6cvBoAh9+3vnFDL8vn:4EnLB383FhgqWDZF3vVZF3v6cvdhI3vM
MD5:	BFC4A48F5B10D137A4D32B440C47D3C6
SHA1:	C90EF2A8291DE589BC12D0A5B8AF2F0B00FEB7CD
SHA-256:	3CF2D0937FD95264549CF5C768B898F01D4875A3EB4A85D457D758BC11DFEC6E
SHA-512:	A91B81A956A438CA7274491CA107A2647CBDFB8AEB5FD7A58238F315590C74F83F2EBA4AA5C4E9A4A54F1FC1636318E94E5E4BBEA467326E0EACED079741E640
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_CA TIME_FORMAT "%r".. ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p".. ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_gb.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.892405843607203
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEbtvqyFjoELE3vLjoELE3v6mjoEbto+3vnFDoAkvn:4EnLB383BbtvqWHLE3vTLE3v6EbtF3vW
MD5:	52E55DE8C489265064A01CEEC823DCDD
SHA1:	16F314A56AE0EAC9DAD58ADDEA6B25813A5BAA05
SHA-256:	C2CE5B74F9E9C190B21C5DF4106303B7B794481228FB9A57065B9C822A1059C3
SHA-512:	6010F29BF75D0CB4EE4F10781423A8CC68D5018DE8C633CD1217A7FE1299A0532E8C0E5D120188B748171EB255C587BB0B64B7384A58F725F3B6A4B9EA04393E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_GB TIME_FORMAT "%T".. ::msgcat::mcset en_GB TIME_FORMAT_12 "%T".. ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_hk.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.851471679101967
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoa+joaQ9PoaAx/G4soaYYW3v6ay/5oaAx/T+3v4x6HyFvn:4EnLB383BSiF4KxW3v6ay/B/3v4ISVn
MD5:	DE2A484508615D7C1377522AFF03E16C
SHA1:	C27C0D10E7667AD95FFF731B4E45B2C6E665CC36
SHA-256:	563450A38DB6C6A1911BC04F4F55B816910B3E768B1465A69F9B3BD27292DBEE
SHA-512:	A360B0FD7E36BCC0FB4603D622C36199E5D4C705396C6701F29730EB5CB33D81B208541CADFAED5303FC329C7C6A465D23CA9584F0DEC2DE128E258478DD6661
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_HK AM "AM".. ::msgcat::mcset en_HK PM "PM".. ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_ie.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.833246107458447
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoK6qyFjoKi+3vLjoKi+3v6mjoKv+3vnFDoAkvn:4EnLB383CqW13vJ3v6b3v9dmn
MD5:	57F0BBE1316D14BC41D0858902A7980A
SHA1:	B68BF99A021B9F01FE69341DF06F5D1453156A97
SHA-256:	9E0DCEE86A03B7BDD831E0008868A9B874C506315BF01DF3982AD3813FD3BA8E
SHA-512:	864F32254AAD39859AFC47D0C90DC5F38CA86EF0BBC7DE61BE253756C22B7806E616B59802C4F4D7B2F5543BF7C070FFF6FAF253E0A337EC443337E63A2E5A57
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_IE TIME_FORMAT "%T".. ::msgcat::mcset en_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.80637980762728
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoKr3ujoKrGtoKr5vMoKrw3v1oKr5o+3voAsvn:4EnLB383T9xvT3vJF3vonn
MD5:	1A54E506E70B2125C6016B373D3DD074
SHA1:	15289902BAA93208D8FB224E119166D0E044E34E
SHA-256:	ADEA3A1AB8AA84237DDB2F276ABDB96DCB4C51932E920D1A5E336904E1138664
SHA-512:	0D663233E6C96515713B3B829B605E72D8CE581AEF1C02FF6CA96598C040DCA42A3AC765EE9B5002E8969A331EB19A9AF0F8215F7113D0AD2F2EB2C560239D53
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IN AM "AM".. ::msgcat::mcset en_IN PM "PM".. ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_nz.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.939458132662909
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoyejbmvFjo63v1o63v6p6HyFjoy7+3vjb0ysvn:4EnLB383temdj3vd3v6QS1S3ven
MD5:	7E81708F107658FFD31C3BFBF704A488
SHA1:	7941ED040707591B68581337F8D90FA03C5E1406
SHA-256:	EC305B7CB393421E6826D8F4FEA749D3902EBA53BFA488F2B463412F4070B9ED
SHA-512:	8F038FF960F81D96FF9E3454D8ABDA7FFDA5B99DA304ACECC42E74DDBED839388246F66B58928DA902D3B475FBA46602B34F6829A87ECB1124FFC47C036B4DBE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_ph.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.824360175945298
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoojoOo2e4soe3v6ay/5o27+3v4x6HyFvn:4EnLB38304u3v6ay/k3v4ISVn
MD5:	E2E3BD806C20D7FB88109B7F3B84C072
SHA1:	2D7AD6BECA9C4D611BAE9747AD55A3E9385C2B42
SHA-256:	3A9C22B07906544C04F7A29B800FCE87C09D7FDF5C251236925115CF251A3890
SHA-512:	B14756B59BCABF8B29B41AC688E4F3A011735AF190B88F88B7B5FDDD3DA77F63FFC0F7875B3B453729CD3BC65E79F75F6E632CA68952EF473F78337D89E80BF2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_PH AM "AM".. ::msgcat::mcset en_PH PM "PM".. ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_sg.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.911413468674953
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoQW53FuoQGuX3v6ZwoQWa+3v3F0fxvn:4EnLB383V83FOJ3v62c3v3FEn
MD5:	F70245D73BE985091459ADF74B089EBC
SHA1:	21D52C336C08526D9DCF1AEC1F0701CB8B073D7A
SHA-256:	D565679AE9AACBFE3B5273FE29BD46F46FFBB63C837D7925C11356D267F5FF82
SHA-512:	171C70EB10D5E6421A55CE9B1AE99763E23FB6A6F563F69FE099D07C07FCA0CF8D3F6F00C5BB38BFF59A5F4C311506C4A9593F86C12B3B9E1861E72656B3800B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_za.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.937431055623088
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoOr0lIZoOK3v6poOs+3v0l6Uvn:4EnLB383z+3v6R3vl2n
MD5:	FCA7B13CA6C9527D396A95BEA94CC92D
SHA1:	E6F338A08F72DA11B97F70518D1565E6EF9AD798
SHA-256:	67C253E2A187AA814809418E5B7A21F3A1F9FB5073458A59D80290F58C6C1EB4
SHA-512:	37B8B4EA24B1C77AF0252A17660650CB2D4F8BB55C75817D6A94E1B81A3DDEF9913D12D3BF80C7BFE524CD0AD84E353E73238056759E6545BFE69EF5F806B8B7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d".. ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S".. ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\en_zw.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.934659260313229
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEmGMoEs6W3v6ay/5oEmT+3vR6HyFvn:4EnLB383Zr0s6W3v6ay/ZJ3voSVn
MD5:	A302091F490344B7A79C9463480AD7CF
SHA1:	E3992D665077177BAD5A4771F1BAF52C2AD1829C
SHA-256:	6F4754CE29DFA4F0E7957923249151CE8277395D1AF9F102D61B185F85899E4E
SHA-512:	FEBDB0BD6D0FD4C592DB781836F93F0C579399D324112F8829B769303CC6EEA487AAB14EBD60ED1B4F3B3DABF501601C9F65656327FF54853BF2CD9EC6A2F00F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\eo.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.3537859241297845
Encrypted:	false
SSDEEP:	24:4aR83dRb4vyomrIsmZ55vrAO0LH+50ydAcveva:43PT5rWvrAR60yW6oa
MD5:	D87605E6282713EED41D56D53B7A04FD
SHA1:	41AAD4BD3B72CCBB6A762FEED3C24931642DD867
SHA-256:	98D52CAB5CA65789D1DC37949B65BAF0272AB87BCCBB4D4982C3AF380D5406AB
SHA-512:	4A4F51B2FD0248B52530B5D9FE6BFCFE455147CBE2C1F073804A53666945405F89CBBAD219FFF6904C1F92885F7C53B9D9A969732D662CEA8EC1717B3303B294
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \.. "di"\.. "lu"\.. "ma"\.. "me"\.. "\u0135a"\.. "ve"\.. "sa"].. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \.. "diman\u0109o"\.. "lundo"\.. "mardo"\.. "merkredo"\.. "\u0135a\u016ddo"\.. "vendredo"\.. "sabato"].. ::msgcat::mcset eo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "a\u016dg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset eo MONTHS_FULL [list \.. "januaro"\.. "februaro"\.. "marto"\.. "aprilo"\.. "majo"\.. "junio"\.. "julio"\.. "a\u016dgusto"\.. "septembro"\.. "oktobro"\.. "novembro"\.. "decembro"\.. ""].. ::m

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	4.2910064237800025
Encrypted:	false
SSDEEP:	24:4aR83hEVIhlp4herIsYoorrClH+Fo9ARhprBvtFvr6:43OVY7+ercrmsYsr1thr6
MD5:	91DE6EE8E1A251EF73CC74BFB0216CAC
SHA1:	1FB01E3CF2CAFA95CC451BC34AB89DC542BBD7DD
SHA-256:	E9A6FE8CCE7C808487DA505176984D02F7D644425934CEDB10B521FE1E796202
SHA-512:	46CFD80E68461F165EE6A93AB6B433E4D4DA6A9A76CB7F3EF5766AC67567A7AFFB7B4E950A5AFA7C69C91F72AC82D2A448D32E39BBFC0BF26D2257460471EEC1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mi\u00e9"\.. "jue"\.. "vie"\.. "s\u00e1b"].. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \.. "domingo"\.. "lunes"\.. "martes"\.. "mi\u00e9rcoles"\.. "jueves"\.. "viernes"\.. "s\u00e1bado"].. ::msgcat::mcset es MONTHS_ABBREV [list \.. "ene"\.. "feb"\.. "mar"\.. "abr"\.. "may"\.. "jun"\.. "jul"\.. "ago"\.. "sep"\.. "oct"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset es MONTHS_FULL [list \.. "enero"\.. "febrero"\.. "marzo"\.. "abril"\.. "mayo"\.. "junio"\.. "julio"\.. "agosto"\.. "septiembre"\.. "octubre"\.. "noviembre"\.. "diciembre"\.. ""].. ::msgc

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_ar.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.878377455979812
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo8GzvFjot/W3v1o8T+3v9ysvn:4EnLB3833GzdV3vLK3vnn
MD5:	313966A7E4F50BB77996FDE45E342CA9
SHA1:	021DF7211DAE9A635D52F7005672C157DBBAE182
SHA-256:	B97DCEA4FEC3E14632B1511D8C4F9E5A157D97B4EBBC7C6EE100C3558CB2947F
SHA-512:	79DCC76263310523BAF1100C70918FCE6BECB47BE360E4A26F11C61F27E14FC28B588A9253AA0C1F08F45AE8A03312A30FBDCF4FDFFDC5BF9D086C4B539DE022
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_bo.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.924579610789789
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoYePWWjoU3v6ry/5oY7+3vPUe6HyFvn:4EnLB383nedh3v6ry/nS3vs3SVn
MD5:	EF58B1097A3C6F2133BD7AA8CCC1AD1B
SHA1:	BD479E4635F3CD70A6A90E07B7E92757BC9E2687
SHA-256:	B47F55539DB6F64304DEA080D6F9A39165F1B9D4704DCBA4C182DBD3AA31A11B
SHA-512:	F9EB1489E5002200D255A45DC57132DEFD2A2C6DE5BC049D0D9720575E4FDD1B6A212D9E15974C6A2E0D0886069EA0DD967AD7C20845EC38EB74CBED0C3E5BE1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_cl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9352990174129925
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xodvPWWjok3v6ry/5odo+3vPUe6HyFvn:4EnLB383OdV3v6ry/i3vs3SVn
MD5:	42BCE0EE3A3F9E9782E5DE72C989903A
SHA1:	0960646417A61E8C31D408AE00B36A1284D0300E
SHA-256:	9D1A2A6EBA673C6F6D964DBCDDF228CB64978F282E70E494B60D74E16A1DB9CB
SHA-512:	C53DDCC17F261CFFAA2205879A131CFD23A7BCF4D3787090A0EA8D18530C4805903ED6CF31B53A34C70510A314EBBB68676E9F128289B42C5EFBC701405D5645
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_co.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.908553844782894
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo4FjbmvFjo4F+3v6ry/5o4++3vjb0f6HyFvn:4EnLB3831mdD+3v6ry/P3vbSVn
MD5:	6A8F31AE734DCEE4845454408CDB3BC5
SHA1:	A3B9A0124D3CFA9E0E5957612897B23193AD5D59
SHA-256:	5FAC53ACFB305C055AFD0BA824742A78CB506046B26DAC21C73F0BB60C2B889A
SHA-512:	188A65CFE2FBD04D83F363AEA166F224137C8A7009A9EBEB24B2A9AC89D9484D3A7109A4CE08F5C0A28911D81571230CC37554F4F19956AE163F9304911EE53C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_cr.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.919346233482604
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo76GzvFjoTW3v6ry/5o76T+3v9f6HyFvn:4EnLB383K6Gzdj3v6ry/K6K3vMSVn
MD5:	2EDDA3F61BA4D049E6C871D88322CF72
SHA1:	40AFB64AF810596FCBDBD742ACAFE25CE56F3949
SHA-256:	A33DC22330D087B8567670B4915C334FF1741EE03F05D616CC801ECFDA1D9E64
SHA-512:	B6A6059B44F064C5CB59A3DAFAA7BE9064EE3E38F5FA6391017D931EF3A2B471DC4D556B7BEC6852FD1F6260EF17F476754D6BEA89E035748E9304977513CFB5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_do.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.913083040975068
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xomerQZ2jou3v6ry/5om7+3vrQZg6HyFvn:4EnLB383sk4/3v6ry/s3vkrSVn
MD5:	76CFD4F568EA799F9A4082865633FF97
SHA1:	B09846BBF7A78243A5075F2DC9241791DCBA434B
SHA-256:	8DC2F857E91912ED46A94EB6B37DD6170EA7BCDDCD41CB85C0926A74EE12FCC1
SHA-512:	58B20A8A5D1F8C19AC36E61965106266B7E6F7E95DDD6AD9C4BB9FD7FFC561CB0E2103639D901A6A78CE2DD154CBF7F3AE0F71B4DC1CCB11DC6BB40D9C6E2157
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_ec.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.915857529388286
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xozgzvFjoro+3v6ry/5oz9+3v9f6HyFvn:4EnLB383OgzdkF3v6ry/OI3vMSVn
MD5:	94B713B1560FE7711EA746F1CEBD37CD
SHA1:	E7047E8F04D731D38FA328FBC0E1856C4A8BB23D
SHA-256:	52AB5A6C9DD4F130A75C049B3AF8F54B84071FC190374BCCF5FA0E1F3B91EB21
SHA-512:	EE807D4D74A609F642CC3C6FC3D736708F67A6931DEB95288AB5822DA256BE4C908A346036195CF4266408458906D28BB5C715EEAFCACFC4FE45D4E6D8E435FE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_gt.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9102355704853435
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xohvjbmvFjoI3v6ry/5oho+3vjb0f6HyFvn:4EnLB383KmdJ3v6ry/W3vbSVn
MD5:	761D0A468DF2EE75BC2CAB09D5FF38CD
SHA1:	D627BE45FE71CCB3CA53153393C075FF5136C2F3
SHA-256:	19B4D3025156C060A16328370A3FDB9F141298DECFC8F97BE606F6438FECE2EE
SHA-512:	6CF7C9004A8A3B70495862B7D21921B1A6263C2153FEBC5C4997366498ABBFE70263B436C2B4998550780A4C3A58DCF0AAE7420FF9D414323D731FA44BD83104
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_hn.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.947925914291734
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoIvriSFjoP3v6ry/5oIo+3vrig6HyFvn:4EnLB383V+2m3v6ry/v3v+lSVn
MD5:	33CEE7F947A484B076F5FA7871A30FEB
SHA1:	F77F8D1F42008770A6FF1F5097C863ECF482BEBE
SHA-256:	07873D4D59BB41000706A844859C73D26B1FF794058AA83CFFCA804981A24038
SHA-512:	EBF6873F9CB554489EFCD352943100C00171E49D27153769D1C4DB25E2D1F44F2D34869B596C267C9BB59ED0444468D9982137CFB1C6035FB15A855BB867133B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_mx.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9102355704853435
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoPjbmvFjoH+3v6ry/5oI+3vjb0f6HyFvn:4EnLB383UmdD3v6ry/k3vbSVn
MD5:	678D7A6DC32355246BF3AC485A24AF4D
SHA1:	B6C273D3BE5FB9F5A221B0333870CCE41CEDFDE4
SHA-256:	A0F57137D2C0ABDC933E03CFB188F5632176C195CEADB9DC80D469C8DC6CEDC6
SHA-512:	571404CCB0591C681C975E3F7A6C6972FAF2362F1D48BFC95E69A9EAE2DB3F40BF4B666C41950C4924E3FD820C61ED91204F92283B8554F1BD35B64D53BD4125
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_ni.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.918215906418583
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoe/GriSFjo3W3v6ry/5oe/T+3vrig6HyFvn:4EnLB383Re+2eW3v6ry/RS3v+lSVn
MD5:	471C41907CE5DB1F30C647A789870F78
SHA1:	C575A639609620AF7C56430991D0E4C2B50BDEC5
SHA-256:	6250663DA1378E54BEDCEF206583D212BC0D61D04D070495238D33715BB20CAE
SHA-512:	CAE32DF8F583542CAFE3292501725D85B697A5C1F9A0A7993490E8A69B6CE5CE3DE3AA2733B14D989A8D13B5E31B437DB42E9AB9D1851FE72313592C752B5061
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_pa.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.906719336603863
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoX5rQZ2joHE3v6ry/5oXa+3vrQZg6HyFvn:4EnLB383ak4F3v6ry/G3vkrSVn
MD5:	571F6716293442672521F70854A5AD05
SHA1:	525EBDEA6F85FC769B6C0C0B179BD98381647123
SHA-256:	EBB661C1C09E7D4F6FBCC4B2DAD0F41442B1FFDD27F003ABDC0375DD316E57D7
SHA-512:	C6176EE48515BDFC09B8347DAC5FD2C0165AA765916457DC7B057E526785AC912481CB72F118D2943372213B23CE3C39739263C2B3DA4DBFEB24C522ACC0439D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_pe.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.90959433688075
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoIgzvFjoQ9X3v6ry/5oI9+3v9f6HyFvn:4EnLB383+zdB3v6ry/y3vMSVn
MD5:	5A5997D834DDD3E2E8FF8C6956AD54AC
SHA1:	AB4110E37B3665D738A8F2B3E64CBA9E99127301
SHA-256:	90C130B66958CF63CB3DDD2C633E58444357DBAB44C56831DD794CBD2EB1AED0
SHA-512:	1FEB8E77EA7B886E4A06279AC8A4B6200DBB86DCD28989651B92A0C9147A7BCFBB871DF8F904A1CF8F869BFFBD21325505AC44A4DBEBE1EFC87D43174597F1F3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_pr.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.905689521403511
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo06GriSFjoeW3v6ry/5o06T+3vrig6HyFvn:4EnLB383gG+263v6ry/gK3v+lSVn
MD5:	CE811BB8D12C7E6D53338759CCFB0A22
SHA1:	0AED290AA479DE6887CCB58D3F0A0F379EF8D558
SHA-256:	F790E8E48DC079DCD7DEB58170561006A31294F7E4ACBF9CF2ABFA3DB9E3FA9E
SHA-512:	0C73654CC3D33F76D9BF545BD6C5E42CBDD10B6D9750BFD6536806010F3B6A3C3647FB9D5E7E75A39823FDB857E13D07B7F987809C94B9F980E6D3A6D3108E85
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_py.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.917539255090736
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo/5zvFjovE3v6ry/5o/a+3v9f6HyFvn:4EnLB383Czdt3v6ry/+3vMSVn
MD5:	9CD6FAC4121E3D287C87157142E32845
SHA1:	3081FE2197017EC8E052756A407880C1C4ED026A
SHA-256:	70263F7EB22822DFEE8849B7AC4418ED9331275A71E77236B59226396505CDFF
SHA-512:	25DC054085C4078734988EEDD87E31ABE93DA8B43512E924DE4BCDE9F8EC670436B72FAD1855484F9AC71DD0BEDD9ED30304D02219C4FFC4B0516D8889BDF9F9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_sv.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.929035824905457
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xofriSFjo3+3v6ry/5oY+3vrig6HyFvn:4EnLB383Y+22+3v6ry/Q3v+lSVn
MD5:	AF300EA6E733DC6820768EA16194B472
SHA1:	7766A6EB3D07BCC759CF6718EF3D6EC3FCE13565
SHA-256:	26A38B3745C95673D21BABB987F1D41EE08DDA945C670F5432BA0CE6F893C0E9
SHA-512:	C38D67C912584BE539D71881C6517AC186CBB336A160602DA716CE2708B2D38CE8FA7DD23EDB98890ABB7119B924B6C7816C18EC18F20C49D6284DF2386E32EE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_uy.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.923802447598272
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xooygzvFjooq9X3v6ry/5ooy9+3v9f6HyFvn:4EnLB3835rzdbsX3v6ry/5J3vMSVn
MD5:	2DC550FEC3F477B1159B824479BCE707
SHA1:	4D0B20CF3E50B64D74655A405A7750E0B0BB4375
SHA-256:	1291B58810739EA0651493DD7887F5EE3E14BDB806E06DD4BB8AE2520C742EDA
SHA-512:	B12B927ACA6274904928A6A6CAEC8339A794C74A1F1804FF93AABC132AF9AD8AC5117F20067A60EFEBC9887150D7ACA5BE9643FF61509666011FD203211C25B9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\es_ve.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.928484426267027
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoXrzvFjoXK3v6ry/5oXs+3v9f6HyFvn:4EnLB3838zdv3v6ry/c3vMSVn
MD5:	184D6C4B9F0AA874DEB959F63F7CC01B
SHA1:	5FB370B498289590C977F6B489FF646F0FB27425
SHA-256:	91191517403C712299919F9C797F952502E33CB6961D1DBEE3A7C9E8D2B170B9
SHA-512:	881CCAB0950AE993744ECCA141120C005F53D684167A3E5CBDDF950D110D630FB2B4F6AE6E3D0E06D5110AE25EA00A4F4DAFB03AD3B227DC8C63464D434431DA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\et.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	4.391217201307309
Encrypted:	false
SSDEEP:	24:4aR83P1Y2+1YoQVTsC/m48qpRTVTR7I/68qqq4Z0yoN7emG5wsvtqmsv5t:43P1p+1jQ9sq8y9v8Yko7emG5wKtqmKX
MD5:	C8C5EF2FA6DD8DBD5BBD2699BE1A0BF6
SHA1:	F5E26B40786B8987C98F9CBDEF5522043574A9ED
SHA-256:	4BEE224C21B0483CFF39BE145C671AA20CB7872C8727FD918C0E8ECA2BBEB172
SHA-512:	757FA85C137A11C1A3F4A8392C7A4E4030A67D0E593FA25A98BEC07DB295399AB2C0D9EBE61E07420B14387A29C060DC3AF812A1E7B85110DBB13C3C3DCB3600
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \.. "P"\.. "E"\.. "T"\.. "K"\.. "N"\.. "R"\.. "L"].. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \.. "p\u00fchap\u00e4ev"\.. "esmasp\u00e4ev"\.. "teisip\u00e4ev"\.. "kolmap\u00e4ev"\.. "neljap\u00e4ev"\.. "reede"\.. "laup\u00e4ev"].. ::msgcat::mcset et MONTHS_ABBREV [list \.. "Jaan"\.. "Veebr"\.. "M\u00e4rts"\.. "Apr"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "Aug"\.. "Sept"\.. "Okt"\.. "Nov"\.. "Dets"\.. ""].. ::msgcat::mcset et MONTHS_FULL [list \.. "Jaanuar"\.. "Veebruar"\.. "M\u00e4rts"\.. "Aprill"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "August"\.. "September"\.. "Oktoober"\.. "November"\.. "De

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\eu.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	4.002617252503668
Encrypted:	false
SSDEEP:	24:4aR83DEXk8TT7vXk8TTMtzCIsOo/ssP6tvf1I49sHT:434bTbbTc+RjKi4mz
MD5:	ED9805AF5BFB54EB28C6CB3975F86F5B
SHA1:	2BD91BD850028712F35A2DDB2555036FBF6E8114
SHA-256:	6889B57D29B670C6CFB7B5A3F2F1749D12C802E8E9629014D06CE23C034C7EF1
SHA-512:	16F31DE5D2B0D3ED2D975C7891C73C48F073CDAC28F17572FC9424C2D384DDFE9E5E235F17C788F42840CB2D819D2D9499B909AB80FEF1B09F2AE1627CF1DADC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu MONTHS_ABBREV [list \.. "urt"\.. "ots"\.. "mar"\.. "api"\.. "mai"\.. "eka"\.. "uzt"\.. "abu"\.. "ira"\.. "urr"\.. "aza"\.. "abe"\.. ""].. ::msgcat::mcset eu MONTHS_FULL [list \.. "urtarrila"\.. "otsaila"\.. "martxoa"\.. "apirila"\.. "maiatza"\.. "ekaina"\.. "uztaila"\.. "abuztua"\.. "iraila"\.. "urria"\.. "azaroa"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\eu_es.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.915392589807169
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoszFnJF+l6VvBoszw3vLjoszw3v6mjosz++3v/RHvn:4EnLB383FL+l6VQ3vO3v6G3vZPn
MD5:	4C91AA000D4316585893025CBB96E910
SHA1:	3D4E73839A1A8CB9DEC1E59D9D2813257D9480F0
SHA-256:	D45CC432E5743E6CEC34E9A1E0F91A9D5C315CDA409E0826B51AD9D908479EB6
SHA-512:	0731F2EEB22ADC7EF8AF215B9EB4C5A66B33BC90E4F80CF7AA482AD002CB30543547230124A0507EC79EDDD6903A042EDA5D7C8AFD77F7FC994EFC6853FABB05
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da".. ::msgcat::mcset eu_ES TIME_FORMAT "%T".. ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T".. ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fa.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	4.21837106187395
Encrypted:	false
SSDEEP:	24:4aR83CnMqnbxbGwgjSyiY/Xw2mS1yM/8ye48YyfNqTb2gyj/8yHkQp:43Yzyhgvs9yi4P
MD5:	7AB25F4E7E457469DC61A33176B3AA72
SHA1:	EEA98283D250A99E33DD4D5D9B1B76A029716CE6
SHA-256:	86898728B275288693B200568DC927C3FF5B9050690876C4441A8339DAE06386
SHA-512:	7524437F91E91751BEB7A378D7674C49E5D84B716FE962F4C23580C46A671F3F33638FCD37A8F90C86E24DA8F54448E06AC9C3AEFFB5613E94A04E512C1AD68D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0648\u062a

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fa_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2009
Entropy (8bit):	4.491667766230948
Encrypted:	false
SSDEEP:	24:4aR83KnMqnbxbGUgjDiY/Xw2mS1yM/8ye48tfNqTb2gyj/8yHkQLoRv9v/vNv0P:43wihgvsai4Rmv53JU
MD5:	C59EE7CA80AD9F612A21C8B6674A820E
SHA1:	AEFD631EFC1892063244FA622DE1A091C461E370
SHA-256:	6B56545C1AE1DE53BC2389BB7AE59F115BADE24F907E384E079491DC77D6541D
SHA-512:	42F52091480599D317FB80DF8E52A6C6F88614C6172BF4033974DD136FB30E6F47D38982C8A7BC14CF3165C3EBAE3680F94DF3A0ED079AB68165286251CD0BD7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fa_ir.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.12739029869254
Encrypted:	false
SSDEEP:	12:4EnLB383D2WGz7A/3vy3v6TANCmK3vz7AAbn:4aR83DoPivkvFk5vPN
MD5:	9778A7C3ABD37ECBEC0BB9715E52FAF8
SHA1:	D8063CA7779674EB1D9FE3E4B4774DB20B93038B
SHA-256:	3D9779C27E8960143D00961F6E82124120FD47B7F3CB82DB3DF21CDD9090C707
SHA-512:	B90B4A96CE5E8B9BF512B98C406603C60EA00F6740D04CD1FC30810C7155A37851AE5E28716F959137806F1A9E3152D2A0D79B8EA7E681A0737A28593657DE66
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d".. ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631".. ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y".. ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H".. ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P".. ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fi.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	4.32217771842326
Encrypted:	false
SSDEEP:	24:4aR83KTvIhmuw4tW/UWJTttWKeqA+3ewvtyv3e6:43YvIwuw4t05ttnlzt0p
MD5:	CC06F0ABD8F985654DAD8256598EBCB7
SHA1:	71C880F9F395ACD32AF7F538033211F392F83645
SHA-256:	9929A6B7139BD7E0F29487F7888A83E4C4F5E9CE0352738CFCA94EE2DDF3BD6B
SHA-512:	E1292665270B6FBF7738CC3864B55194E7B827C6AD9492FB2E54DC1B626159B243052CE502335B9D92E2B8F58A4DD1FA0E628CB6A9D1D3A652FE2B93A3FB711A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "ma"\.. "ti"\.. "ke"\.. "to"\.. "pe"\.. "la"].. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \.. "sunnuntai"\.. "maanantai"\.. "tiistai"\.. "keskiviikko"\.. "torstai"\.. "perjantai"\.. "lauantai"].. ::msgcat::mcset fi MONTHS_ABBREV [list \.. "tammi"\.. "helmi"\.. "maalis"\.. "huhti"\.. "touko"\.. "kes\u00e4"\.. "hein\u00e4"\.. "elo"\.. "syys"\.. "loka"\.. "marras"\.. "joulu"\.. ""].. ::msgcat::mcset fi MONTHS_FULL [list \.. "tammikuu"\.. "helmikuu"\.. "maaliskuu"\.. "huhtikuu"\.. "toukokuu"\.. "kes\u00e4kuu"\.. "hein\u00e4kuu"\.. "elokuu"\.. "syyskuu"\.. "lokakuu"\.. "marraskuu"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fo.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1033
Entropy (8bit):	4.15884265510429
Encrypted:	false
SSDEEP:	24:4aR834YPxTSBFSa+E6rIsmYmyAxyIQbXHU92W1T:43a6rIyAE0B
MD5:	5D224E66FD9521CA4327D4F164CD6585
SHA1:	FC8F4C1D9A69931679028DE02155D96A18F6542E
SHA-256:	2EC9B03469FA38B260915C93318F446EA5E12B9090BD441936B57552EBA1E3C9
SHA-512:	0E0F97D99F0274A8A92AA7DC992B252A0BB696D69A8835602D8F4C03A6A15780F45971F00863436949CD81AD7DF6EE6BC463CE5B9FECF5E39508BA4D4E83C693
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \.. "sun"\.. "m\u00e1n"\.. "t\u00fds"\.. "mik"\.. "h\u00f3s"\.. "fr\u00ed"\.. "ley"].. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nadagur"\.. "t\u00fdsdagur"\.. "mikudagur"\.. "h\u00f3sdagur"\.. "fr\u00edggjadagur"\.. "leygardagur"].. ::msgcat::mcset fo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset fo MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "apr\u00edl"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fo_fo.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.864028070948858
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoZA4WjoZd3vLjoZd3v6mjoZd+3vnFDoAkvn:4EnLB3831P23vS3v6u3v9dmn
MD5:	92E2B6483B2374817548F4EAA1731820
SHA1:	071E1E9368CCB4EC864E78622B2113F460920203
SHA-256:	C3DCCF5E5904C24D4AD9AAA36160A78F5397A7452510C0C0E61DE4DE863305CB
SHA-512:	E79D4D38A22298252FA46D15C383CFB2A1E49E8196C265A58F9BA4982DFD9CE29E87C0B85BE3F39617359451831B792FCD3092A52EDF8FFD999AFE5CFE1D170D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y".. ::msgcat::mcset fo_FO TIME_FORMAT "%T".. ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T".. ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fr.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	4.383721663740675
Encrypted:	false
SSDEEP:	24:4aR835LzAX2t6KOkPwzZIGzRmzQf1waGqHvivh:43mlwIFZtA/qPkh
MD5:	4D63B4A7CF13A28A6F6784B5597EEF43
SHA1:	FE1B35A93CB72666D7D6BC37D9BE081B05A00CD9
SHA-256:	96B1E1E12CD13A56722EBF27D362C70B467342FA1282A40B89FB16B5105A0480
SHA-512:	5647CAE859B62C7CE1CEE6426A076361D2A29EFE6B6F311DDC0E7D006194BA68D575852FEC5FDE2AB43DF8AE440C57013D32A3951095CB856327070FD9BD1C76
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \.. "dim."\.. "lun."\.. "mar."\.. "mer."\.. "jeu."\.. "ven."\.. "sam."].. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \.. "dimanche"\.. "lundi"\.. "mardi"\.. "mercredi"\.. "jeudi"\.. "vendredi"\.. "samedi"].. ::msgcat::mcset fr MONTHS_ABBREV [list \.. "janv."\.. "f\u00e9vr."\.. "mars"\.. "avr."\.. "mai"\.. "juin"\.. "juil."\.. "ao\u00fbt"\.. "sept."\.. "oct."\.. "nov."\.. "d\u00e9c."\.. ""].. ::msgcat::mcset fr MONTHS_FULL [list \.. "janvier"\.. "f\u00e9vrier"\.. "mars"\.. "avril"\.. "mai"\.. "juin"\.. "juillet"\.. "ao\u00fbt"\.. "septembre"\.. "octobre"\.. "novembre"\.. "d\u00e9cembre

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fr_be.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.910112619660625
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoXqyFjoIX3vLjoIX3v6mjog+3vnFDoAkvn:4EnLB383AqWv3vL3v6d3v9dmn
MD5:	07EEADB8C2F2425FF9A27E46A81827A2
SHA1:	AA18A651C64098C7885F1F869B9F221453F42987
SHA-256:	AAD828BCBB512FBD9902DCDD3812247A74913CC574DEB07DA95A7BBE74B1FE48
SHA-512:	1FA60B1A69B2F5FD2C009EC18695A937C4484D7C418F7E8398D95723B857698143E0584A546F9032B75894730CBBEF78453061AC13D90199FF702E148D983C28
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset fr_BE TIME_FORMAT "%T".. ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fr_ca.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.890376345610709
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xooIso13vLjo13v6mjo1+3vnFDoAkvn:4EnLB383vIF3vU3v6A3v9dmn
MD5:	2F70BDDE7685E2892C5F79C632FC2F0F
SHA1:	FD1A6F6042E59D1563ABB5858C348C1D785C435E
SHA-256:	0624DF9A56723DDB89E59736C20A5837DEA2206A789EBE7EEF19AD287590CA45
SHA-512:	50FC0C91AB2C75FFC4F100C0D42DFC4B2101DB9713FD77E6FF5BF3F25A0AF4A535A4709CF4586809CEEE76C25B66ABC0DD4FD61524510C57AA0E63EA8F46E8D5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset fr_CA TIME_FORMAT "%T".. ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\fr_ch.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.913241133684606
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoFt28oF+3vLjoF+3v6mjo++3vnFDoAkvn:4EnLB383yte+3vs+3v6/3v9dmn
MD5:	83FC7EBA68C3727F7C13C8EEAF79823F
SHA1:	81C27F9B97F5F5190F7189230535EC09CD228158
SHA-256:	290CA6EB74BAEAC4E2420D0755D148849F89EE87E37860F25CBB7B8AFA3EDCBC
SHA-512:	35DA46558A246D7B3FAB02208001CE986E2E6DD88D6318AF743F4E81CA6920471D1425BB009A7476A79E7F61E1353C027B765331CD8EFA07A9E884DCB73F2195
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y".. ::msgcat::mcset fr_CH TIME_FORMAT "%T".. ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ga.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	4.314271783103334
Encrypted:	false
SSDEEP:	24:4aR835k0CM/hlrXa754pD73/tKSx54pbIK5f2CA:43W05rXUa173/VadDA
MD5:	67D137E5D853DB61A4B4264871E793F7
SHA1:	4280E7F662DE792175AF8B4C93874F035F716F0F
SHA-256:	880806867ACABD9B39E3029A5ADD26B690CC5709082D43B0959EBA725EA07AB5
SHA-512:	C27B745143539D3E6D94BB754DCA35065CDE9B1AA6EE038D47F658175CFACC20236124D38BE5BBB03CAF8F613BD748C43CB8DFCC9234E915D18B5A477BAEF94E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \.. "Domh"\.. "Luan"\.. "M\u00e1irt"\.. "C\u00e9ad"\.. "D\u00e9ar"\.. "Aoine"\.. "Sath"].. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \.. "D\u00e9 Domhnaigh"\.. "D\u00e9 Luain"\.. "D\u00e9 M\u00e1irt"\.. "D\u00e9 C\u00e9adaoin"\.. "D\u00e9ardaoin"\.. "D\u00e9 hAoine"\.. "D\u00e9 Sathairn"].. ::msgcat::mcset ga MONTHS_ABBREV [list \.. "Ean"\.. "Feabh"\.. "M\u00e1rta"\.. "Aib"\.. "Beal"\.. "Meith"\.. "I\u00fail"\.. "L\u00fan"\.. "MF\u00f3mh"\.. "DF\u00f3mh"\.. "Samh"\.. "Noll"\.. ""].. ::msgcat::mcset ga MONTHS_FULL [list \.. "Ean\u00e1ir"\.. "Feabhra"\.. "M\u00e1rta"\.. "Aibre\u00e1n"\.. "M\u00ed na Bealtaine"\.. "Meith"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ga_ie.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.824539027053997
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xobHAygDobHAqo+3vLjobHAqo+3v6mjobHAy9+3vnFDoAkv:4EnLB383p23vy3v6a3v9dmn
MD5:	C27BD7F317AAADB380F4C38AE0D2FDA6
SHA1:	79870A0E68AA0A9B301414EDC21889F83BB81E40
SHA-256:	3F9615C617D3CDBC1E127B3EFEE785B0CB5E92E17B7DABAC80DA2BEAF076362C
SHA-512:	3605B9A914284CF1D3CC90DF2F21A86C0472AEE59800942DC93D842C7AE164E1DA72813787F163DC80B72269D2C391953ABAD6A8B72CCF069BEE96D418A173E9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y".. ::msgcat::mcset ga_IE TIME_FORMAT "%T".. ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\gl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	997
Entropy (8bit):	4.120890519790248
Encrypted:	false
SSDEEP:	24:4aR83okzalCcPdJ5rK8yzMY4JlV1ZDqqIkFo8w:43JkPj9K8y4HHZLIQtw
MD5:	A3D098C1A47E380F7C25233A52FBDE38
SHA1:	C97E4EAA9E7A7F99950F422B93C57134B532C639
SHA-256:	34D61B49DBF9584893051FFB458D6DE9E7E2E7774AC0011F70C4DD4184EBA81C
SHA-512:	4687AB3D2FAA65FED90678EBC08C074959E93A9FEFAF3D61EEE39DB08FD200CB57C0DDB4DDBF6451FE1EF5E07EA976EDEF830769FF403CE51734129CEF24DA9F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Lun"\.. "Mar"\.. "M\u00e9r"\.. "Xov"\.. "Ven"\.. "S\u00e1b"].. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Luns"\.. "Martes"\.. "M\u00e9rcores"\.. "Xoves"\.. "Venres"\.. "S\u00e1bado"].. ::msgcat::mcset gl MONTHS_ABBREV [list \.. "Xan"\.. "Feb"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Xu\u00f1"\.. "Xul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset gl MONTHS_FULL [list \.. "Xaneiro"\.. "Febreiro"\.. "Marzo"\.. "Abril"\.. "Maio"\.. "Xu\u00f1o"\.. "Xullo"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Decembro"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\gl_es.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.886176304042503
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoPhkgMoPxsF3v6ay/5oPhk9+3vR6HyFvn:4EnLB383WrfK3v6ay/WJ3voSVn
MD5:	78B9163C5E8E5E7049CBF91D1A5889A4
SHA1:	F2F07AF3D79D61C8E0C73B13E2CA8266E10E396B
SHA-256:	B5688CA07D713227B713655877710258CD503617E8DF79293A971649E3134F05
SHA-512:	E86074B687670542CFA097C94D150292E1A73C9F231E92CD84386580A446569CC6F8F5817F46ED64A1D00F95D59F6F1F5D4B961DF3C8335938D83F3517794353
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\gv.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	4.213672208102291
Encrypted:	false
SSDEEP:	24:4aR832vTXAC2/fS5JfaCroeLaCAQbSm5qJe1:43QTXs32zrf
MD5:	518FC3964D50854081FB79189A42D3E7
SHA1:	59392F16CD56E3E6A685F78974D539FB3A972B98
SHA-256:	404795F2C88D0038F9ED0B5120A251D26EDF8B236E1B1698BC71ACD4DC75AC45
SHA-512:	E5C88CAB8741D631938CEC2E0959C0FE26685C395F5F9F4F1B5C9E146E84D23D897CD7A823AB46D4B62C590AE15EC76B87EB59308ACFB1BB6F61398890B43622
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \.. "Jed"\.. "Jel"\.. "Jem"\.. "Jerc"\.. "Jerd"\.. "Jeh"\.. "Jes"].. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \.. "Jedoonee"\.. "Jelhein"\.. "Jemayrt"\.. "Jercean"\.. "Jerdein"\.. "Jeheiney"\.. "Jesarn"].. ::msgcat::mcset gv MONTHS_ABBREV [list \.. "J-guer"\.. "T-arree"\.. "Mayrnt"\.. "Avrril"\.. "Boaldyn"\.. "M-souree"\.. "J-souree"\.. "Luanistyn"\.. "M-fouyir"\.. "J-fouyir"\.. "M.Houney"\.. "M.Nollick"\.. ""].. ::msgcat::mcset gv MONTHS_FULL [list \.. "Jerrey-geuree"\.. "Toshiaght-arree"\.. "Mayrnt"\.. "Averil"\.. "Boaldyn"\.. "Mean-souree"\.. "Jerrey-souree"\.. "Luanistyn"\.. "Mean-fouyir"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\gv_gb.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.936566750568767
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoQbtvMoQLE3v6ay/5oQbto+3vR6HyFvn:4EnLB383PbtvALE3v6ay/PbtF3voSVn
MD5:	0B6BE614EF5F5F25A30D2D33701A9F94
SHA1:	65800FBD73D9DAE550E04E1D818A6B9D1AEF86FE
SHA-256:	86CABF3B9360C0E686CC4CBEB843E971C28BC6D35210ED378B54EB58CC41F3D5
SHA-512:	376D21B38DA49A8F7C2983F2B808FD55AC9F6383BC66DF28DB99DBF61FDC9FFF8CD20F077EC3ED873EF47F0F613BDD9AD02DFFB1CB51F9A36715C7FC798C3B70
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\he.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	4.298934047406144
Encrypted:	false
SSDEEP:	24:4aR83Y71LCLxL0eCLbCLKCLaCLXL7CLB0p1dLGCoCLU5LT5Gv5LJ9p5LnLEHLGCh:43sl7KqpU/nNbhbOezd2ICn
MD5:	A0E60036EB17208A449AAFC3AAAE622C
SHA1:	9D7479BA85FBB00A2DF2B61F4ED2CBEA8F1EC8C3
SHA-256:	787DA79AF58872BF45AB09E3B6A920A4496B5BD8A4F3C7F010CF013EC2E8EFE0
SHA-512:	46D12C14B5736E5EA97EB728BF58999E9D7C2CF910D8F5AFA3F5D3A86329ABF41A3E2BEBD81EE4EF64BEA0DC173B77A9FE12471C1BD9D768ED552A55B3B80213
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \.. "\u05d0"\.. "\u05d1"\.. "\u05d2"\.. "\u05d3"\.. "\u05d4"\.. "\u05d5"\.. "\u05e9"].. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \.. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\.. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\.. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\.. "\u05e9\u05d1\u05ea"].. ::msgcat::mcset he MONTHS_ABBREV [list \.. "\u05d9\u05e0\u05d5"\.. "\u05e4\u05d1\u05e8"\.. "\u05de\u05e8\u05e5"\.. "\u05d0\u05e4\u05e8"\.. "\u05de\u05d0\u05d9"\.. "\u05d9\u05d5\u05e0"\.. "\u05d9\u05d5\u05dc"\.. "\u05d0\u05d5\u05d2"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\hi.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1777
Entropy (8bit):	4.2117128941697715
Encrypted:	false
SSDEEP:	48:438n4kALqrU1fbokQTbWqrU1fbokQTw38:28OD86D8gM
MD5:	4219A929E27308ADC04A9F368F063F38
SHA1:	FA728EEBA8751F4CE032ED32AECFDE124D1B68E2
SHA-256:	192F4A8E77E1627712F85533C9896EF6A040157C7BD56DF3A4A7FA56AD6746C2
SHA-512:	223B137AC1FC15908F5541067736EF3A29493549B963393EB78660036A82982E57CFC4AD09CBD33D32A5187FF9F4ACFB5F83A0C974702434B7FAD1B2539B7F76
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset hi MONTHS_ABBREV [list \.. "\u091c\u0928\u0935\u0930\u0940"\.. "\u092b\u093c\u0930\u0935\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u0905\u092a\u094d\u0930\u0947\u0932"\.. "\u092e\u0908"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u093e\u0908"\.. "\u0905\u0917\u0938\u094d\u0924"\.. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\.. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\.. "\u0928\u0935\u

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\hi_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9286948144352865
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xocv+IZoz3v6ry/5oco+3v+6f6HyFvn:4EnLB383Jvlg3v6ry/JF3vmSVn
MD5:	1C1E1484EA0286175FADCB90937C9F34
SHA1:	5CA1BF19021D529CB3B3A308EFFFCA7E4D073640
SHA-256:	5A3BF0DD61BFB5A2BF75E96B11E0E3528FFAB720A0BF1923853606F8CAF0E76D
SHA-512:	F9A43E1E18ADB6DC6B18BEDC3303A99F514DF6CA54F12100989F734233012D7D60216116915351CCACC12F6942795BF8F3BBD26B15A86E88101067D64BEE54F5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\hr.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	4.36311224714184
Encrypted:	false
SSDEEP:	24:4aR83dVX79VIE9bLTWnh7rT+5dPcdvgrNv5KvOA1:43kmrQ7n+odIrJ6OS
MD5:	906963A3AD09EAC781B35C190B77484E
SHA1:	E5AA49DA9C4987EAFA839115F84612426EB8615E
SHA-256:	105A9180BC5D23738183374FA0EA8DD80484BF3947E1432E515BDC2913C017D9
SHA-512:	557BD1C8306750D09215D9774069A52C7D60E03DE2DF39FF909A8F658AB0565739D127E24ACDC96F736C69A71BEFA30B8A30BB489C7B7FDEA85386C802166349
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \.. "ned"\.. "pon"\.. "uto"\.. "sri"\.. "\u010det"\.. "pet"\.. "sub"].. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \.. "nedjelja"\.. "ponedjeljak"\.. "utorak"\.. "srijeda"\.. "\u010detvrtak"\.. "petak"\.. "subota"].. ::msgcat::mcset hr MONTHS_ABBREV [list \.. "sij"\.. "vel"\.. "o\u017eu"\.. "tra"\.. "svi"\.. "lip"\.. "srp"\.. "kol"\.. "ruj"\.. "lis"\.. "stu"\.. "pro"\.. ""].. ::msgcat::mcset hr MONTHS_FULL [list \.. "sije\u010danj"\.. "velja\u010da"\.. "o\u017eujak"\.. "travanj"\.. "svibanj"\.. "lipanj"\.. "srpanj"\.. "kolovoz"\.. "rujan"\.. "listopad"\.. "studeni"\.. "prosinac"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\hu.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.511450677731002
Encrypted:	false
SSDEEP:	24:4aR83IFb7ZTmKrkAYm2LZyyApLDV2uZi5WF+shHUTyvtsv+:43C3ZTmKQAyZyyAp0BotK+
MD5:	E398158EE1CD49CB5286D9642D4A61DD
SHA1:	A93A588B0ADD198C067C4BB070DC1E5170E6E208
SHA-256:	993475532F89E1EA7214ADB265294040862305612D680CFF01DD20615B731CCC
SHA-512:	9E5791FB97110FE5F7A1F49FF2ED8801A05E49D5B9AF579474C0081073D2B40ECFFE6E4EB5B61F12B1995FDCC0A557CB572E5E116F951FD286A6254253DAEC01
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \.. "V"\.. "H"\.. "K"\.. "Sze"\.. "Cs"\.. "P"\.. "Szo"].. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \.. "vas\u00e1rnap"\.. "h\u00e9tf\u0151"\.. "kedd"\.. "szerda"\.. "cs\u00fct\u00f6rt\u00f6k"\.. "p\u00e9ntek"\.. "szombat"].. ::msgcat::mcset hu MONTHS_ABBREV [list \.. "jan."\.. "febr."\.. "m\u00e1rc."\.. "\u00e1pr."\.. "m\u00e1j."\.. "j\u00fan."\.. "j\u00fal."\.. "aug."\.. "szept."\.. "okt."\.. "nov."\.. "dec."\.. ""].. ::msgcat::mcset hu MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "m\u00e1rcius"\.. "\u00e1prilis"\.. "m\u00e1jus"\.. "j\u00fanius"\.. "j\u00falius"\.. "augusztus"\.. "szeptembe

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\id.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.02166638427728
Encrypted:	false
SSDEEP:	24:4aR83dcTcWKutdXaMmEfc2ftdT2dHblWZ0VT:43dQrKutdntdI8g
MD5:	191ACF2E8A8F10A1360B283D42886382
SHA1:	EE2C00D021381EA638B6CE3F395DEA5F8491ED9B
SHA-256:	41C0C3D3B4491E9B36E719466503EFCD325175CB7824C4A5055CB113D347BE0F
SHA-512:	29BC4F7D3FAE7DE392B175FEA76138FA823B7D9D0B051A19A73F7D36D51DE34E0D0C7C129867307ABF51FC92E70853C15BD96B8484AD21EAB0A8EB83B0411E03
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \.. "Min"\.. "Sen"\.. "Sel"\.. "Rab"\.. "Kam"\.. "Jum"\.. "Sab"].. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \.. "Minggu"\.. "Senin"\.. "Selasa"\.. "Rabu"\.. "Kamis"\.. "Jumat"\.. "Sabtu"].. ::msgcat::mcset id MONTHS_ABBREV [list \.. "Jan"\.. "Peb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Agu"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset id MONTHS_FULL [list \.. "Januari"\.. "Pebruari"\.. "Maret"\.. "April"\.. "Mei"\.. "Juni"\.. "Juli"\.. "Agustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\id_id.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.904408530699153
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo0kGMo0F/W3v6ay/5o0kT+3vR6HyFvn:4EnLB383wG33v6ay/wK3voSVn
MD5:	FEB4D50576BF3E11A0A40FD29ABE35A7
SHA1:	8CEAA187C8AA5EC101743060A877D039850964CA
SHA-256:	BA7FC0C0452D3E482DB6E19BDF512CACED639BA72B92ED8F66D80B52FEA11AC0
SHA-512:	8B5D18E3D6628F369FB387C8EF08CC80000E0CBE500972958F4AD75F1C2F0DD6058F9777BD7DD0D7C26E7ECAA65E5071E2BF51B560973E88637942116C7576FB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y".. ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\is.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.457417703528286
Encrypted:	false
SSDEEP:	24:4aR83XVhVTeMVHGPbfXSmWzaZlfFxUQbW1U6ZY95n123etvmv3eTn:43Xz0b/uzaZtXUMw8n
MD5:	ACF0452D5BB6D36A40061D2B0AF4D7A6
SHA1:	9DF4D88F1962A672EFBDDE524550F7A5D02D446D
SHA-256:	778BE3D6BFE2DFFB64FF1AFB9EC8351A3343B314CF93A68E8F7FD1073EE122BB
SHA-512:	34CC02D7D28B5E161ED10250C214375561FD3D00979BFB8BCF3DB72A81BD9B7C225301528B400F7C54D8B6379F772EB6477D5D03F2CF7DC4DD19D22AEEC151B5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \.. "sun."\.. "m\u00e1n."\.. "\u00feri."\.. "mi\u00f0."\.. "fim."\.. "f\u00f6s."\.. "lau."].. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nudagur"\.. "\u00feri\u00f0judagur"\.. "mi\u00f0vikudagur"\.. "fimmtudagur"\.. "f\u00f6studagur"\.. "laugardagur"].. ::msgcat::mcset is MONTHS_ABBREV [list \.. "jan."\.. "feb."\.. "mar."\.. "apr."\.. "ma\u00ed"\.. "j\u00fan."\.. "j\u00fal."\.. "\u00e1g\u00fa."\.. "sep."\.. "okt."\.. "n\u00f3v."\.. "des."\.. ""].. ::msgcat::mcset is MONTHS_FULL [list \.. "jan\u00faar"\.. "febr\u00faar"\.. "mars"\.. "apr\u00edl"\.. "ma\u00ed"\.. "j\u00fan\u00ed"\.. "j\u00fal\

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\it.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1294
Entropy (8bit):	4.282101355195382
Encrypted:	false
SSDEEP:	24:4aR83JYEVI2vfYpQjAOnhWBIIsmdC2lkOKk+Z+FoPJ6G3vesvY:43JZVB8eAOnh4IzR2+J6G/eKY
MD5:	3354A6FC06C298E33AA14163929E56EB
SHA1:	C3005370DAE8A266AE21F7E2B871AEA5A656A155
SHA-256:	1D72170B9F9028A237364F7CD7EA8B48BD4770E61922205CE862300103B13DE5
SHA-512:	58B64D4F5827CA2A1BF2DDFD1F7EFDDBBD46709A6A9B7277E8EB386D80043A87ADDE2B3D5A49A934E8EB8F797BD735FADA1D22AD3DD856FFE9507F71B9E45CBA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mer"\.. "gio"\.. "ven"\.. "sab"].. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \.. "domenica"\.. "luned\u00ec"\.. "marted\u00ec"\.. "mercoled\u00ec"\.. "gioved\u00ec"\.. "venerd\u00ec"\.. "sabato"].. ::msgcat::mcset it MONTHS_ABBREV [list \.. "gen"\.. "feb"\.. "mar"\.. "apr"\.. "mag"\.. "giu"\.. "lug"\.. "ago"\.. "set"\.. "ott"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset it MONTHS_FULL [list \.. "gennaio"\.. "febbraio"\.. "marzo"\.. "aprile"\.. "maggio"\.. "giugno"\.. "luglio"\.. "agosto"\.. "settembre"\.. "ottobre"\.. "novembre"\.. "dicembre"\.. "

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\it_ch.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.8982877714191035
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoi5jL/oyJ+3v1oia+3vjLtAsvn:4EnLB383b3F+3vV3v3tnn
MD5:	E4400C16406A46C2880250522BED2EDE
SHA1:	787A04037A355FF845025B8865335EB938280BFB
SHA-256:	24B5F303F5C7AF6F63FDC23ADB4D713087AE74B6D18C117D787AF03374C5F57E
SHA-512:	3551DEEF0EAAC66042143F77F2F4DD9154764F35BD624DAB3C9F0F59F3489CA39CE34BC2A69BC5BFBB1926C6F5C39D74A806ECB1A47F6B374101071957FD417B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y".. ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ja.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	4.951012555106795
Encrypted:	false
SSDEEP:	24:4aR83Gl84OCtnbf3wvtMwvLv4GTwhvevTwSoXghGhD6h:43FULWttbdEVoES8gshD6h
MD5:	11FBE427747012444AEEAFD6134034A4
SHA1:	58C72C432053264EAE6335D6CC93C5FFA33C42B8
SHA-256:	2B6D15A191437F1B84FA7023E34153B61E6BF1DE1452EA921E9CCBBE5D4BEB1C
SHA-512:	4F993BDF5D50D6D9F7410C83D226FEF30BA8C989F9977A7025C36BE22CEECCD6C68CDD6AFC5C9CE3D700559C4EDC619042E14DD88EE7583B9D5AA66F0268FD23
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u6708"\.. "\u706b"\.. "\u6c34"\.. "\u6728"\.. "\u91d1"\.. "\u571f"].. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \.. "\u65e5\u66dc\u65e5"\.. "\u6708\u66dc\u65e5"\.. "\u706b\u66dc\u65e5"\.. "\u6c34\u66dc\u65e5"\.. "\u6728\u66dc\u65e5"\.. "\u91d1\u66dc\u65e5"\.. "\u571f\u66dc\u65e5"].. ::msgcat::mcset ja MONTHS_FULL [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"].. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d".. ::msgcat::mcset ja CE "\u897f\u66a6".. ::msgcat::mcset ja AM "\u5348\u524d".. ::msgcat::mcset ja PM "\u5348\u5f8c".. ::ms

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\kl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	4.097746630492712
Encrypted:	false
SSDEEP:	24:4aR83E7XIE/OWbjH3Tw2PzJrIsmZ5maAXaMHPB:43WlrraA/vB
MD5:	2F79804667D6F8C77BB188D59EF5F3DF
SHA1:	10950ECA798F24A7C405B3E18B559CCC0C056EC1
SHA-256:	96FF17F1CFF976E4E204D3616D1EFCED4D0F907C5E6A0F04B4536CB4AD1190C9
SHA-512:	1B8ADC3B7FF920F8F53A17BFCC7EA24A0F8E276A42E5C63F9880DAE9B74E12716DD12DB647A80A9D99294449146C643EC58A33B03681AA4FA26A5FBC508C248C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \.. "sab"\.. "ata"\.. "mar"\.. "pin"\.. "sis"\.. "tal"\.. "arf"].. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \.. "sabaat"\.. "ataasinngorneq"\.. "marlunngorneq"\.. "pingasunngorneq"\.. "sisamanngorneq"\.. "tallimanngorneq"\.. "arfininngorneq"].. ::msgcat::mcset kl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset kl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "martsi"\.. "aprili"\.. "maji"\.. "juni"\.. "juli"\.. "augustusi"\.. "septemberi"\.. "oktoberi"\.. "novemberi"\.. "dece

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\kl_gl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.882476709336307
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEpb53FuoEpLE3vLjoEpLE3v6mjoEpba+3vnFDoAkvn:4EnLB383jF3Fyw3vxw3v6A/3v9dmn
MD5:	255830678C8724E65C05A7E020E68B5B
SHA1:	0AEA48AB0439C04F92B5CA9A3B5182718B7F116B
SHA-256:	3027CFE9EBD2172CEFC15C025786CAD47A6E2894BF0474AFC1B0C341E70202AA
SHA-512:	99039FFA7269DD136D1693121E261DB5586E86EC401D2B1EB8FB1D13A9A7F1E514D9FC941B838286B986C02ED281828ED67E59002D837E350A64F4832340516A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y".. ::msgcat::mcset kl_GL TIME_FORMAT "%T".. ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T".. ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ko.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.612163420716489
Encrypted:	false
SSDEEP:	48:43fMlylslXlslxl1hVuqLGuqqntH4xUyw9:2fKYqVq3f
MD5:	CCB2C2254D3FA3025183DB7E010CAD66
SHA1:	510BBB6A9162F2EF908E6561CC714848C2EA74CA
SHA-256:	EF6FB319C398EEA79B3A951319F831F3B186D556565D17D738E5F9B4B77570F2
SHA-512:	A0264565899BD1B0783ADC0388F893CCE713ADB23BDD63907CF092A74ACB4F7D3BE09DA29801E9C11A7B08CB1706E3771C598ACED351A0FCCBF4EBBD7871148D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \.. "\uc77c"\.. "\uc6d4"\.. "\ud654"\.. "\uc218"\.. "\ubaa9"\.. "\uae08"\.. "\ud1a0"].. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \.. "\uc77c\uc694\uc77c"\.. "\uc6d4\uc694\uc77c"\.. "\ud654\uc694\uc77c"\.. "\uc218\uc694\uc77c"\.. "\ubaa9\uc694\uc77c"\.. "\uae08\uc694\uc77c"\.. "\ud1a0\uc694\uc77c"].. ::msgcat::mcset ko MONTHS_ABBREV [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\.. "7\uc6d4"\.. "8\uc6d4"\.. "9\uc6d4"\.. "10\uc6d4"\.. "11\uc6d4"\.. "12\uc6d4"\.. ""].. ::msgcat::mcset ko MONTHS_FULL [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ko_kr.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.058233326545794
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo56SFZhjAo56m5Ys5o56TGMovBo56a/W3v6mfKo56TT+3+:4EnLB383g62vjV6m5Ysg6TG26a+3v6oo
MD5:	58CA45CE26AF8ECA729BA72898BB633D
SHA1:	CBBEDB7370890A1DB65080A359A9A5C164B525D5
SHA-256:	4CAC8FB43D290A63A4D3215F22228B358AB4FA174F08712DD6C5B64C5E485071
SHA-512:	48CCBD3F7B96D0998B6D1A1F8D7FE2B4B070BB5B8809FABE0A38209AEAF2E95E098292A5B9B5F0954E7729708A2173D32AAD70B6C0F336DB1E9BFA2968E6A56B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804".. ::msgcat::mcset ko_KR CE "\uc11c\uae30".. ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d".. ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S".. ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\kok.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1997
Entropy (8bit):	4.202940482570495
Encrypted:	false
SSDEEP:	24:4aR83cm48Vc7VczMmDNVcYVcR0prdSmS68FeDJVcYVcR0prdSmS68FeuT:4354a+0prjS68mq0prjS68pT
MD5:	67FA08F588A3B44D67E42EC1025013BC
SHA1:	6895FEF0476DE0349895DB052B335AC46636B23A
SHA-256:	9D215E31A39FED45B3657144E5F73C942E59E500036CE16B1FFF201FD6358595
SHA-512:	4C2708BD9DD98320D3133EEFFD19A8018F49A36AB8348DB7C0B0287ADB4C052D3EFAD3686C8E46E0520F3CE27F361978272BA8752EB04E5A7BC07780398480DB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \.. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset kok MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\kok_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.904340548436718
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo5VsNv+IZo5VsU3v6ry/5o5VsNo+3v+6f6HyFvn:4EnLB383gVsNvlAVsU3v6ry/gVsNF3vj
MD5:	0AA20289A63BA3A14DCFED75EED980DE
SHA1:	2B76013593D886B0724D82849FD1840B20922902
SHA-256:	644F2B6D4BA27AF14891B781DEF60F708A9F18FC2F73566649B631A6DEA3EF09
SHA-512:	6E13E0DC8BFD2ABE0D04B0BC098C40972F088F8D3D6ACA00338B17473ABC6F69840A88EC0C965C493B4270DEC777A0EA2D762BC33044EFE7030E437604EE201B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\kw.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1013
Entropy (8bit):	4.060027087416375
Encrypted:	false
SSDEEP:	24:4aR83no1UwRlw4MAwBdc//3rpF6HFoot8:43vglHM7MTCHFs
MD5:	CCEC7B77DCA1F6A406311FC43EE57030
SHA1:	4ED329BB09A8F7C67F8984CD790E9B6819DE6F00
SHA-256:	EAB468AC5BF1833D4F8CD658789413D4A46CAD16B63FB9B906CFF6DC9EA26251
SHA-512:	4EFF6E49CC479A1BF0CEEAE256A1FAE7D4AE7D0ACE23CD87851471EC96BB5AF580C58A142E1B6CE72BC8B6BFF946A38801E681443B7DD9527A1DEB6E7EDD7D22
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \.. "Sul"\.. "Lun"\.. "Mth"\.. "Mhr"\.. "Yow"\.. "Gwe"\.. "Sad"].. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \.. "De Sul"\.. "De Lun"\.. "De Merth"\.. "De Merher"\.. "De Yow"\.. "De Gwener"\.. "De Sadorn"].. ::msgcat::mcset kw MONTHS_ABBREV [list \.. "Gen"\.. "Whe"\.. "Mer"\.. "Ebr"\.. "Me"\.. "Evn"\.. "Gor"\.. "Est"\.. "Gwn"\.. "Hed"\.. "Du"\.. "Kev"\.. ""].. ::msgcat::mcset kw MONTHS_FULL [list \.. "Mys Genver"\.. "Mys Whevrel"\.. "Mys Merth"\.. "Mys Ebrel"\.. "Mys Me"\.. "Mys Evan"\.. "Mys Gortheren"\.. "Mye Est"\.. "Mys Gwyngala"\.. "Mys Hedra"\.. "Mys Du"\.. "Mys Kevardhu"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\kw_gb.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.959913054070712
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoh6AvMoh633v6ay/5oh6Ao+3vR6HyFvn:4EnLB38346AvR633v6ay/46AF3voSVn
MD5:	18E8576F63B978F1AFEF15AC57B44FBF
SHA1:	D50EB90944FF81E3CBFF942B16C1874EB7EA2562
SHA-256:	EDAC14D929D1C6559EC46E9B460F8F44A189B78FB915F2D641104549CBD94188
SHA-512:	F3DE5EE77BB889DA1353F9C9A1811083AB28BBEE4B7D6C8782F38B1AE44CF77565371A0E18F7E2BACD7EF590BC1215CA3E41AF929A15F60B3E85F6099A4CF378
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\lt.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	4.506235846178408
Encrypted:	false
SSDEEP:	24:4aR83iHYuAMLzHYCaNu3d3nT15T31FhAlDgK/YrDZ/6Qz2C9kGPCveksvc:43iHFnHuUd3/T3xM/+SQCC9kGPEekKc
MD5:	D4EC2E96995E0EB263F338DD16CC4F8D
SHA1:	7ED86175489B1AE3CA5C0E8D42969F951C895D6B
SHA-256:	855B652FCC8066BA45C7DC8DBFD3807D1B4759EA8D71C523567F47BF445D1DE6
SHA-512:	A55E0D759A22360FF6668CEFAFFB812BABB316C447ADDB1FD5CDBC06AE1DA2E891E09952D073164C013AD9BF4184614102E7ADA553EEEFB2BBA26208B79B277F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \.. "Sk"\.. "Pr"\.. "An"\.. "Tr"\.. "Kt"\.. "Pn"\.. "\u0160t"].. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \.. "Sekmadienis"\.. "Pirmadienis"\.. "Antradienis"\.. "Tre\u010diadienis"\.. "Ketvirtadienis"\.. "Penktadienis"\.. "\u0160e\u0161tadienis"].. ::msgcat::mcset lt MONTHS_ABBREV [list \.. "Sau"\.. "Vas"\.. "Kov"\.. "Bal"\.. "Geg"\.. "Bir"\.. "Lie"\.. "Rgp"\.. "Rgs"\.. "Spa"\.. "Lap"\.. "Grd"\.. ""].. ::msgcat::mcset lt MONTHS_FULL [list \.. "Sausio"\.. "Vasario"\.. "Kovo"\.. "Baland\u017eio"\.. "Gegu\u017e\u0117s"\.. "Bir\u017eelio"\.. "Liepos"\.. "Rugpj\u016b\u010dio"\.. "Rugs\u0117jo"\.. "Spa

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\lv.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1271
Entropy (8bit):	4.460631492946299
Encrypted:	false
SSDEEP:	24:4aR83Amshb4mZdA7nl9kMmfpK269rkbi5vWm0W9ARivirXsv05vkn:430bHA7XRr95QWQQgaKkn
MD5:	554ED2CAFD25F5F82DA54AE057F4BA98
SHA1:	E25CDF0F9C4B523B5B05408E7820F7B4F627D19E
SHA-256:	7E90D2008B220DB19C796C7107AD69D263B8AC8C7BDDFB879230699D978E9A0A
SHA-512:	612201CCD64A51EC943921196D8C74D8BCA3AB3E35B0C9E91AE7F3A6B36F4F255AA9ADB3A254EC03629B01BD221B0B3F8CC4DFBFAC1F1718775E81CAD188AA86
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \.. "Sv"\.. "P"\.. "O"\.. "T"\.. "C"\.. "Pk"\.. "S"].. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \.. "sv\u0113tdiena"\.. "pirmdiena"\.. "otrdiena"\.. "tre\u0161diena"\.. "ceturdien"\.. "piektdiena"\.. "sestdiena"].. ::msgcat::mcset lv MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maijs"\.. "J\u016bn"\.. "J\u016bl"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset lv MONTHS_FULL [list \.. "janv\u0101ris"\.. "febru\u0101ris"\.. "marts"\.. "apr\u012blis"\.. "maijs"\.. "j\u016bnijs"\.. "j\u016blijs"\.. "augusts"\.. "septembris"\.. "oktobris"\.. "novembris"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\mk.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	4.299300188052441
Encrypted:	false
SSDEEP:	48:4389QMsGqdQfRQPjQmofqJp9sk5BstSpWQiQ3QJQ5QL39I0QRQTQ8Ql4J8W:2W8SMq+9sWINi2Kc9I0+gXF
MD5:	888014F13A82511ABEF99497A753BFC3
SHA1:	7F4231BEDE191370B37E8B917B6AD8829D15CA7D
SHA-256:	4C0EB07F0FCB36DD12A3F7EDD6531616611ABF62BF7705B5A37CC59098221D5D
SHA-512:	D748127CC615584901D35B6492EC566448B6C4DA6363858B5145921E9CD09490355CF4315F0F7A8542AA12790CD3432011A643A3A8F74B0119DB0DCE19FD68A4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0435\u0434."\.. "\u043f\u043e\u043d."\.. "\u0432\u0442."\.. "\u0441\u0440\u0435."\.. "\u0447\u0435\u0442."\.. "\u043f\u0435\u0442."\.. "\u0441\u0430\u0431."].. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0435\u043b\u0430"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\.. "\u043f\u0435\u0442\u043e\u043a"\.. "\u0441\u0430\u0431\u043e\u0442\u0430"].. ::msgcat::mcset mk MONTHS_ABBREV [list \.. "\u0458\u0430\u043d."\.. "\u0444\u0435\u0432."\.. "\u043c\u0430\u0440."\.. "\u0430\u043f\u0440."\.. "\u043c\u0430\u0458."\.. "\u0458\u0443\u

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\mr.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	4.220147808639664
Encrypted:	false
SSDEEP:	24:4aR833cXh48Vc7VczfVczPmzNVcYVcR0prdSmS68FezUVcYVcR0prdSmS68FeoV:43K4S+0prjS68Yh0prjS68nV
MD5:	07F99E0A05083B10F80A4D6867163B23
SHA1:	B6036C7DA8043E3401583D03831E7A4BF755D93D
SHA-256:	AE873BF5484EACBBE179913D43451BE53378FA701B5D81594D052266B8A09AF0
SHA-512:	3A032C81B8FBFEE6EB66C1538CBD16329A1B393E4684B4E9B3FBCDD6344CE8AD34FA699F76EF953B3EB597D8E253345F54C2E92E7A43611C721038BCC2471EA2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset mr MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\u091f\u0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\mr_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.89440333975705
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoGNv+IZoGU3v6ry/5oGNo+3v+6f6HyFvn:4EnLB383Zvlw3v6ry/ZF3vmSVn
MD5:	67368E8A5715860BABD44E54A168192F
SHA1:	7790D4B4B28FE5E38AB11CD037FFB826A8EB77FD
SHA-256:	B7B1D379355A1D278E13EF557A887A662E84FB6A9B62B8E19A27927926270EF9
SHA-512:	E95C90CFFA7CC4E61026FC328A4AA0BEE6A54A0061BA0B9459F9F0F4B008DD36F81BC9B8D8B964FA051FCEAB7FECE6D107CD456B3FD01A83B4900ECC3A0BCFA4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ms.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	957
Entropy (8bit):	4.018924167342869
Encrypted:	false
SSDEEP:	12:4EnLB383Zm/aufodZmt+JHEA7UVRosmAL/7Idzr43xRRosuL1PJHWZ6tHhHjv:4aR83ZsauSHJkA7umE/72UD21PJWZ0hT
MD5:	7E6A943B7D82404F61BDBD95682073CD
SHA1:	B96DBB1738F293D2842FDCEDF2DEF13004F77A8D
SHA-256:	970B2F3ECC04980FCC2F9531CA6CE2BF36BC12942CB614BF70313B4CB0508985
SHA-512:	12F5A5F7A170EE79D1F4398E96FF2DE84472027C5B5003DE7E86F46713E3F0997439E2EBA03FFB7DB611F0CE0E06EB149F5BD08ED2AA0409DB8348867487FFFD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \.. "Aha"\.. "Isn"\.. "Sei"\.. "Rab"\.. "Kha"\.. "Jum"\.. "Sab"].. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \.. "Ahad"\.. "Isnin"\.. "Selasa"\.. "Rahu"\.. "Khamis"\.. "Jumaat"\.. "Sabtu"].. ::msgcat::mcset ms MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mac"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ogos"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dis"\.. ""].. ::msgcat::mcset ms MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Mac"\.. "April"\.. "Mei"\.. "Jun"\.. "Julai"\.. "Ogos"\.. "September"\.. "Oktober"\.. "November"\.. "Disember"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ms_my.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.818053174805798
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoChFfluoChF+3v6xyFjoCh++3vflm68vn:4EnLB383xPflwe3v6gZl3vflm6+n
MD5:	A02F11BE0DF920E63E7A3ACCE746E32D
SHA1:	4A8B1EF1A6F8A5FD022042D6E009A01E4B0FEBD3
SHA-256:	F5B859D8DD2A2B5F756E39B0DFEB26B95878D2F54BA3CE46C56F0F26CF2B554B
SHA-512:	5F9AF8C89F491CB4C158ED73EA4CF32E6A83CF44A94DA6FE1A962C58199BF2348530F3DEFA0C6F433BA3ADEF81AE9B3884F30CD7A841B159D52F9F21008B4F92
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\mt.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	717
Entropy (8bit):	4.55153350337982
Encrypted:	false
SSDEEP:	12:4EnLB383VYmxWHWog4QUbxMmAMMiGZu+3v6ay/GK3vZsSVn:4aR83VYsxonQ2MmVVGRvjCGsvGSV
MD5:	D8BBEC2F8935054E6081BB5E4AE8F7E3
SHA1:	33FE6D51A284B8760BC6F442329B10374F506BDA
SHA-256:	7DBC4E82D82FDE8CDF522FA10E082289D46B0C1A4A7D7A5FA83FF116677F052B
SHA-512:	BF39C75DD6B3625897D7D44AC253AF5656CA21D0B394F78611584E2606CBC419C4A02353542D23393BEBCCF0CB4D861CDECD61AD89339F78C0260E966B495777
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \.. "\u0126ad"\.. "Tne"\.. "Tli"\.. "Erb"\.. "\u0126am"\.. "\u0120im"].. ::msgcat::mcset mt MONTHS_ABBREV [list \.. "Jan"\.. "Fra"\.. "Mar"\.. "Apr"\.. "Mej"\.. "\u0120un"\.. "Lul"\.. "Awi"\.. "Set"\.. "Ott"\.. "Nov"].. ::msgcat::mcset mt BCE "QK".. ::msgcat::mcset mt CE "".. ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y".. ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\nb.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	4.313626715960843
Encrypted:	false
SSDEEP:	24:4aR83B0tSYuZrIsmYmPAxyIQ4HU92W16EL3Tvav31:43qhuZrIPAt04yTcF
MD5:	42D02C3CAF28BE4994F27CEF5A183AB7
SHA1:	DC411E8AC12C3D588AB2F3A3C95A75D8689AD402
SHA-256:	534C5DACEF12F818FAF4ED806997A559F95D591F1B6236B0C30B07A107DD13F3
SHA-512:	0BE27572106324FE2B6CDFF4513500DE7582AD1ABEF451FFC62B2050D3875A149DDDB66451E1B3F5BA9216268E9998D2A1C1E8343BBB9EF97947DA054B82818E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset nb MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nb MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nb BC

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\nl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1129
Entropy (8bit):	4.235969198645435
Encrypted:	false
SSDEEP:	24:4aR837Ed+RxRMZZsmUmnZAEEHM92WFU5vtrvs:43AAHRMZZPnZALsCtt7s
MD5:	B9B949794203D204628D4DBEA29587AE
SHA1:	1642D8040144469B5C359E80693E68036F87B849
SHA-256:	9E2FE3851CF13EC79A9B10A09B01CEB0A26044AE0DC90A4E00BE57745E854C79
SHA-512:	0CCCCF6D61423CEE0389C3BA1A8E94F2B092C53465D1937F5595AF91E46DD38B318D6C7EE3D88B89F32BFB952C0D55E0E67B46D7DF306ECA6690E283ADEB2CB9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \.. "zo"\.. "ma"\.. "di"\.. "wo"\.. "do"\.. "vr"\.. "za"].. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \.. "zondag"\.. "maandag"\.. "dinsdag"\.. "woensdag"\.. "donderdag"\.. "vrijdag"\.. "zaterdag"].. ::msgcat::mcset nl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mrt"\.. "apr"\.. "mei"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset nl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "maart"\.. "april"\.. "mei"\.. "juni"\.. "juli"\.. "augustus"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset nl DATE_FORM

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\nl_be.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.865165930946383
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo4gPPdjog9X3vLjog9X3v6mjo49+3vnFDoAkvn:4EnLB3835gHdPF3vjF3v64I3v9dmn
MD5:	3261F397ED0291368FF1881E7BA08ECE
SHA1:	7147ABB62034EB152B1FED9246A533535F07372C
SHA-256:	77A69DD60D171B321512B14794E75A66FF753410C007997B310790D86E09B057
SHA-512:	C1526F454FA594DAD056B056F76F01D8B2AB713D04EB2A3643416B8E741B248CC94E000BAEE5B0F60436B88B1216FB1DE7F7C3FA456D4A4FBDE24F97C3B739B8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y".. ::msgcat::mcset nl_BE TIME_FORMAT "%T".. ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\nn.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.282788574144479
Encrypted:	false
SSDEEP:	24:4aR83tCtrJwuQrIsmYmLAxyIQ4HU92W1W4/3Hv+v31:434suQrILAt0EafIF
MD5:	985E97517C2BF37719A618F575DF392C
SHA1:	65BC07FC3A955300ED09B7485F90AEC18CBAD43F
SHA-256:	06FA2D6D8C59D0B8EAC2EDE5AB0DDB8B6E095D1A023B1966FCE3B65916FA14FB
SHA-512:	75BC14DBAD147A98D32D2AF0BE0BE50F115BB9C3BBE283B53977B9F264A055734B30F6B1C4EEE9686F1874D178C535111731C92D495B7D370FB17213B65C9A40
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "m\u00e5"\.. "ty"\.. "on"\.. "to"\.. "fr"\.. "lau"].. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \.. "sundag"\.. "m\u00e5ndag"\.. "tysdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "laurdag"].. ::msgcat::mcset nn MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nn MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nn BCE "f.Kr."

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\pl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.459506202908786
Encrypted:	false
SSDEEP:	24:4aR83lUj0ORGgIzdW6RDYKG7FwRc0ypvOvX:43+HMg2W6RDYnFwRc0ydYX
MD5:	79AB7C13AA3833A1DAEADDB1144CCE55
SHA1:	C01ABC2F16549CAEC6B081448B2CBA88A680E250
SHA-256:	61462C325DB0065352D8155307F949869862A86CAC67AD7BB6703F57A7FA2FF3
SHA-512:	79EB696164FDDD9B121558C2780E54E295FF2DC4D8E87A0DE507B4F2925612721A98FF5010199CB68CF894ACA7A07884E9E02F3DC1E078D241431E3DC884C0A1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \.. "N"\.. "Pn"\.. "Wt"\.. "\u015ar"\.. "Cz"\.. "Pt"\.. "So"].. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \.. "niedziela"\.. "poniedzia\u0142ek"\.. "wtorek"\.. "\u015broda"\.. "czwartek"\.. "pi\u0105tek"\.. "sobota"].. ::msgcat::mcset pl MONTHS_ABBREV [list \.. "sty"\.. "lut"\.. "mar"\.. "kwi"\.. "maj"\.. "cze"\.. "lip"\.. "sie"\.. "wrz"\.. "pa\u017a"\.. "lis"\.. "gru"\.. ""].. ::msgcat::mcset pl MONTHS_FULL [list \.. "stycze\u0144"\.. "luty"\.. "marzec"\.. "kwiecie\u0144"\.. "maj"\.. "czerwiec"\.. "lipiec"\.. "sierpie\u0144"\.. "wrzesie\u0144"\.. "pa\u017adziernik"\.. "listopad"\..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\pt.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.394980756969744
Encrypted:	false
SSDEEP:	24:4aR83CYkjBc1yHYJt//0/I31YMY47flV7YaqgCyt9Fo8g6Gtvt76svi:43C5LHcNnxJ9Ltg6Gpt76Ki
MD5:	8F53B3571DD29E12BD33349CFA32F28F
SHA1:	C125E059B8BFE5FECD482D1A1DA50B8678872BF6
SHA-256:	6F6EEEDDCF232BDCB952592A144810CED44A1CBB4BCC2C062D5F98D441505380
SHA-512:	5CD7E7097B720E5399795126A71348816CBA697FD8F14160779E982ADAB00D5994978E2F9445785B0DE62F6F14232278AD1A65BC53730CA58D676B057F0BC406
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Seg"\.. "Ter"\.. "Qua"\.. "Qui"\.. "Sex"\.. "S\u00e1b"].. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Segunda-feira"\.. "Ter\u00e7a-feira"\.. "Quarta-feira"\.. "Quinta-feira"\.. "Sexta-feira"\.. "S\u00e1bado"].. ::msgcat::mcset pt MONTHS_ABBREV [list \.. "Jan"\.. "Fev"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset pt MONTHS_FULL [list \.. "Janeiro"\.. "Fevereiro"\.. "Mar\u00e7o"\.. "Abril"\.. "Maio"\.. "Junho"\.. "Julho"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Dezembro"

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\pt_br.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.8608779725401785
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xofm6GPWWjofAW3vLjofAW3v6mjofm6T+3vnFDoAkvn:4EnLB383+NGdg93vk93v6fNK3v9dmn
MD5:	A2626EA95C2480FEA68906AE6A1F6993
SHA1:	A0592902337C00FC2E70B1DFB3A42453A86535BB
SHA-256:	320BE7D5B730091E6FA35F196314737261C8E154577DCF6AC8C2057D44394AD7
SHA-512:	9801A87D024565676D4F3EAF0702C213E59FC2B6719D8BE95C19C9ED53FC43487F65F5408378B401A2B4C2BD4E2E391C2D848CA87739A6082AB7766EC6B9EFE1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset pt_BR TIME_FORMAT "%T".. ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T".. ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ro.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.350784108088039
Encrypted:	false
SSDEEP:	24:4aR83coPUMSeZmkTMm41icpK+7ZVoImEcVUCWdvHvWIn:43lPHFmkm1iMVoxEc+CWZPWIn
MD5:	F6575EC17966320106FF7ABDFB3186E2
SHA1:	68C6B72D664FDA27450FCE8B5734AB627CE825D7
SHA-256:	25ED6AC7A353E23B954B98611AE3B7E56BDCF2B0CB0DB358253CFB8BEBBB831C
SHA-512:	E564543231922A17C898419545BFA65E5E31FE9F005FDD201B735CFDE08E96FB3B98349C2A7959E29CA8F7E6934B0C4C6DE6B5E67209D0DD9A7746DFEBF037B3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \.. "D"\.. "L"\.. "Ma"\.. "Mi"\.. "J"\.. "V"\.. "S"].. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \.. "duminic\u0103"\.. "luni"\.. "mar\u0163i"\.. "miercuri"\.. "joi"\.. "vineri"\.. "s\u00eemb\u0103t\u0103"].. ::msgcat::mcset ro MONTHS_ABBREV [list \.. "Ian"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mai"\.. "Iun"\.. "Iul"\.. "Aug"\.. "Sep"\.. "Oct"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset ro MONTHS_FULL [list \.. "ianuarie"\.. "februarie"\.. "martie"\.. "aprilie"\.. "mai"\.. "iunie"\.. "iulie"\.. "august"\.. "septembrie"\.. "octombrie"\.. "noiembrie"\.. "decembrie"\.. ""].. ::msgcat:

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ru.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.2886524607041006
Encrypted:	false
SSDEEP:	48:43D+pQ7keidQfRQPgQHB81Z/sFIAZSQWQXQrQxJQjQRnQBFQiWftkWt:26pgkeoSnpjA4tMYiJcCMFmVRt
MD5:	9F1C8DD58550558977821FD500E7C0E0
SHA1:	EFDD809BC2872A5BE0E353D31BE6D7D72E4B829C
SHA-256:	BB35BB6F07BAEF72C329EC3E95D6527A2736070EE2FFE5DE227E1FF0332390F8
SHA-512:	AA3C5C40AE9D342F8287958355C3321CF60566AD3E84E3D18D782FC022A998DA275506A61010A65D2E7D7578F2919C47C63AB0BA63A38800AA48D4B88ACE54D3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \.. "\u0412\u0441"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \.. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\.. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\.. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"].. ::msgcat::mcset ru MONTHS_ABBREV [list \.. "\u044f\u043d\u0432"\.. "\u0444\u0435\u0432"\.. "\u043c\u0430\u0440"\.. "\u0430\u043f\u0440"\.. "\u043c\u0430\u0439"\.. "\u0438\u044e\u

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ru_ua.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.9420431225061
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoVAgWIZoVY9X3vtfNrsoVA9+3vW6Q9vn:4EnLB383SFWIyaX3vtNl/3vWHNn
MD5:	DC98D88964650E302BE97FDB3B33326E
SHA1:	1DDDCC4265D7B980B867FEE674BEF2FD87D823F7
SHA-256:	13E4E79A0ED82034BADE0CFF8DEF5DE1222F6968108AD710662BDB7DAF36D7E1
SHA-512:	F3B9D528C529DD520FEDA3C20ED354E521C5B3C29F3317E15B7939CE06A3D67554D34DD6E54FE038585E46C560C604A1FD7E7F84914086B5994D52CE2C9E99CE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y".. ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\sh.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.359036493565628
Encrypted:	false
SSDEEP:	24:4aR83/YIXo4YY0dD6kMm7fX2NaSIvZdHZgHZ/IxvaGWxvtl9svWTN:43rLTR44/yWltOWB
MD5:	E297221FA73BD78577B398BC7D061D21
SHA1:	F2A6B456272F913A9E97C495CEE73AC774C90FA1
SHA-256:	E65D6E5E837DF0A2DF0DB77BCE45334BBC27EFFF9023C37119E75D49932D9D6C
SHA-512:	AB9DDAE7CB21193C7753041F0B88CF2D40987E7E604B47816219458D217F084AA4EBF36719E22AAB3FD71A271D9F956ADC353182991903D7ADE8C8F00F6B2F9B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Uto"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sub"].. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljak"\.. "Utorak"\.. "Sreda"\.. "\u010cetvrtak"\.. "Petak"\.. "Subota"].. ::msgcat::mcset sh MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maj"\.. "Jun"\.. "Jul"\.. "Avg"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset sh MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "Mart"\.. "April"\.. "Maj"\.. "Juni"\.. "Juli"\.. "Avgust"\.. "Septembar"\.. "Oktobar"\.. "Novembar"\.. "Decembar"\.. ""].. ::msgcat::mcset sh BC

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\sk.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.4043119723436135
Encrypted:	false
SSDEEP:	24:4aR83c46o40u3rIsmJIcm93ApLDVb2IcU95WFGEXF3eUCvtz/v3e6:43c3ow3rF93Ap7tEXFREtznp
MD5:	24DA40901D907D35195CC1B3A675EBC7
SHA1:	8AF31248F06FADA5CFB0D83A940CFF5CE70E2577
SHA-256:	976813F6C53C9BEBBF976B0F560FD7FC5E4EC4C574D7E1CD31F9A4056765CB7A
SHA-512:	A9BC6AAFE9AEEDFD1E483E54A2D27871A09ADD6807D8F90410CD2BB82A91BA9DF435652EC9A7C3AD0A080D7F153CA848BB47DAD3936BA30E4AEFF3C474C433CC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "Ut"\.. "St"\.. "\u0160t"\.. "Pa"\.. "So"].. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \.. "Nede\u013ee"\.. "Pondelok"\.. "Utorok"\.. "Streda"\.. "\u0160tvrtok"\.. "Piatok"\.. "Sobota"].. ::msgcat::mcset sk MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sk MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "marec"\.. "apr\u00edl"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "august"\.. "september"\.. "okt\u00f3ber"\.. "november"\.. "decem

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\sl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	4.333705818952628
Encrypted:	false
SSDEEP:	24:4aR83MIXpC9opYuGS/BrIsmZ5hv1yAxyIVjd392WFThENvt0vJoO:43fXYujZrqyApYJtyR
MD5:	CB76F54CBE0D1AAE8BA956B4C51CBD2A
SHA1:	C1F78375EDB0BD2504553E33B2024C0C63FDB1B2
SHA-256:	11A6264676DBED87E4F718075127E32E107854F35F141642454F484984084486
SHA-512:	69964348FF08DE6EEB5E3DD61057FF0DF5441105EB7BEE7FB7E9AC5E26DCC164E3C7C011CA5CD7BC5B97A7872532331C97CCBC80563F6C5A3548014BFA8BEF16
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Tor"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sob"].. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljek"\.. "Torek"\.. "Sreda"\.. "\u010cetrtek"\.. "Petek"\.. "Sobota"].. ::msgcat::mcset sl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "avg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sl MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marec"\.. "april"\.. "maj"\.. "junij"\.. "julij"\.. "avgust"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset sl B

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\sq.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	4.408176575111904
Encrypted:	false
SSDEEP:	24:4aR83F7ONQEwXwjjTlVoSEh76W/X+WZQJ4hv+H6v2V:43NwjPEwl4VQ8q
MD5:	E606F620F03EC0FBDBE6551601299C5F
SHA1:	0B50AB679E8D90D8E7319BCADAC426E004594D3B
SHA-256:	1F4EFD78F6B45B65F73F09B2F52FC13C2A7C4138DCB7664804878D197B6EBDF9
SHA-512:	08AF2B51EB7111E334ADDA3A03F9A8816C104E9742B523EC363FB5131A3DF73D298A8DDCD573D23C23C65CCFD2B8898DF75AE3D4F04BF80744044FB6BAB5EC0A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \.. "Die"\.. "H\u00ebn"\.. "Mar"\.. "M\u00ebr"\.. "Enj"\.. "Pre"\.. "Sht"].. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \.. "e diel"\.. "e h\u00ebn\u00eb"\.. "e mart\u00eb"\.. "e m\u00ebrkur\u00eb"\.. "e enjte"\.. "e premte"\.. "e shtun\u00eb"].. ::msgcat::mcset sq MONTHS_ABBREV [list \.. "Jan"\.. "Shk"\.. "Mar"\.. "Pri"\.. "Maj"\.. "Qer"\.. "Kor"\.. "Gsh"\.. "Sht"\.. "Tet"\.. "N\u00ebn"\.. "Dhj"\.. ""].. ::msgcat::mcset sq MONTHS_FULL [list \.. "janar"\.. "shkurt"\.. "mars"\.. "prill"\.. "maj"\.. "qershor"\.. "korrik"\.. "gusht"\.. "shtator"\.. "tetor"\.. "n\u00ebntor"\.. "dhjetor"\.

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\sr.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	4.307749748884122
Encrypted:	false
SSDEEP:	48:43ilQTSBQrQP9QenzMKSFD9NI/QiNQEQrQL1KKYjU5rtAx:2I5EyLMKSFZNIYMzYMKKiqW
MD5:	BF363AB60B57F6D8FDCDBFD230A28DDF
SHA1:	6375CBA0A2197DA7E65BEE45C42F02C4F0B9142D
SHA-256:	FA00A7B22C9941F6C2B893F22B703DCB159CA2F2E4005FD6A74A632AEB786BFA
SHA-512:	91AD8085EF321A5A0E4D2ED204940CB66E8E230BBEDE59A8A07D1CEED9155FCC6B075A1FCC44AE834C1FEEEB3A59256C4310684C5AC453D4C50DFABD88469814
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0435\u0434"\.. "\u041f\u043e\u043d"\.. "\u0423\u0442\u043e"\.. "\u0421\u0440\u0435"\.. "\u0427\u0435\u0442"\.. "\u041f\u0435\u0442"\.. "\u0421\u0443\u0431"].. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u0459\u0430"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\.. "\u0423\u0442\u043e\u0440\u0430\u043a"\.. "\u0421\u0440\u0435\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\.. "\u041f\u0435\u0442\u0430\u043a"\.. "\u0421\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset sr MONTHS_ABBREV [list \.. "\u0408\u0430\u043d"\.. "\u0424\u0435\u0431"\.. "\u041c\u0430\u0440"\.. "\u0410\u043f\u0440"\.. "\u041c\u0430\u0458"\.. "\u0408\u0443\u043d"\.. "\

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\sv.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.3542418837714285
Encrypted:	false
SSDEEP:	24:4aR83qoLt6yLQoAusrIsmZ5m4AcjTHX92WFfjr4MvBvX:43ZLxQNusrr4Aw3Jkq1X
MD5:	3B5C3FFA0829768470BDA1B46D882060
SHA1:	C96799036EC5CCDE799A6B50CD7748908935A2F3
SHA-256:	483916B51BD7E071E88F9EC36AAF3E08FEA823991532F832DE491C6C40B55A9F
SHA-512:	684FA249123878AA7F856DF0FD3B0D9F041113CFEA8EEFA47D0E1948DA23694330BF0D62BA896A3891CD559C16CAE9330BF31508F530AC003D2929D5FD9246D8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \.. "s\u00f6"\.. "m\u00e5"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f6"].. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \.. "s\u00f6ndag"\.. "m\u00e5ndag"\.. "tisdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f6rdag"].. ::msgcat::mcset sv MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sv MONTHS_FULL [list \.. "januari"\.. "februari"\.. "mars"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "augusti"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat:

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\sw.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.108744949579904
Encrypted:	false
SSDEEP:	12:4EnLB383A4mScvhkzoR4mtuWckRkoay3UVxMmALfG7IdzVJ633xRCPLMYMvYo76u:4aR83/Shkz1uckO76kMmEf62qOTdMvvn
MD5:	5774860C8AEECBD48F1502E616158CAB
SHA1:	DE7059713EA7913A0C79F5386833CE2BCAD2CFD7
SHA-256:	1DA068C9AA02EF14A2440758C6040D632D96044A20EC501DBB9E40D8592E0E7F
SHA-512:	91E69222DDF55E9E0E389DB77D7A0F2E082351DC3FB34A1A2C1E350E4187E8BB940F6C2EDE1B8651159C2787AA0BE4D7268F33F7A82CAED03514FCE462530408
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \.. "Jpi"\.. "Jtt"\.. "Jnn"\.. "Jtn"\.. "Alh"\.. "Iju"\.. "Jmo"].. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \.. "Jumapili"\.. "Jumatatu"\.. "Jumanne"\.. "Jumatano"\.. "Alhamisi"\.. "Ijumaa"\.. "Jumamosi"].. ::msgcat::mcset sw MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset sw MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Machi"\.. "Aprili"\.. "Mei"\.. "Juni"\.. "Julai"\.. "Agosti"\.. "Septemba"\.. "Oktoba"\.. "Novemba"\.. "Desemba"\.. ""].. ::msgcat::mcset sw BCE "

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ta.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	4.080580566597515
Encrypted:	false
SSDEEP:	24:4aR83AI0xnJdnQhmHlHYPKtul+eOPfIxyH5ztUSLu8tptLtrl+eOPfIxyH5ztUSU:43N0dQmHlHYPKtu1HxMtr1Hx/
MD5:	85288236C3997302EA26D7403BBA2C15
SHA1:	05AB389CC4DCF17B37BFF6ED1ECD58D6E9850A01
SHA-256:	AEFDC4255890D5B3FFE5CEE1B457B7D711283C2287ABA644155C10956012F6C1
SHA-512:	8E389D46606176EE14B8356153095B49C9426B80139B672A620F488891F091D1A272D4FB116775900E4AB4EC84DDDEBD8D6AF81AC672F14F148F2BFC638D2B10
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \.. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\.. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\.. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\.. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\.. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\.. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\.. "\u0b9a\u0ba9\u0bbf"].. ::msgcat::mcset ta MONTHS_ABBREV [list \.. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\.. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\.. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\.. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\.. "\u0bae\u0bc7"\.. "\u0b9c\u0bc2\u0ba9\u0bcd"\.. "\u0b9c\u0bc2\u0bb2\u0bc8"\.. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\.. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\.. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\.

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\ta_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.863003494480733
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xosDv+IZosK3v6ry/5osDo+3v+6f6HyFvn:4EnLB383ZDvl5K3v6ry/ZDF3vmSVn
MD5:	CF078352DA0507C767F04E31D6C14296
SHA1:	0A9B1255BD85B60D3620AE61370F54748AB7A182
SHA-256:	4978A193076DE56944236F7F1DCECACFF739536DFB3DBEFC1F7FE2B97A8AEAF4
SHA-512:	6FFC85B2A8DECB373EC76B1CD1A9459A30E443319F2C8DB9BBE6E115F5EFEEBAC314D4E8BE996EA55EE46466C6F6057A73078F5FDCF1C4CBAF1A270E45BC10C0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\te.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2149
Entropy (8bit):	4.097884113767283
Encrypted:	false
SSDEEP:	48:43a8mxI9k3JR0UjjFbPcniLHVktjjFbPcniLHVM:2a8v9k3JdbPcIidbPcIG
MD5:	61E4CB2AAD66285E9113071057F39C35
SHA1:	A2BD21090859669C4B6A875E077825381B7E2702
SHA-256:	9E96C7123100234A7018533764502985A208F2EB3314F5B6332D46016725A63F
SHA-512:	589A2D65508B07B5FDEDA883F71A4B496B25458CA1ECE7C4D4F5DAE82EB683DA82C8E21E57D63A235AB600174C9D362A746B2E27BAA6E3ADE1B7BD9D6000BE27
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \.. "\u0c06\u0c26\u0c3f"\.. "\u0c38\u0c4b\u0c2e"\.. "\u0c2e\u0c02\u0c17\u0c33"\.. "\u0c2c\u0c41\u0c27"\.. "\u0c17\u0c41\u0c30\u0c41"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\.. "\u0c36\u0c28\u0c3f"].. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \.. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"].. ::msgcat::mcset te MONTHS_ABBREV [list \.. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\.. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\.. "\u0c2e\u0c3

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\te_in.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.058324650031252
Encrypted:	false
SSDEEP:	12:4EnLB383LjZWsn0sHjoD0savzda3v6ry/ZF3vMSVn:4aR833Z1nnHjoDnavzd8vSCZNvMSV
MD5:	BCA040A356E7E8CC597EFB9B9065F8E1
SHA1:	ADAF7EC8C2035BC06E168D3F1BD7F39277E9273F
SHA-256:	B110FEEDDA21ECCEFA624BEF8E1476E9F221FB253880AC370967AE4D0237CA7A
SHA-512:	D408ECE8CF89FB23B45420D3CBA7655EEE713498210889A84EE25D3417360705546D97028EAAAA47764B6E9B0A3699669B98C0A53861A38E0DFCB9F3B8A47BEC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\msgs\th.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.382796122808316
Encrypted:	false
SSDEEP:	48:439X4QKPQJecQwFA0P9JmDsxQ7KHfWkD2CQM0DnWxFDzCYmdrtVP:29ohCi1028QmHfIC4jW3DmHB
MD5:	7F61E1EA256D78948189EF07119663CD
SHA1:	6867E9780049FACE9984B7788B6F362B8D1AD718
SHA-256:	48BEAF693BF5B6EED15234DB0D375B97E6D576A749E9048420C153E6CAFC0259
SHA-512:	F3E24E0B41A7D722AC2FA0E429A2DCB1CCB5BAECC9912ADF6AF79C51366EA1AC9F931F0F44F068F3CEE6873516E6223CC5E7616CF523B1DFB9E528DE4D58454A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \.. "\u0e2d\u0e32."\.. "\u0e08."\.. "\u0e2d."\.. "\u0e1e."\.. "\u0e1e\u0e24."\.. "\u0e28."\.. "\u0e2a."].. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \.. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\.. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"].. ::msgcat::mcset th MONTHS_ABBREV [list \.. "\u0e21.\u0e04."\.. "\u0e01.\u0e1e."\.. "\u0e21\u0e35.\u0e04."\.. "\u0e40\u0e21.\u0e22."\.. "\u0e1e.\u0e04."\.. "\u0e21\u0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tclIndex

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5617
Entropy (8bit):	4.747404679682368
Encrypted:	false
SSDEEP:	96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
MD5:	C62FB22F4C9A3EFF286C18421397AAF4
SHA1:	4A49B8768CFF68F2EFFAF21264343B7C632A51B2
SHA-256:	DDF7E42DEF37888AD0A564AA4F8CA95F4EEC942CEBEBFCA851D35515104D5C89
SHA-512:	558D401CB6AF8CE3641AF55CAEBC9C5005AB843EE84F60C6D55AFBBC7F7129DA9C58C2F55C887C3159107546FA6BC13FFC4CCA63EA8841D7160B8AA99161A185
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0..# -- tcl --..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(auto_reset) [list source [file join $dir auto.tcl]]..set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.t

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tm.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12204
Entropy (8bit):	4.763796758810551
Encrypted:	false
SSDEEP:	192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
MD5:	215262A286E7F0A14F22DB1AA7875F05
SHA1:	66B942BA6D3120EF8D5840FCDEB06242A47491FF
SHA-256:	4B7ED9FD2363D6876092DB3F720CBDDF97E72B86B519403539BA96E1C815ED8F
SHA-512:	6ECD745D7DA9D826240C0AB59023C703C94B158AE48C1410FAA961A8EDB512976A4F15AE8DEF099B58719ADF0D2A9C37E6F29F54D39C1AB7EE81FA333A60F39B
Malicious:	false
Preview:	# -- tcl --..#..# Searching for Tcl Modules. Defines a procedure, declares it as the primary..# command for finding packages, however also uses the former 'package unknown'..# command as a fallback...#..# Locates all possible packages in a directory via a less restricted glob. The..# targeted directory is derived from the name of the requested package, i.e...# the TM scan will look only at directories which can contain the requested..# package. It will register all packages it found in the directory so that..# future requests have a higher chance of being fulfilled by the ifneeded..# database without having to come to us again...#..# We do not remember where we have been and simply rescan targeted directories..# when invoked again. The reasoning is this:..#..# - The only way we get back to the same directory is if someone is trying to..# [package require] something that wasn't there on the first scan...#..# Either..# 1) It is there now: If we rescan, you get it; if not you don

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Abidjan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.995501022397479
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2DcsBdNMXGm2OHnFvpsYoHsdSalHFLwy:SlSWB9eg/2DBpDm2OHnFvmYoH1alHOy
MD5:	FF8B5540631A6EE93507338C4E7AA49D
SHA1:	817B261A1B6B92AA498EC286349964EA10FB5A84
SHA-256:	7213997BB9CF9D384A7002B8C8EFEF25C01ABA6083D9835A16D583D5DCEE40A0
SHA-512:	8D78AC4868ED0013EDA536C0E82E0E91398772AA18C637AEFE22F24B142FCDA55A4CB853B2282951E907C9E2F62BD3F831A5CF995F52898F5225D16889943A9C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Abidjan) {.. {-9223372036854775808 -968 0 LMT}.. {-1830383032 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Accra

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.832432925672155
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dc9XfBQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DUGDBS
MD5:	52FDFD3DB98475FBBB620D0D5565C5CC
SHA1:	C7750452859663605272553DBEE0B6C134E1517C
SHA-256:	6040827AFED8CEF45F252FBD7E3E862C0B5E9D06C1C98C58BAD61DFE67BD57CC
SHA-512:	2FF9D96D81279148A86BE208FEEACCBCB8B4224D093D6C092ECD1C4EA2186589CCF947027D3A726600C703611B4CFEE029AA14ED3E8593C477B427C4F342CF27
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Accra) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Addis_Ababa

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.817170256300069
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DczqIVDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DnaDkO
MD5:	30CDD4D37E9DD60FBF6D754C9343F364
SHA1:	56F896C21068764B7B8F884F374B18913CA3D9CA
SHA-256:	E11FD8AD8572B684333810CFDC23B92E1ACF619875866985E288D92F8277D07F
SHA-512:	78FC8043CCE25713404E70996229E5EA8238BF5C0F59029064EDA5494E2D4F54398931F3D855E30C82B2C53B789C40EE4CBF09D0F98C2BA6734595D4AA75017A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Algiers

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	4.187497782275587
Encrypted:	false
SSDEEP:	12:MB862D7nmdHh5Cv6/lHY8SOSuvvzXipFSgSO5vW5aKmvbsF6VWsXN87QBWcAFy:5veSvKlHYXNujXipFSjKRKXiWsXCGWJy
MD5:	E8D3DF11CE0E7575485573FA07D955D5
SHA1:	3B2C00C85B6C0BFAA1C676C970D6DF1B4BDC3D4A
SHA-256:	E6874647561CE1C5FD1F650C9B167F77AC5B24FD2026046399A9043CF998E5C4
SHA-512:	E2968BE847622CF243C0E498436FD21BDC2E1DF0FD8D694F2C70569D17CE896CDE4968BB8ABDEF9F687439E4EA2D955AE87D6C15E81F881EE1413416A90765D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Algiers) {.. {-9223372036854775808 732 0 LMT}.. {-2486592732 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1531443600 0 0 WET}.. {-956365200 3600 1 WEST}.. {-950486400 0 0 WET}.. {-942012000 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796262400 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766630800 3600 0 CET}.. {-733280400 0 0 WET}.. {-439430400 3600 0 CET}.. {-212029200 0 0 WET}.. {41468400 3600 1 WEST}.. {54774000 0 0 WET}.. {231724800 3600 1 WEST}.. {246240000 3600 0 CET}.. {259545600 7200 1 CEST}.. {275274000 3600 0 CET}.. {309740400 0 0 WET}.. {

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Asmara

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.801054282631739
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjEUEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DGs+DR
MD5:	A543BDEB3771017421FB75231F0004F2
SHA1:	D682C58C27562FF3ABAB8EDE8EB6EA754DA7C02E
SHA-256:	064EB7F9A1FA05A317C6BDCA6B102BC1560D980758F9E4DDB010C9E7DC068ECB
SHA-512:	44848D60EDC79AF784A819714C0D9F62DCCB6329B47F25D74AB8C174BF9EC3F783C66FEB27F588A93FABA9BECAF076F453D6D797CE4F28461F7AE69440EA54C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Asmera

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.806258322241929
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjAWDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2D8DkOn
MD5:	1B5E386E7A2F10D9385DE4C5683EBB85
SHA1:	FECBA599C37493D2E0AEE8E21BAB40BF8E8DC82A
SHA-256:	76939852A98EA7BF156D0AC18B434CC610DAF5232322C0FBB066CD52C5B72AF7
SHA-512:	B36FABFCDB2187A3A4A211C8E033D96C91E3C4D47907D284E10786555562C82231566033EAB4753EF1E48DF1233CFC8C6C0FB3CA50748BE0B2554A972A88FBA0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Bamako

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.883634030944169
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcxAQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwNDBS
MD5:	6B9BB5B37C41AA727E31BF03483DC1CA
SHA1:	CB3BBA37B063EA4A54CD15C6E30C14D8CA30D3C0
SHA-256:	F6D1BA22115A6565B6D6ABEB578F001DDB41E673C422C8EA70D0DF77B24115F6
SHA-512:	23DB3E298FDEB165FD85D99E03C00835B584984B814AF7F54A9CDD4A9F93E16B0C58342D319129F46CF8EC36F93DE5EA51B492CA4CABDAB75D84709BC6C26119
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Bangui

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.882974805254803
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcx2m/2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dw/2D4yn
MD5:	92FF9E5835C0C80F358BFE69120660A0
SHA1:	724758B43BD79DD8A29B02BE6910D492924F8280
SHA-256:	5047A507D22B68C9349EB6A48C41C80DB4C69F98F99C6574059DEA87178E36C0
SHA-512:	6FCB709DB4AC19191FECE1E8BAC55E77F265B5AF89F7A3565F06BFAF0BEE12E3EAF2F52CA09C68D75C358C25A31867505CE8AD75D7386DCD15F4BE1CE61272CD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Bangui) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Banjul

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.888193386512119
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcx79FHp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dw7J4c
MD5:	46E5703CF284E44E15E5872DF075FCBC
SHA1:	EA4BFA6D568DFA877F72302ADA21ECC2840D9FD5
SHA-256:	77E610A02CCECE3045B09D07A9BE6100F5AA9C3C2AEB543535C9AE941194F4E4
SHA-512:	1454467FE63E97DFA4DE66E359F68B2D80C92CDE59FC15A4BE513629FFD154D2281EADF3FC78F7AFDDF5A5896195F3A69E66697A659BBB1A0EAFD3E1DA6565EC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Bissau

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.847843768169462
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2Dc5iDMXGm2OHGVkeoHsdSawwF6hSVPVFwy:SlSWB9eg/2D4uDm2OHCkeoH1awwFMmMy
MD5:	7E710C939B9CC0C1AC1ECF4239B543C5
SHA1:	429CC87086FB22727815ED05AC6472333FF06013
SHA-256:	2A870E534DE67713C27F2F3B9BF26FA7498C240CF633988CE76DBDAC5B69214D
SHA-512:	70D9365C31C43A95211FC20E9290B24D356FFEFA935B8829CE32831026A196DECDD12226097F6DA3B4B919E137AA0181714680CDBB72B00C130A87E3A4735004
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Bissau) {.. {-9223372036854775808 -3740 0 LMT}.. {-1830380400 -3600 0 -01}.. {157770000 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Blantyre

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.904342145830274
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc8ycXp75h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAmp1hs
MD5:	7AD3749D7047855CB9B9EC9696015402
SHA1:	F792359AD9EEC2ABD98DAFA6661C1E57BAB89EBE
SHA-256:	8F700409B8EEE33ACE5F050414971FFEE0270949842E58E9299BB5CD6CCF34DE
SHA-512:	681C1B318746C587DEBA6E109D1D5A99D1F3E28FE46C24F36B69D533D884FDDC6EA35BB31A475575D683B73BF129FED761523EC9285F2FF1E4CACA2C54C046C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Brazzaville

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.901235831565769
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DciE0TMJZp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D4qGp4D1
MD5:	7028268EE88250AC40547A3FDBBFC67C
SHA1:	5006D499CD1D1CB93EB3DA0EC279F76B7123DAA6
SHA-256:	596DB2D64CDD6250642CB65514D5BCB52F3E3EA83F50D8915D9D4FDEA008F440
SHA-512:	D623C69FE8A6050E77FB819C2F5FAEE35D5034182B1D30A409C17208155501656133E774E402875537335F8201E4734A0B5D327712CBF623AC330F1014D9025B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Bujumbura

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.947752840781864
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DclbDcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkbDEi
MD5:	0EBC2D8F0BD1A32C21070F9397EAC9E2
SHA1:	95AAA97427265635784E8AC624CA863DB9F1475D
SHA-256:	9A15867255B43A954CA60DA11660F157553AAB6A15C50ACD49D182276E0CF4CC
SHA-512:	4CD2E14F84C58E955742637A51D99DB9493972671A2B5D801EBD9D901D4903654E374C59BF010C70071D33FA17788358F78004201A787CCA2AD714D670393488
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Cairo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3852
Entropy (8bit):	3.7766651198444507
Encrypted:	false
SSDEEP:	48:58ybRwEa40MF4pt0/jaGYbaJF0a3T07ITB85oWXmSGmuyTVuV0apRQnL0KD3rZza:fLg1GbJFp3gHRQVy7DPUUQkiHMo
MD5:	9DCDB3DD41DA13D81EB8E1CAF56964DA
SHA1:	F95EE7B1EF464F2640EC4AE29F3C18B5BF2B2905
SHA-256:	8698B0A53D858AEA7C495EDF759EF0E6C63F7E07A256599393DEC7B7A7413734
SHA-512:	BA5898ABEE541BC72C9DEDD77BABB18024C7AEA0274FA3F809748FCBFF770BFAD902BF70680DDE989F7D3592E5398C100D0E0EA388D4200911ED7DE089535D6D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Cairo) {.. {-9223372036854775808 7509 0 LMT}.. {-2185409109 7200 0 EET}.. {-929844000 10800 1 EEST}.. {-923108400 7200 0 EET}.. {-906170400 10800 1 EEST}.. {-892868400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-857790000 7200 0 EET}.. {-844308000 10800 1 EEST}.. {-825822000 7200 0 EET}.. {-812685600 10800 1 EEST}.. {-794199600 7200 0 EET}.. {-779853600 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165801600 7200 0 EET}.. {-147402000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Casablanca

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5532
Entropy (8bit):	3.535398586134154
Encrypted:	false
SSDEEP:	96:zE+CJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:7MZSszBrlKcJC9k
MD5:	18183122D242E0B69A80BC02BC0328DF
SHA1:	C9976ABC0663EB29A2FEAAFDF6746C05A264B67C
SHA-256:	8776EEDFDFEE09C4C833593127CEFAC9C33E2487AB9BF4BF8C73E5E11B4E5613
SHA-512:	9611A6EF9C5B55FAB752C1EC7E464B8AF60AE32383CE9BA72F35168ABB68A45DB0654A9099CBDC123F5F6E2B6DB7C8FBF56A8DDB813824187AD1090971F12219
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Casablanca) {.. {-9223372036854775808 -1820 0 LMT}.. {-1773012580 0 0 +00}.. {-956361600 3600 1 +00}.. {-950490000 0 0 +00}.. {-942019200 3600 1 +00}.. {-761187600 0 0 +00}.. {-617241600 3600 1 +00}.. {-605149200 0 0 +00}.. {-81432000 3600 1 +00}.. {-71110800 0 0 +00}.. {141264000 3600 1 +00}.. {147222000 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {448243200 3600 0 +01}.. {504918000 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {13731

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Ceuta

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7536
Entropy (8bit):	3.8315604186920704
Encrypted:	false
SSDEEP:	96:TzLdXKy9f4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:TdayR41sFpM5vwA6Efv03TBZLl
MD5:	30155093248C4F7E45EF7C0132D2B2AB
SHA1:	FAD100CC49F0CB0910BDE39B43295A47512E1BE6
SHA-256:	8827F7311EDE69A9679BDF2B7418DBF350A2FC8F973E8B1E1E4390D4D5C6D2E8
SHA-512:	469A24AF0C2A4A40CB2488C3E21BB9BBDE057F876EACA08A31FC6F22845063D917A0A4AE96680401E45792DE534EE3A305F137A93C4DF879B4602510D881270E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ceuta) {.. {-9223372036854775808 -1276 0 LMT}.. {-2177452800 0 0 WET}.. {-1630112400 3600 1 WEST}.. {-1616810400 0 0 WET}.. {-1451692800 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1293840000 0 0 WET}.. {-94694400 0 0 WET}.. {-81432000 3600 1 WEST}.. {-71110800 0 0 WET}.. {141264000 3600 1 WEST}.. {147222000 0 0 WET}.. {199756800 3600 1 WEST}.. {207702000 0 0 WET}.. {231292800 3600 1 WEST}.. {244249200 0 0 WET}.. {265507200 3600 1 WEST}.. {271033200 0 0 WET}.. {448243200 3600 0 CET}.. {504918000 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Conakry

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.88110192592456
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcmMM1+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DCM1+c
MD5:	8CDD2EEB7E0EC816F3EC051350FEBF13
SHA1:	37F3A149B4A01DFA2EAB42A28C810BE66AAB7C52
SHA-256:	3176C99FC45337CBCE0CD516DE4B02B8BAA47D00E84F698122A2ADD57797984E
SHA-512:	5A90B6DB45EDAD7734D596FB81FD1959A433F57E71D2212E1DCBD6A12F3FD1FE747FA363C4C787A4D3023F542553C1E2C9CF4F61E28F1BB13042E4AFE3D0FF31
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Dakar

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.856992353568779
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXXMFBx/2DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DKXEBn
MD5:	946D3B52F915445DBB8EE8BF67F4EFAB
SHA1:	18345968B95E886CA72634D49F2B38F9B29BA629
SHA-256:	D50F9732757B284BAC75526F2CFA585DF7F6974160827AFB0FF66124C7CFD361
SHA-512:	00B531D1352CF35045EE25C777C7FEA17294E9861E68CE2DE0D9884C05EBDEA84D5F4F0E8B5605721295E25C259979446B7DB76525A633C7D2FA35B38962CF43
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Dar_es_Salaam

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.8447607449193075
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2Dc8bEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DJbVDR
MD5:	7A819572758BC60F4085DF28F1DD1C01
SHA1:	0A5BA34EBFBA5A8E8B896713BA527781FC90FF01
SHA-256:	AB69948637416219A3D458777990FA4568BEBC89388884BBF129C0E1370A560B
SHA-512:	C03E785D1E85292056BB0BDD8DF8326C5DFEB6070AB1C071E1032D14EA69C9DEBC57B2CC7852E35D31652187126CCF0009A6A5C32F9DBB75D56C705535DF05CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Djibouti

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.829357904445218
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcRHKQ1BQDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DOrkDR
MD5:	7981499F9430DC1636C9F834273E0B91
SHA1:	1D63F8578420D56E4A5D9D0881FBEC015421E416
SHA-256:	E7F7560CCD65D53C446ADAE7128A74D37E17DD0B907A2F2FD85322FB8707B497
SHA-512:	3C3F7D78E9A0DE6E2950E1C305EA2DBC986754AE9FB10AC410685F30C39EC235F6F221393099C012E62EE5A7B4F1BED67C96B7B81E90BBA064BA9FE685FE4050
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Douala

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.850101792457859
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcnKe2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dml2D4yn
MD5:	44881E75AC32FA95FF6143066EF01B90
SHA1:	A221619B4CDE8BE6A181E1F3869EAB665F2E98B8
SHA-256:	FCF2DAD148F4D2951320EA99730C56D5EB43D505F37416BE4BAD265CE2902706
SHA-512:	4FA67A5F84758366189F0FC4A7FA6C820BA083E1C56EA95D25D21A367F25F76261B7EB5631DFFEB20E095CFD64E770338773F76BD50D4CF6AE29AD3EDFCEC408
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Douala) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\El_Aaiun

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5235
Entropy (8bit):	3.541189246992611
Encrypted:	false
SSDEEP:	96:+eCJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:+eqZSszBrlKcJC9k
MD5:	956F5B51FA8BA2E954A0E59AAC8F3276
SHA1:	AE35A8502E57EA6EE173E3B42509E4CAC73DA091
SHA-256:	5FB102A95B3C004AAB8371840B1A04AC352F48FF9E9EAFDEAAF21960B0F3CAA6
SHA-512:	19E7F2574E2B62DF68CC24737F6B94864B3D64B2472BC7D78E6AB5142A1DC1AB3B3700AB802129CB16AED4A4FED29E2B8A5593EE327ADF496255FE2FEF6A7023
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/El_Aaiun) {.. {-9223372036854775808 -3168 0 LMT}.. {-1136070432 -3600 0 -01}.. {198291600 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {1373162400 0 0 +00}.. {1376100000 3600 1 +00}.. {1382839200 0 0 +00}.. {1396144800 3600 1 +00}.. {1403920800 0 0 +00}.. {1406944800 3600 1 +00}.. {1414288800 0 0 +00}.. {1427594400 3600 1 +00}.. {1434247200 0 0 +00}.. {1437271200 3600 1 +00}.. {1445738400 0 0 +00}.. {1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Freetown

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.866631090752554
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcu5sp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dk4DBS
MD5:	6C115220CF951FC2EE3C299F86935B6D
SHA1:	A1CAB8C710BF20553AF45343118C1726CFE922B7
SHA-256:	BC53A4D489F48F14C594C4B0E52079B34E043A5751BBC7DF254A560352243575
SHA-512:	E87A4FD145B645DF034182CAD7F9D2BE5B2D9F3A17B6A9B6C84A0B3E846D92EC4C69DF2E85129B7A1AFBC0CCAAC8E3B1D47EB09F0900A82B908E9F6BF63B9736
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Gaborone

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.899477454245453
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcHK0o/4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAV+4Dt
MD5:	07222D8ED83CDC456B4D5D84C4BDE320
SHA1:	2C657F461FA3F48D56C791AFE4AB7D2EAF45AF60
SHA-256:	653AF88955C4418D973E2F8681A99552EB7BE95BCA64C736072F488462F7B373
SHA-512:	3016D0636F401BD88BCD460F6A61782E7E8A2C32CE4ECB904C711DF414038A5818F0CA3D7FC671C5ABCE70647FC674A2EF9081C5289EBFD184B44885902E007A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Harare

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.884642061266759
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc0B5h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2Dlfh4Dt
MD5:	8666DABE8D196ACD94A9691C592FAF4E
SHA1:	9F7EE009DCEAACA79C6EAA6FC73015D595467919
SHA-256:	06B82C524585192E0E8FC69DCC1CF86183A8C5EF404645DC413FCF3F8C16B0AB
SHA-512:	AAA32FD1B01BFECDD0D1C9C1DF1163374DAFE094C75720EA4095C34F7EAE7DCB594D1A7F6A2A90FB43FF01020F7AEB48E92496E0EE2D039AF23076CD369DD2A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Harare) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Johannesburg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.695542624694403
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DWbzDm2OHePoHvmmXsd//HF2d7d6VcF2d6KsYov:MB862DW7mdHePCvmmcZvF0cVcF/KsFv
MD5:	F0E153FC9B978E30742ABC025CA45E02
SHA1:	73D96F3188190DAC2453E6F18A1C683CECB9CDE3
SHA-256:	5EEF6475E1312051037FCAE3354E32DC0910BE7A5116B71F8CCBE1CCA08D3F1C
SHA-512:	E66F4B5FF18BAAD53AFB1ED36A0827115C793075A61F794F26F32BC9F6799DF816A1F817BEB0C0BC938F89E6F5BFBE1AB4F504F1AF518764103FB287746552C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Johannesburg) {.. {-9223372036854775808 6720 0 LMT}.. {-2458173120 5400 0 SAST}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {-829526400 10800 1 SAST}.. {-813805200 7200 0 SAST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Juba

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	4.027824722230131
Encrypted:	false
SSDEEP:	24:5mesdOkMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8M5:5YMV04MSHMzNxMbwM0JXMfCsMzaMq0QJ
MD5:	32EC0589260D9D4BCC85FE91E6F04D00
SHA1:	BAA269852C4AC6B89EA7941E7A75A007E0CF9EDF
SHA-256:	F2646E15488ABF2E960759CEFE5705416E71DA71BB8407B26196244FD1A3394F
SHA-512:	4F485453BE1D186ADBE0908852475C63C57BA498091C222EFFB9A5FEA2DB7F55E1BB2DBDBF6AC0F24CC67D47549FA3F5257655B5449B1BCF1FB5CDB27B03D501
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Juba) {.. {-9223372036854775808 7588 0 LMT}.. {-1230775588 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Kampala

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.837466713772859
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcJEl2DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DIEl2V
MD5:	E929ED1BC316C71AABE7E625BD562FB1
SHA1:	C20C172518C02D93327F4BBBC5D410BFFEF5039D
SHA-256:	8EA3028CE2B025F0C457DC8F7601279CA5AF565A88B9FE80208F9F1030F2B0D0
SHA-512:	B2FBCF06EACCF18DE97AF1D6BC57D9638E0A36DBF17044FF97F6B9E5089CF9E13E1304F304495324C0ACC1128A7D2D494E7C1FDB95DB0855FCE54F7028096C50
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Khartoum

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	4.0421745451318385
Encrypted:	false
SSDEEP:	24:5xe9dSXMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8MM:5hMV04MSHMzNxMbwM0JXMfCsMzaMq0Qc
MD5:	2BD3850DDBE2F05BF6F24F3AEFF7516C
SHA1:	22B0DBB54E071F30D51A8654CF103F99537F74CD
SHA-256:	F475DB8A857A46B310B12C21D6A9BC6CA9FF2960DA429A9D57FA375F9439E13B
SHA-512:	1CF82FC07348C697F26625673DA7E3D734358B3FBE69D8E2132CAC0D9F00C7E8CDC353676CD9BAC4CBB9E26CF6638CEAE41DF559E7445D9C453409D7115FFC6C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Khartoum) {.. {-9223372036854775808 7808 0 LMT}.. {-1230775808 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Kigali

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.910322325134086
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcCJRx+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DRX+DEi
MD5:	3017253E1C6ACCA8D470A014E4BB321D
SHA1:	671B7AC04580B56E2C34F88D123E8296947DDD7E
SHA-256:	73FEB807006897B4B485CB82394867444E890265EFE960EC66D6C0E325DA9372
SHA-512:	2498C380D761A16C183D78BC1BB18B1D2A1BFCB9C703D86A3FC04CCCE43D88C8D4BC3C47CC31639B78A5FE9C8A7445E9DBB52062E2F3B737DA1E7D0FF70F140A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Kigali) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Kinshasa

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.866127364448228
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcqQFeDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DdD4yn
MD5:	41209A335A99803239A854575190C5ED
SHA1:	E6EA627C25513B9DDE053F9A24D509AA317C30A1
SHA-256:	611375C4901AD6C4844C2BB7D02FB17F34996F49E642546A6784D6F0B28530CC
SHA-512:	DF2C0B131F35F54DF5EBF7F8459F98DBABEB6F081247BA95B5D7B41146E2A2EF9BC6B1D909DE57A1223D9C258AB197D9668ED2E111A365C86BABDAA7DF551FB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Lagos

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.7936510664790815
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2D4JDm2OHWQvvoHvBsp9boFvoHzIX7uRe6vF9:MB862DymdHWQCvqpmVCzIq
MD5:	EC08046589E85D999A597252FF5368B7
SHA1:	126E3DE158E1E7AF4737D0AB5B51C0F92F416DC7
SHA-256:	DCC9F52F539A67DFD7ABAFDE072ACDAE2B67754C559C8A5FE61979F5A286A066
SHA-512:	84B9AB18BC343C8B8934F5FDD2E2EB413925B04D6F5394AA8337B7B55E6487FB071A83A69BD4D0FA40F7F31EBC57B9908729674542CEA3083D700FCD02D77633
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Lagos) {.. {-9223372036854775808 815 0 LMT}.. {-2035584815 0 0 GMT}.. {-1940889600 815 0 LMT}.. {-1767226415 1800 0 +0030}.. {-1588465800 3600 0 WAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Libreville

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.865878143076229
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcr7bp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dgfp4D4y
MD5:	35D8A58EE21E603C6FC4FB896AE6B3D0
SHA1:	F1D0A939D761F3F0954F045814CF5339A5597036
SHA-256:	AB3E797548C7663CF9ABA7FE163635FF7CAB9E6CB61FA1644C0F7B4B5CCE8B99
SHA-512:	97717961987F6B6832C24A7833150CDFE7E82BBEB32DFDB84D2500442AAD9263F8BD4E879591E913D56E9A1991C389EF730211853647A889F358AE3FA37C0185
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Libreville) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Lome

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.862780607964543
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcih4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DNh4D4
MD5:	EA21ABBF8B11953916A1C509B8A1B427
SHA1:	35ADC230C57B001BE8A99A3D2E34B609A60A1162
SHA-256:	EACA9124F17E5B11F27D11FA6141D19EB3AC23E155E155B73467BDAA3BC99AA7
SHA-512:	A7972D4F1C5FB988CA04B39E2CDD580F51383BA9D7A66C478275C11A07B8D7A6EFF53A3E1929B0D89F10BCC39D22F285DB2601ED60DB4647C65465643F70C137
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Lome) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Luanda

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.856982839546061
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DccLtBQDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DXQD4yn
MD5:	40CD47F6DCF51EBEFEF42489F1716257
SHA1:	DF245192A1899A72DE01A57F6969AC060E841734
SHA-256:	4C2FD1E44DFAAF0C0DD2EB56B84B538F1E2D84B301AB2CFB8EE7759783501444
SHA-512:	D39BEB0EEF344B1A44F7D6A806A1D5B956D7D402648EE0C67C4BA46493236840AF975D89A91B2D33B8AA7D6DC9A051E66718DCDBC1C83B0E964215C2E32ED923
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Luanda) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Lubumbashi

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.940313336280723
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcfpT0DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2D8pT0Dt
MD5:	71A5DE1276902DB1542840318F9B1AF3
SHA1:	AC3825BF343482E0E4D9D6FAA6FCA4D1A125433B
SHA-256:	24384EEC359FD24D181AAEF3C017E3C345490A8D352B29D19B1B143A29A811C2
SHA-512:	2984EB42A79B8B32BB93DFE71F1C4C0CABFDC9B0A199971347BB3473463FA07FDB5D20227D288BF8653B1BDE347E1297459BBB4C3C34AF7A5434FBF945683577
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Lusaka

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.905174746463853
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcOf+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkDEi
MD5:	1D7FDB388535CC59742CA0F1AEE27FBD
SHA1:	A99FF2CAC47FD333429C22B271E190D979EEC024
SHA-256:	B00801A7279741434D9C2D7EC7322DD93B85EA4F5C9976AB3A43F0AB142E1553
SHA-512:	0174D3C6F9116C36C62AD1EB58203EE7DFE8C37F618B8449D5E45AD6290CF8334F28798877D7A563A12EE533026244D6A49BCCF29B5D7FCB5BCC91481D0DDDE2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Malabo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.857096806490649
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcn2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D42D4yn
MD5:	1CA9B3E7BCD5BC1CC881453D16B09389
SHA1:	1B1964B314E72847D71A42C147CF2BF331B44461
SHA-256:	35D56EFFE9E7E60F17B32BD30486E566B635F0AE7A8948D77395B8E6332E26F1
SHA-512:	9E08D57B7824F5B076D159D9A5106E51450DF24729C36F485B9B68E8F47E8DFC50F9BEC3F11E0AE6579A8E372A5C0F0DA18A2E797CF2115519D1B4E5B64413DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Malabo) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Maputo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.952872531197478
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2DcfKiMXGm2OHoVoHvdSF2I:SlSWB9eg/2DEZDm2OHoVoHvdI
MD5:	CD429B6891CBF603A93F9A9733E2391B
SHA1:	C6833B83B6D1694AC632018A27915E6F97F708AE
SHA-256:	FE6B6A4BE1B61F7F909A3F6137530DFE6D1754499A4D9B0D1CE4952FFF0AE62D
SHA-512:	6E57B70B71515998AD617954F9DDAE19968B20946542201153DAB47FBE63790D42F41AE29148ECBCE6D12812879BCF0A4EC881507B62CDB2675AB20267220BF9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Maputo) {.. {-9223372036854775808 7820 0 LMT}.. {-2109291020 7200 0 CAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Maseru

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.964472328419063
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DZQs+DWb4n:MByMaHw7NH/t2DZiDWU
MD5:	88C8FF2B480648EDADBD0FB93F754275
SHA1:	BED7A784C378909914CEB0D303DFE6D05FD576B7
SHA-256:	1D80FD86CB733D57D88ECD404E702F750B233ED0CCBFBFFFEED1AAD3B7F1CB04
SHA-512:	CB7F831CF099E85B948AE57FCE9D91C7EAAD39753AF82C56EC15B65830EB4115A71BBC83A71A2AC947CAB24DEDDB557E02FAA5A3264546AE6E60607DF6BD2FA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Mbabane

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.957246428185456
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DzjEHp4DWb4n:MByMaHw7NH/t2DzjEJ4DWU
MD5:	CA7255B86425BA706D214924856B6818
SHA1:	E9BE6CF871BB1786E842953D41392299952EC9AC
SHA-256:	547197C09C1987350AE5720A4EEC7E8D8F4B9F4A0559726E225E13C707F7C564
SHA-512:	23F9AD0F926A0945A17BBC3DCFF9A3D7EE68EC9423EA78985F5FFC60CC61641B57871F9AA703B5FB9BE842DCD4693D0641F9EDED702240873F58D24CD4D60C32
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Mogadishu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.877126792757121
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcBEBXCEeDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DFSVDR
MD5:	5C2E2B5189E0E816D5BD7AFC8B49A35E
SHA1:	4E43A1ED51399528636D6442B1DDFFD820911407
SHA-256:	25E221BE49DEC5547A74AEB91B0041859C59BC866987272A447AB2343D1CC30C
SHA-512:	B74735CFAB692756BAADFB1A51A8CC0C986F981D8E7E7A8182370A9017E67439875F0115820A349AFB3BE2FA581A721440968EF817471DD2C5E1286E53B2FE99
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Monrovia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.8660011420394955
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2D3NPDm2OHrFGxYoHvlHIg5pTwdPsy:MB862D3NbmdHhmYCvdIg5GPsy
MD5:	1B3C94B5098E454981C73C1F2AF80164
SHA1:	1EBA9E2DBEA70BB1AE5EB13739518AB5A62D2130
SHA-256:	2BF0D90610211651127402680519B29AB50B15D344263D0C1A22EDEBE5E01E27
SHA-512:	DA4A0BCE7C6750BD7D3BA76B6301B9390723BE0C001C39BE453D80BD87020C2253A75629F68F83C19410D2A75FAF5223A435299CD4AA53DE545EC7C5B5AA54B7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Monrovia) {.. {-9223372036854775808 -2588 0 LMT}.. {-2776979812 -2588 0 MMT}.. {-1604359012 -2670 0 MMT}.. {63593070 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Nairobi

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.655052651600954
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2Dk1Dm2OHsvT5oH99VCV22ufPnVCkVBKBQn9q:MB862DGmdHsvVCjkifvdH9q
MD5:	B640661FB37BB74FAB172DBDF1B433E1
SHA1:	0236A5B53443A4A18B8B9D6AA7732620BE9A6553
SHA-256:	BD8E9765174431C0D403249D3E881C949C83966E9F8162552DA88AE53132467B
SHA-512:	53DCC6DF7C3E0B00A6D98A8DCC4988C8CFD6B53CC89E6F8D32DA41CB532A62D9C6A823675C5039F5639CE0D423F6D571F46F5B93FFC7EFFB4EDFFBF89D46AA12
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Nairobi) {.. {-9223372036854775808 8836 0 LMT}.. {-1946168836 9000 0 +0230}.. {-1309746600 10800 0 EAT}.. {-1261969200 9000 0 +0230}.. {-1041388200 9900 0 +0245}.. {-865305900 10800 0 EAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Ndjamena

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.856754881865487
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DjUfDm2OHNseoH1axCXFHzaSmkFWTvF9:MB862DjULmdHPC1XNzaS3yz
MD5:	EDB548348E590C8CFE04ED172D96B86C
SHA1:	AD3B631FB03819772164402E202AFA781687F597
SHA-256:	9ADA5F5AFB25E823E1F0E8AD2489AAA1C09F01356634A9403670D7AB21CA2E2C
SHA-512:	17E396A9BE497077B774AD1108CC8760ED35FC92F65FFF070F9ACD3C4FB67A335C1C57DF1CCB1570DE14B708EFCA0063990A969E30759C9A47731DA45ED25EFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ndjamena) {.. {-9223372036854775808 3612 0 LMT}.. {-1830387612 3600 0 WAT}.. {308703600 7200 1 WAST}.. {321314400 3600 0 WAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Niamey

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.871519187180041
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcdhA9Ff2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dsh2f2D1
MD5:	0134039CD1666E983A9B6E43ABD6AF59
SHA1:	A2A99345390F4D17C892CEADE58C604257686764
SHA-256:	B517120AD8DB3F21EAB4E44A78001EE856EB4EA35852C54CCA96D38887DEBCFA
SHA-512:	E5911ADD3D776D87ACFC986C4D2564E3ED9AB12C67F23391ED35FF2A31AD8314B873E31DB8DA4D5E0DAEA12BE34110A8F0C27C9C6126977BAD51C6AD5CDFA39B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Niamey) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Nouakchott

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.909962899502589
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcboGb+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dqbb+c
MD5:	550E482599C2F4280F2C258019BB2547
SHA1:	A39045BEF313094CEDC100A7D695AE51BC9E498D
SHA-256:	64CAF2BF9D45095DF97F419714D5617CF6300ACDB544B621DCE1D594AA9B910C
SHA-512:	4FD29C5B4C0D2BDE69C437E9BF4F08A11E1DAAA689B69F28F3551F550BDCCDD055E4C1A241EDB2FA48B18825AFF792F4860F55983E106EA8224F1D87ED4F7546
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Ouagadougou

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.920023025906233
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXCZDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2D1DBS
MD5:	6CFC4E938E50C9B591F8CC42A14FA82A
SHA1:	FCE14A5CA62C9005C76D27B849A238E76C834F8A
SHA-256:	03B9C1FE350B5E9F6F333F9519FA394DCC562308D9388A903AF3D3FECEBDC762
SHA-512:	98F22F1D23A9930276A2D306A1473E64DC43547A16CFD01226E4F030A26A3CC4FDED77F790583CC5C078FC6DFCCE81C16A50879AE46A0D3A6F1FA98373F413C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Porto-Novo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.893842293207225
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcyTKM0DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DQD4yn
MD5:	6D979FCD225D5431C7391AE568C6409F
SHA1:	6C9DCD222061CC00FD386773C6BB2861F3429A60
SHA-256:	8FB8692DB9281AE2B087D704168BFD47D3D0901781FEF65BFD62FCB213BA6B50
SHA-512:	32AFA6AF6BFC3D42CA636DD2B96906048EF1ADFBB135BB7E7B77C444FED99FDABB84FBBADF56EC63828FFA7B3371191FF1311822B1C75241EBD9CF602467088E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Sao_Tome

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.818597723513168
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DXDm2OHH5oHvzdoH1aNbbFHRMy:MB862DTmdHH5CvzdC16bZRMy
MD5:	28A5967C797F4B38FB63F823D6F07168
SHA1:	17872E91683B884191D2E4C777FB79DCE6D73EE7
SHA-256:	BA1D60DF2B41320F92A123A714E17E576C89383526B96E0541A464C3FBA415B7
SHA-512:	B335E3D3268631F3A71F4BAD59740F3A5222344E8223C201B8FE885BAA7F1A550FA7778E498D6DC2111F41053856F50B21413AECCE84B80833EC8176F2A1009C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Sao_Tome) {.. {-9223372036854775808 1616 0 LMT}.. {-2713912016 -2205 0 LMT}.. {-1830384000 0 0 GMT}.. {1514768400 3600 0 WAT}.. {1546304400 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Timbuktu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.905303708777235
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcHdDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwdDBS
MD5:	F2D7F7BC4EA3629EC7F0E45300A0CFD2
SHA1:	E7594D378C5DCFEB1E87E13AC79A026260D2E630
SHA-256:	9D8009ACAB019B32B1E87AB10E0AC3765ABCABE8066318DA8CA4905D41562F72
SHA-512:	795E58172907020C85CF0B10BBA35842D5F92872CCB3382DFDC787BAA504C79927FA23BC3104AD63541A95C44CA80977E8247846DE918A0B00963B970F4823D2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Tripoli

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.151253074491018
Encrypted:	false
SSDEEP:	12:MB862DrmdHrCDWR+f7Zn9ueRSmNvlTtuyI/ZBv8dq8Jw4VFZBZYEuAENSfp8kSYx:5veuDkWx3NdT18kbjjAkxTx
MD5:	2DF9B050D82B06EB89DA908C31C1F1C9
SHA1:	CB294E12560A98D5CEA3BA7004B5519B6C22BAAC
SHA-256:	B447B6B1C351E77F22A2D77C0437F2BBB7D8BDFDFDC3D6285E0D260519CC7110
SHA-512:	BBE281D551E9F8DA7B6BB08D809177615410A11E4B1184ABD220EA8B1F355B2BBC090C6BAAF7E07FD61286891388ECD4026D4433C4E4B6A8D201F8D95E174532
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tripoli) {.. {-9223372036854775808 3164 0 LMT}.. {-1577926364 3600 0 CET}.. {-574902000 7200 1 CEST}.. {-512175600 7200 1 CEST}.. {-449888400 7200 1 CEST}.. {-347158800 7200 0 EET}.. {378684000 3600 0 CET}.. {386463600 7200 1 CEST}.. {402271200 3600 0 CET}.. {417999600 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {465429600 3600 0 CET}.. {481590000 7200 1 CEST}.. {496965600 3600 0 CET}.. {512953200 7200 1 CEST}.. {528674400 3600 0 CET}.. {544230000 7200 1 CEST}.. {560037600 3600 0 CET}.. {575852400 7200 1 CEST}.. {591660000 3600 0 CET}.. {607388400 7200 1 CEST}.. {623196000 3600 0 CET}.. {641775600 7200 0 EET}.. {844034400 3600 0 CET}.. {860108400 7200 1 CEST}.. {875919600 7200 0 EET}.. {1352505600 3600 0 CET}.. {1364515200 7200 1 CEST}.. {1382662800 7200 0 EET}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Tunis

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.150944563639585
Encrypted:	false
SSDEEP:	12:MB862DHmdHjCvbB/lxRjntMVyoKCyFWeey0XSe/OSyHaCgmvLOcSFQSFeSTC6ZPJ:5LemvbplxRhbv+yuh2tIee6kvcw9Cy
MD5:	0C99335A41D33AA8BC1EDA0CB4CDCBF5
SHA1:	5CABC28D318FA5B8307429EA571FFF91EB8E1252
SHA-256:	0760D1028E733888E43E7F1E057217DC2B52786029FCEC67B27EB69CC6A54938
SHA-512:	C8FE685ACA46FD4836F3AABC15833F294E5EBED123A487D04E74A8C5668BDFAFB96D2326760452A6E5A1B9CC25AC6C3918D8C10A7F8EF737456640E3000BBA2F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tunis) {.. {-9223372036854775808 2444 0 LMT}.. {-2797202444 561 0 PMT}.. {-1855958961 3600 0 CET}.. {-969242400 7200 1 CEST}.. {-950493600 3600 0 CET}.. {-941940000 7200 1 CEST}.. {-891136800 3600 0 CET}.. {-877827600 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-842918400 3600 0 CET}.. {-842223600 7200 1 CEST}.. {-828230400 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796269600 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766634400 3600 0 CET}.. {231202800 7200 1 CEST}.. {243903600 3600 0 CET}.. {262825200 7200 1 CEST}.. {276044400 3600 0 CET}.. {581122800 7200 1 CEST}.. {591145200 3600 0 CET}.. {606870000 7200 1 CEST}.. {622594800 3600 0 CET}.. {641516400 7200 1 CEST}.. {654649200 3600 0 CET}.. {1114902000 7200 1 CEST}.. {1128038400 3600 0 CET}.. {1143334800 7200 1 CEST}.. {1162083600 3600 0 CET}.. {11747

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Africa\Windhoek

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1649
Entropy (8bit):	3.9974091170263066
Encrypted:	false
SSDEEP:	48:5t+Lmcz0iMHHWMbnHoMcHiM0H+MCySHr/MDHqMafHO8MwHJMHHOMHSHWMHHXM5Hs:OLjQDI6jZ2WFcv
MD5:	4846FB13467BA93EB134D88228D7F534
SHA1:	477FC6144B7DF365606A2E44EF1430F8DF6FB841
SHA-256:	DFC3D1FC182B315B31D999BC103C264BD205EB16F971C8636003A71170D7BD7C
SHA-512:	A719F5083F66CE44FE047880A10B2ED04B66E01C7F0F7DADAE2FFB95172308F091D669BCFED5A236D2A0F80A4A1D78DA7A778DDE3FAECB40170ECDA705573769
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Windhoek) {.. {-9223372036854775808 4104 0 LMT}.. {-2458170504 5400 0 +0130}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {637970400 7200 0 CAT}.. {764200800 3600 1 WAT}.. {778640400 7200 0 CAT}.. {796780800 3600 1 WAT}.. {810090000 7200 0 CAT}.. {828835200 3600 1 WAT}.. {841539600 7200 0 CAT}.. {860284800 3600 1 WAT}.. {873594000 7200 0 CAT}.. {891734400 3600 1 WAT}.. {905043600 7200 0 CAT}.. {923184000 3600 1 WAT}.. {936493200 7200 0 CAT}.. {954633600 3600 1 WAT}.. {967942800 7200 0 CAT}.. {986083200 3600 1 WAT}.. {999392400 7200 0 CAT}.. {1018137600 3600 1 WAT}.. {1030842000 7200 0 CAT}.. {1049587200 3600 1 WAT}.. {1062896400 7200 0 CAT}.. {1081036800 3600 1 WAT}.. {1094346000 7200 0 CAT}.. {1112486400 3600 1 WAT}.. {1125795600 7200 0 CAT}.. {1143936000 3600 1 WAT}.. {1157245200 7200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Adak

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8447
Entropy (8bit):	3.867931581740766
Encrypted:	false
SSDEEP:	96:6hvOs5vveFaHU6lgqN/zNMkixlrxYTMcmo1LWF59:6hvOstgqN/zNMkArxiZmf
MD5:	DF52E726B33FA47EB115C1233614E101
SHA1:	26B0E49022FCB929F0160617F9C9D2DBEDC63610
SHA-256:	77231D179260C08690A70AEE6C2517E4B621ED4794D9AEEA7040539F4FF05111
SHA-512:	48AAF25419E07B06E076B0E19F9A0C27EB257556E62FD8F7B2AA963A817823DD89D33AB6AFEAAC2EF2230361D76776355E19CC2BBBB4D19536F823A347AC8AA4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Adak) {.. {-9223372036854775808 44002 0 LMT}.. {-3225223727 -42398 0 LMT}.. {-2188944802 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Anchorage

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8685
Entropy (8bit):	3.9620252256806845
Encrypted:	false
SSDEEP:	96:esKLO6KLC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:etLhN9DiaJCUbPI+D/iMpCIBSuk
MD5:	BFEACEA04AAA8A69A9AC71CF86BCC15C
SHA1:	1693971B8AAA35021BA34799FB1B9FADC3DA0294
SHA-256:	DE7FBE2B3ED780C6B82099E1E249DD41F4452A3ADB9DD807B1D0EC06049C2302
SHA-512:	E94112A2A5F268C03C58CE3BB4C243B2B9B0FC17CB27FDD58BCD2CCC8D377B805C87A552AE7DE1C5698C5F2C4B0FCAB00A3420B1DAD944C1A2F7A47CE7118F78
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Anchorage) {.. {-9223372036854775808 50424 0 LMT}.. {-3225223727 -35976 0 LMT}.. {-2188951224 -36000 0 AST}.. {-883576800 -36000 0 AST}.. {-880200000 -32400 1 AWT}.. {-769395600 -32400 1 APT}.. {-765378000 -36000 0 AST}.. {-86882400 -36000 0 AHST}.. {-31500000 -36000 0 AHST}.. {-21470400 -32400 1 AHDT}.. {-5749200 -36000 0 AHST}.. {9979200 -32400 1 AHDT}.. {25700400 -36000 0 AHST}.. {41428800 -32400 1 AHDT}.. {57754800 -36000 0 AHST}.. {73483200 -32400 1 AHDT}.. {89204400 -36000 0 AHST}.. {104932800 -32400 1 AHDT}.. {120654000 -36000 0 AHST}.. {126705600 -32400 1 AHDT}.. {152103600 -36000 0 AHST}.. {162388800 -32400 1 AHDT}.. {183553200 -36000 0 AHST}.. {199281600 -32400 1 AHDT}.. {215607600 -36000 0 AHST}.. {230731200 -32400 1 AHDT}.. {247057200 -36000 0 AHST}.. {262785600 -32400 1 AHDT}.. {278506800 -36000 0 AHST}.. {294235200 -3

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Anguilla

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.908728298285591
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290/8J5290ppv:MByMYbpwt290/8m90b
MD5:	1C3CE9F156ABECEAA794E8F1F3A7ADDB
SHA1:	6F84D0A424FD2DE85E3420EA320A186B277B0295
SHA-256:	F38610019C0A2C18AC71F5AA108B9647D9B5C01DCB55211AFB8312308C41FE70
SHA-512:	CA2DA6F9551E4DBF775D7D059F6F3399E0C4F2A428699726CD2A1B0BB17CCF5CDEEF645EE1759A2A349F3F29E0343600B89CE1F4659CF5D2B58280A381C018AD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Anguilla) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Antigua

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.898881450964165
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290//MFe90ppv:MByMYbpwt290//V90b
MD5:	DB16FFE76D625DEC731AB6320F5EF9BF
SHA1:	D286994E03E4F82C08DE094B436FA098648AFADE
SHA-256:	561E58E11DC5A86CAE04B5CB40F43EFCFF9ABC0C841FAC094619E9C5E0B403F8
SHA-512:	8842B616205378AF78B0B2FC3F6517385845DE30FFD477A21ACFA0060D161FB6462A3C266DCFD54F101729446B8E1B2ECF463C9CF2E6CE227B2628A19AF365F9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Antigua) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Araguaina

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	3.733307964154526
Encrypted:	false
SSDEEP:	48:5KChlvEw6kSSx5H4a8tf3fkuozd23t8VZDG8+GCRRRd:QIlvEwJSSxdF8tfMuozdCt8VZy8+GCRB
MD5:	9B01680A362EA7B462DC236F6A35E14C
SHA1:	456A5E771F6B749BFDB2BFD59836A6A930499881
SHA-256:	B1327CBEC20A21E3FF873E28A2EDFA271EE3A5C01933779300EABD6B185DA010
SHA-512:	E6C2F5C489BEA31B0AAC3CB1DB750AC2B665DAC0AC82C1CE6756E768305300297BA5E3B32EDEB9E1715452F02223E47674C4F2B1844920F664623C9F34309240
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Araguaina) {.. {-9223372036854775808 -11568 0 LMT}.. {-1767214032 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Buenos_Aires

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	3.7664759014118188
Encrypted:	false
SSDEEP:	48:5p9uuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0wi:jIu3pfe92jCs/VOHv2kdeRtnxafwwfF0
MD5:	2B9A1EDE5110B46E24F4726664EA1E3F
SHA1:	939D1A7A50544F34B318ACDB52BC6930FE453F6D
SHA-256:	BC86AC89121EC4AA302F6259CCC97EFFD7022DC6CEE3B291C57DA72B6EA0C558
SHA-512:	C204740DACBCECF2CC5CF4FEB687E86B9150512623203C999D6F4EB5FB246D07681A35C28D8445F6A50F49940C321E0AA5E51FE5A73B8ED076F29CEB5B4D4CA2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Buenos_Aires) {.. {-9223372036854775808 -14028 0 LMT}.. {-2372097972 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Catamarca

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2077
Entropy (8bit):	3.742645155048276
Encrypted:	false
SSDEEP:	48:5/nuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0NC:Vuu3pfe92jCs/VOHv2kdeRtnxafww3mP
MD5:	3D2AF5714DFC392ED4BC976784D5A58A
SHA1:	9252DE40B6EF872E1D2F7CDD53DDD21145E93C5C
SHA-256:	A516BB0937977EF949D47B3C8675E30F1CA6C34F8BD298DCF6EBB943580D5317
SHA-512:	8D5FFDB5B578B8EA0291D3A21BDDE25F8301CB16B11AE794FFBA8DCFFE46F6AC5EC03D93E511061B132D84E69E5FAF1BB212837EB8A5A4B4BE517F783837E615
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Catamarca) {.. {-9223372036854775808 -15788 0 LMT}.. {-2372096212 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522740

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\ComodRivadavia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.72138001874583
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/290/MquQ90/MMXAy:MByMY/MYp/MrRt290/MquQ90/MK
MD5:	8A609667DE461CEDC1127BE38B161459
SHA1:	557D2D55DEA38D1CD1103E183F89C65F4016662B
SHA-256:	8CCD6FC77D55582938F1912B1BA66035882D1BFC18A797C631E5E89ABFBF570B
SHA-512:	DBAFDA069DB5FDBCBA11050AC91A733C1712BD6395939CFFFC5EAA78BD0B70B4AF2D9FB8954C6841CCF3AC5F8EDCF08E604D3F2CF67F1CBEA5EB6D3C4DC7F2FA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Cordoba

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	3.7481312409221594
Encrypted:	false
SSDEEP:	48:5lxQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0n:/xBu3pfe92jCs/VOHv2kdeRtnxafww3j
MD5:	8C1D665A25E61CE462C2AC57687763BF
SHA1:	B5BBC26CF6A24BD5BEA42AC485D62C789B80905F
SHA-256:	FA75E274240A341C6BFE3539CFDC114D125AEAEA3161D3C2409347CF8046042A
SHA-512:	A89A7A92C025B87DA4CDFE99BF70CD0E64690D7BFE827DCBFBF0E91B188003FA26487E72B6B950D3BFC9C854B890E5936F414BBEAAD5F3F0673AC5EFE273CDF4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Cordoba) {.. {-9223372036854775808 -15408 0 LMT}.. {-2372096592 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Jujuy

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	3.7481290145270245
Encrypted:	false
SSDEEP:	48:5HluuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwcSPAC8OS0E:xwu3pfe92jCs/VOHv2kdeRtnxafwcDCK
MD5:	995EDE9E1E86DB500C7437A196325E21
SHA1:	4A8FB1511AA124CA2D299EC8DE155EE9D0479180
SHA-256:	43EB79ABC03CBAC661C563DE1BC09D9DD855CBC72DD2B6467EA98F0F90421BA9
SHA-512:	B58B35EA1B2F0388B8108DCF254F3BD1B21894F00A9F313ABC093BC52C36FCDD94B7486DBA38161C9EFCDB12BC3CD81E7E02395B0CA480A7F01148C43CD3054F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Jujuy) {.. {-9223372036854775808 -15672 0 LMT}.. {-2372096328 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\La_Rioja

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	3.744252944523733
Encrypted:	false
SSDEEP:	48:5lduuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0NC:Tou3pfe92jCs/VOHv2kdeRtnxafwwkFP
MD5:	4A45A063D45EB94214005EF3CA5BCD6D
SHA1:	2420E8591DC53A39EE1A58B2E45DCFAF9503685F
SHA-256:	2B018B791E48269FA9EDA12662FFEC3E2DC33603A918E8B735B8D7D6BEB3B3AA
SHA-512:	0B2824FA3D40B2EDBE8488D50C30368F4CF6E45A39FF6DEBC5BB4FD86F85AD52F5331AD1EB50E5166FA2E735B7E8AA9D94A5FED9421334DB0499524DBE08F737
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/La_Rioja) {.. {-9223372036854775808 -16044 0 LMT}.. {-2372095956 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Mendoza

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2077
Entropy (8bit):	3.738002814507529
Encrypted:	false
SSDEEP:	48:5CPBuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwGSmSc8OSI:GUu3pfe92jCs/VOHv2kdeRtnxafwGJld
MD5:	F6CB24E8567B2443224E9E17EE438BFE
SHA1:	8029426C30C4C645EA77C6240391CDB1C3107568
SHA-256:	DC39400BBFD5BDDDC174FE099194806FBFD3FC3AA20E670D67BE0AC35FE97AD4
SHA-512:	6869CFC24C21FBB2DFCCAA9AE7E21A0B24DC002EE792FB28A8F2F05C75C20E93C95A39BD8653AA272AF10FE95922B99EECC1208AACE814817D9441F84360E867
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Mendoza) {.. {-9223372036854775808 -16516 0 LMT}.. {-2372095484 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Rio_Gallegos

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	3.7580685839169545
Encrypted:	false
SSDEEP:	48:5oQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0NC:qBu3pfe92jCs/VOHv2kdeRtnxafwwfFP
MD5:	212D13CE27AF114A8EC2E04023D218C4
SHA1:	C4C5F86BC6EC0D5EA4C9CF199309D085767B97E8
SHA-256:	A05B6708DEFF0607396BFC6661C2287341C3432841AE353D94A67AC742B5FAFA
SHA-512:	CE7201EEA6A86FB49641410D2EEE4030EDB1B96F3218D764762F5AE23883C796F5742ED69CEC985A9D3582D6C72ED74114DE81508F6DEB4B54865B6974ADC965
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Rio_Gallegos) {.. {-9223372036854775808 -16612 0 LMT}.. {-2372095388 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Salta

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2011
Entropy (8bit):	3.7415813345133975
Encrypted:	false
SSDEEP:	48:5NPuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0wF:72u3pfe92jCs/VOHv2kdeRtnxafww3mz
MD5:	A06C33CDFD7E7B630CB1DF34E72E61E5
SHA1:	694826B9B910DA0BD70A9CB547C26E6838B08111
SHA-256:	CAEFC60F2F36EF9FFE0C5921C3C392DE1E95755683A96C1C4EC0BA2C242A4D84
SHA-512:	D6696A6C14EECF2B77EC586F40137BDD95E5CE5C5193570C809FAB9E5FCA4B8744283CEB6818E525C73F6EFF657274410B2622902EE8C15912C8D5F5FA5C805E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Salta) {.. {-9223372036854775808 -15700 0 LMT}.. {-2372096300 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\San_Juan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	3.747934819596411
Encrypted:	false
SSDEEP:	48:5vXxuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0K:hUu3pfe92jCs/VOHv2kdeRtnxafwwkFl
MD5:	32A50D0ABF408D9E59C0580D5B8CC472
SHA1:	EA5BB8860982F8BAFEAEFDE1D6ACD440DA132DFE
SHA-256:	41B2C25E42146A76934B866061BB3245B8ADA0FF4E1BFBA6F8842A30BDD5C132
SHA-512:	E5D2521A4EF53AAD3E74506708EC2768C4D2EE8D6D014DCCF4A6DC290B713B4D46021B66527548C35004E10D753E1B685EEFD55BBE7BF01EC6104D7D8AAC4403
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Juan) {.. {-9223372036854775808 -16444 0 LMT}.. {-2372095556 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\San_Luis

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2081
Entropy (8bit):	3.7399269084699975
Encrypted:	false
SSDEEP:	48:5MDuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafw6bS2nZSbdI:yCu3pfe92jCs/VOHv2kdeRtnxafwWnZr
MD5:	FB06B66F5D41709C7E85C8B1E9BFCFA0
SHA1:	D5C0C4B12C6190856C300321B1C106C7474BA54B
SHA-256:	A43B35F25E54EF359D046E33281C0A978F0EE8811C93A6809F1F65750878BBB6
SHA-512:	D445F46D6A17A075AD995885E45234A711F53BF3FE2DFC6DFBB611E8AC154B10C91E137927DD66D6A7C596A93BAE5DE283796F341B5095FA0DD05595E1C3A077
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/San_Luis) {.. {-9223372036854775808 -15924 0 LMT}.. {-2372096076 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Tucuman

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	3.741704529449777
Encrypted:	false
SSDEEP:	48:5yZujuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OSf:suiu3pfe92jCs/VOHv2kdeRtnxafww3w
MD5:	D9497141EC0DC172E5FF5304FED0BE6B
SHA1:	CD20A4F0C127A84791093010D59DF119DD32340A
SHA-256:	0F7DB23E1280FC19A1FB716E09A9699ADA2AAE24084CAD472B4C325CC9783CCF
SHA-512:	0B71952055013CD6045ED209FD98168083550655FAB91B7870C92098E40C4FE6827EAAF922D34ECE28298CBB14327A76AD6780D480E552F52F865AA11A4AA083
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Tucuman) {.. {-9223372036854775808 -15652 0 LMT}.. {-2372096348 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Argentina\Ushuaia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	3.7445758155279836
Encrypted:	false
SSDEEP:	48:5SHuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0jE:YOu3pfe92jCs/VOHv2kdeRtnxafwwfFn
MD5:	16A89FD2CDEE50E534301A9797311A9D
SHA1:	4A4EBA1798214C7CF5ACDC0B2EC8B4716CD968CB
SHA-256:	10B6FF51314D8EE1D010187D8805C4E3D71B778BC6DECB26E66193A5BB3E9EA2
SHA-512:	DBB0BA3F8AA2B54C86EA8B6530C16DF95AF1331FC5F843B113A204DA20B8EF011FE93C27EB917D01B9040D4914057687B4AACCD292A847559AF69150D1BDC4B5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Ushuaia) {.. {-9223372036854775808 -16392 0 LMT}.. {-2372095608 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Aruba

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.893042770292303
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290/V90ppv:MByMYbpwt290/V90b
MD5:	CC015E3E5D3293CAA1348B4E0EE5795C
SHA1:	75E7EFD905C9001CE9CA5872DA3915A19BCB00E0
SHA-256:	7490CD66408B8A14C549278FE67DC3338FE9E458F423F01CCBEA00B5E6F6CEF6
SHA-512:	66523F050E4A42A1C9FC8C02B822CD3864A6E35F6364FB6A675F2A503BD8030FE6E380B252068668A79A6593B5042520EE40700DA033517742B3F0ED33D79DAF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Aruba) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Asuncion

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7944
Entropy (8bit):	3.5156463862656775
Encrypted:	false
SSDEEP:	192:j7RXBXLqbvdvZsV4GGdzVUFg7XaMOhKpJq3o5GMJq90vRFhjGF3RxTBhcXBACBLo:jEJgXh
MD5:	181203CAD98E94355B9914A205514904
SHA1:	D361CB53955437270905A9432DE9E7F6C1AE7189
SHA-256:	EAEFE21276EE60C7F876C1D65039999AC069339DCDB82A23FC9206C274510575
SHA-512:	AE9262DFC35579AEB610DF8BB5F7FBB49232195F55F78402405017681F72C0D2A09FA9EB605B406065A1F44FE6785AC0163870C921DAFFC4746DA6EDA3081521
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Asuncion) {.. {-9223372036854775808 -13840 0 LMT}.. {-2524507760 -13840 0 AMT}.. {-1206389360 -14400 0 -04}.. {86760000 -10800 0 -03}.. {134017200 -14400 0 -04}.. {162878400 -14400 0 -04}.. {181368000 -10800 1 -04}.. {194497200 -14400 0 -04}.. {212990400 -10800 1 -04}.. {226033200 -14400 0 -04}.. {244526400 -10800 1 -04}.. {257569200 -14400 0 -04}.. {276062400 -10800 1 -04}.. {291783600 -14400 0 -04}.. {307598400 -10800 1 -04}.. {323406000 -14400 0 -04}.. {339220800 -10800 1 -04}.. {354942000 -14400 0 -04}.. {370756800 -10800 1 -04}.. {386478000 -14400 0 -04}.. {402292800 -10800 1 -04}.. {418014000 -14400 0 -04}.. {433828800 -10800 1 -04}.. {449636400 -14400 0 -04}.. {465451200 -10800 1 -04}.. {481172400 -14400 0 -04}.. {496987200 -10800 1 -04}.. {512708400 -14400 0 -04}.. {528523200 -10800 1 -04}.. {544244400 -14400 0 -04}.. {5

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Atikokan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.791603790249234
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE/qlOi+4IAcGEu5B:SlSWB9vsM3y7oDSHAIgpdN/290/qlf+M
MD5:	5A45B70C79F533548B3DD332F988E15B
SHA1:	C7485828619A1D4F5CA59D80ABD197100AC58F64
SHA-256:	518BEB6E54AE811F8C725EA8CC42787D48FC605A3476D6E7A00A1B5733CBD6AC
SHA-512:	A81C2EBE282E019ED011EADDB8F74C3E6FBE88D87E8D8706B3022CDCC48EF92AD90F9BCF9F25031664BB6EFE069EAFDD23D9B55BF672FC7528A2DD8CB6B986B4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Atikokan) $TZData(:America/Panama)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Atka

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.812527147763069
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0/yO5WXHAIg20/yOoNvWARL/2IAcGE/ol7x+IAcGs:SlSWB9vsM3y7/yrHAIgp/yH0AN/290/e
MD5:	13479F64BFBDC7583C637E1562C454B4
SHA1:	2F59484C779B0D6033FC14E205DA9BCAB7A5FCB1
SHA-256:	1D6FEE336E71FFFB64874A830C976867C071EBF6B133C296B32F87E3E7D814C9
SHA-512:	D2C5D35BBBDAB8D58BF6185328124796C06B67ADFB4C1828BA5A9CCA500A01BB8BE69635AE7EEA7FA837A27B20D488A08A29B121DD1617BC373390AD95D67E39
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Adak)]} {.. LoadTimeZoneFile America/Adak..}..set TZData(:America/Atka) $TZData(:America/Adak)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Bahia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2012
Entropy (8bit):	3.703391569010329
Encrypted:	false
SSDEEP:	48:5/ChlvEw6kSSx5H4a8tf3fku+da2XUd23t8VZDG8+GyOd:VIlvEwJSSxdF8tfMu+da2kdCt8VZy8+K
MD5:	69DCC2477D8D81E2F49D295DB6907190
SHA1:	3C6ED0CEF15D3265C962873480EE1809A4DCACA2
SHA-256:	64F1EC14F6B43FF10B564F839152E88DF9262F0947D1DB347557FA902F6FD48C
SHA-512:	71DEA6D47F267AA7326A011872FA74762FA4F8CD57EB149E3B56B3DE9097B0B9258BC4F6C29188B49FC60C1942869B92D9E59FEE6980A5DA5D0029C383D99F39
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bahia) {.. {-9223372036854775808 -9244 0 LMT}.. {-1767216356 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Bahia_Banderas

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6847
Entropy (8bit):	3.8753284304113196
Encrypted:	false
SSDEEP:	48:5pUSdFS1Y3FUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAqyQUrBbp7uos6u:DG1sehpYtpjyrz7nKED4KPddGEYA/Gx
MD5:	E7EF08880C64C898BB7A5266EBF1A47A
SHA1:	E2D2F36961C9CADB2736FFAF2DBA9A1F4B372DBD
SHA-256:	B24AE5FA20F5329644529F660EEC8BAA3B966F9730AF58F1C21E94C02AE17228
SHA-512:	6C47D875682CCE8B769EB0458CEC20FB8D4950A70D6904A32CED803D30F8B407828D7A12B4F560CF6B86541E985817B4394F9AEAAFEAA80593B5B42BA92D38CB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bahia_Banderas) {.. {-9223372036854775808 -25260 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Barbados

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	648
Entropy (8bit):	4.251560000277241
Encrypted:	false
SSDEEP:	12:MB86290eWmdH9Colj/uFkv/lC1/uFkOzQs/lps/Ozfah/OzT/lN/uFkX/ll/uFki:5TWeUo5Skv/Y1SkA/g/Bh/m/rSkX/zSt
MD5:	DC4FA44B2174A4E6F0644FA8EA2E83F9
SHA1:	C12DF8C862A05D569EAF189272F8BF44303595A1
SHA-256:	FD5E04136506C6543A9ACDC890A30BCF0D561148E1063EC857E3913DE1EBA404
SHA-512:	5AC307CD48132B57215CCBAF0BB63F7FA9C5B28DC9F6217C905885D75B0DF131238D4DB2AE707C3DDEE2EDE6C0914644B435FB1CDD9913600D8B69AE95578B0F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Barbados) {.. {-9223372036854775808 -14309 0 LMT}.. {-1841256091 -14400 0 AST}.. {-874263600 -10800 1 ADT}.. {-862682400 -14400 0 AST}.. {-841604400 -10800 1 ADT}.. {-830714400 -14400 0 AST}.. {-820526400 -14400 0 -0330}.. {-811882800 -12600 1 AST}.. {-798660000 -14400 0 -0330}.. {-788904000 -14400 0 AST}.. {234943200 -10800 1 ADT}.. {244616400 -14400 0 AST}.. {261554400 -10800 1 ADT}.. {276066000 -14400 0 AST}.. {293004000 -10800 1 ADT}.. {307515600 -14400 0 AST}.. {325058400 -10800 1 ADT}.. {338706000 -14400 0 AST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Belem

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	3.8842563546204225
Encrypted:	false
SSDEEP:	24:5fe300cChlrLPsw6kSS3h5R14eH8tf3xd:5+CChlvEw6kSSx5H4a8tf3xd
MD5:	DFA5E50F6AEF1311A4CF74970477E390
SHA1:	5B63676EB8039B2BE767BAA44820F2DAE5B62876
SHA-256:	549625CCB30BD0E025BAC47668BA3AA0CDD8569E5887E483C8D62B5B7302FA50
SHA-512:	4BBB43694E3B54339C549AC3A5488B77366DB1189D8D1834DCF618D9448084A950B575E207064521B1CDFD2E41F7D1D8C5CD9CEB4668D4459585649556136EB0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Belem) {.. {-9223372036854775808 -11636 0 LMT}.. {-1767213964 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Belize

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3284
Entropy (8bit):	3.8546064195941097
Encrypted:	false
SSDEEP:	48:5pKSxZwR9IVQU55DG5krgGN8wW+YeD1yyfCwoc:HKSjgIVzrG5krRN8wWheD1yu
MD5:	4DA622B685B3B075CC94FC4E23322547
SHA1:	DEB23F0A434549DAE1BE60ACF757BB212C907B92
SHA-256:	E07F45264E28FD5AA54BD48CB701658509829CF989EC9BD79498D070A1BA270F
SHA-512:	9B00BF8870BC4AAEF7F06FCDFEEEF54686A2CC890103696631EB4DEF5AEEAD051EC9069D70A2B22397F18C0067E03A54E75DA18474D6B1BD3BDA2D5313E0AD16
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Belize) {.. {-9223372036854775808 -21168 0 LMT}.. {-1822500432 -21600 0 CST}.. {-1616954400 -19800 1 -0530}.. {-1606069800 -21600 0 CST}.. {-1585504800 -19800 1 -0530}.. {-1574015400 -21600 0 CST}.. {-1554055200 -19800 1 -0530}.. {-1542565800 -21600 0 CST}.. {-1522605600 -19800 1 -0530}.. {-1511116200 -21600 0 CST}.. {-1490551200 -19800 1 -0530}.. {-1479666600 -21600 0 CST}.. {-1459101600 -19800 1 -0530}.. {-1448217000 -21600 0 CST}.. {-1427652000 -19800 1 -0530}.. {-1416162600 -21600 0 CST}.. {-1396202400 -19800 1 -0530}.. {-1384713000 -21600 0 CST}.. {-1364752800 -19800 1 -0530}.. {-1353263400 -21600 0 CST}.. {-1333303200 -19800 1 -0530}.. {-1321813800 -21600 0 CST}.. {-1301248800 -19800 1 -0530}.. {-1290364200 -21600 0 CST}.. {-1269799200 -19800 1 -0530}.. {-1258914600 -21600 0 CST}.. {-1238349600 -19800 1 -0530}.. {-1226860200 -21600

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Blanc-Sablon

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.938043196147077
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290F490ppv:MByMYbpwt290S90b
MD5:	09FD8280CC890F238126F9641DB7C90E
SHA1:	98AB4E0DE8173C2BB2532B07FAE2E71F588AB26F
SHA-256:	FACD0A835D1F425CD323EE453ADE231810B2D1CF6EBA227BA1B50522AE3879F7
SHA-512:	117C24389B7BFB079F4409B1FA6AA547654D7C69A6CBB19218BF2B96F6CFE3CBAAD400D4C2EFE8A9BFE25F44402057427FC8A62DC20A98018D23A7CF9B87401F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Blanc-Sablon) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Boa_Vista

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1199
Entropy (8bit):	3.7988385604912893
Encrypted:	false
SSDEEP:	24:5EThevwnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQZ:5EHSeSFESoSQSrSsCSeSPS1cSQSQlSsp
MD5:	9529221F9B4E104CC598491703B10E6C
SHA1:	5ACD61B525A18DE1919A7484C92EC5D787DF2F25
SHA-256:	10592EA1CB0D02C06A61059EC601F70A706A5053AC923B9EED29388D5E71EF3A
SHA-512:	66BEDB631469651A5E426155428764E3C1C14483E6FEE1505812E8676EB6E82CF0A88F6CC697F03FDA0AF906D91C7DE6E940DF3D33DD247BEF51DBD9A13DEE16
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Boa_Vista) {.. {-9223372036854775808 -14560 0 LMT}.. {-1767211040 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Bogota

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.705337479465446
Encrypted:	false
SSDEEP:	6:SlSWB9eg/290bJhDm2OHDgoHvcuknov/zEXPKV2kR/uFVEV/KVg:MB86290bLmdHDgCvcukCz8O2Y/uF2/Og
MD5:	DB019451A7D678C3E7AEE706283861F6
SHA1:	57E63C5372F50CBD1A7FA32688C1B77ADDCC06EB
SHA-256:	B6ADC16815DC95E537548CA3572D7F93626A6D1DC390DD4CBABAB5AB855BBA30
SHA-512:	6C94B2D7EFA856E6BD41FC45B0E8D16A40E61D8B895397CD71230047FAD4793DDB9ABAAC57D2841549F161C9389D7E61D54D38F1BAC6F13ED3DD4C68CDD3272C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Bogota) {.. {-9223372036854775808 -17776 0 LMT}.. {-2707671824 -17776 0 BMT}.. {-1739041424 -18000 0 -05}.. {704869200 -14400 1 -05}.. {733896000 -18000 0 -05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Boise

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8605
Entropy (8bit):	3.8563913604109064
Encrypted:	false
SSDEEP:	96:eSwtktXNmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:/jXNDPlLv/PCenJzS6cy
MD5:	005D0BF1320030A7E9CDC97D0C8BB44B
SHA1:	CB236DA840A49B4BCD261114DCA38DADA567B091
SHA-256:	93AF910CB2AD2203B71C1AD49D56DF4A4A14D07F885AFD4E755271F1372A517C
SHA-512:	16A5483392741673BEC020EF6EBE963AB0FB12629D662C586C27A1E9A1BE3FEA8DC3D05A0E84917B8166E48CADA45C74DFABFDC897A6BC94D3C5058D31AD5126
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Boise) {.. {-9223372036854775808 -27889 0 LMT}.. {-2717640000 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-1471788000 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126255600 -25200 0 MST}.. {129114000 -21600 0 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Buenos_Aires

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.821972751564724
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MQA+zAHAIgp/MQA+zE5N/290BFzk5h490/MQA+zd:MByMY/MV+zhp/MV+zE5t290rzy490/MW
MD5:	6700956D5FE96CEC8D34EB49FF805374
SHA1:	69B9973EF31AE204EFED7485E59CEA99E00815C8
SHA-256:	DEFC5C9DA2D4D4146145A50D692A6BFF698C3B0A1F19EFD82AD0EE7678F39FCF
SHA-512:	A80C03A519F00A4270248E885463090A34B3992B3DEBA94DD6AEBCC50736541655461E4AA10856125B8EF9B92CEB697429EE7088DBC6AB4FAE383FDF11521B7A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Buenos_Aires)]} {.. LoadTimeZoneFile America/Argentina/Buenos_Aires..}..set TZData(:America/Buenos_Aires) $TZData(:America/Argentina/Buenos_Aires)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Cambridge_Bay

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7739
Entropy (8bit):	3.8713679494465016
Encrypted:	false
SSDEEP:	96:zsGaLV9T1sF7Lv/PCewtA8CzSPyDLbrcUia:h5lLv/PCenJzS6cy
MD5:	E6AE12CDB55FED492C253E46E2690FE0
SHA1:	CD3699E50BC1694827E51E4101C713E52FA646C8
SHA-256:	3E0506A54B562DBC3AA6889DDD39B327FE0B85C63B00F0B39D606921A0936A59
SHA-512:	BA3D5D5420210E74E74A581C9678224948266828A8FACE06383E41E13475C682F82D288426FB915D618FFE7ED95BD8F1C7E9D59D31CE5B464D5EC1363AB5E340
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cambridge_Bay) {.. {-9223372036854775808 0 0 -00}.. {-1577923200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}.. {671014800 -21600 1 MDT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Campo_Grande

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2918
Entropy (8bit):	3.6039149423727013
Encrypted:	false
SSDEEP:	48:591PSeSFESoSQSrSsCSeSPS1cSQSQlSsSyZS2SqLSwZS4vSoSUSLpSzS4X3/SxSs:5VsE3LMuJALTvn1ZdP7ZbvLfeAh+KIic
MD5:	230A9F7A87BA56C30ACB3B1732F823F3
SHA1:	8263EA723F2AEA7740C7EC54BE0000A06982D765
SHA-256:	6D5BD1355016B03EDEA58DF98BEC26281CD372725B2DCB60B4D748D2FB4346C8
SHA-512:	C357AA33833DBBDC6BC7DD3F23469EADDF08564AF17D7EE935C8AEA5F35B6E3BBDE1E181BC0DBF264051C4BE139261055633D191413DD610B0150AB3CDE161AF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Campo_Grande) {.. {-9223372036854775808 -13108 0 LMT}.. {-1767212492 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Cancun

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	4.034087321254386
Encrypted:	false
SSDEEP:	24:5s5edTS/uVV3iVP/uaP/uAyAhbS+V8S+FfS+UvS+MS+FB3S+QS+rcS+kS+RS+dSB:5DziZAmELf0On9uhcinzPPoUlWQW3
MD5:	7FBCA91F4B7100C4667F24A9AB263109
SHA1:	163A77FF9EAC49B00B5F838DF4D47F079ECF6A83
SHA-256:	FD6C370F82E5CFE374637E0E222E72570857AC3F85143BEEEF9C3D0E7A6C0D04
SHA-512:	124A5D7F58B38F15A90BA48E63D1D38335371D98A2503E691EC6426EB51E87FD61CA05FCA83573DD1DC06DB9E599302C64D226D5DF13B8A62E0A6943318431BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cancun) {.. {-9223372036854775808 -20824 0 LMT}.. {-1514743200 -21600 0 CST}.. {377935200 -18000 0 EST}.. {828860400 -14400 1 EDT}.. {846396000 -18000 0 EST}.. {860310000 -14400 1 EDT}.. {877845600 -18000 0 EST}.. {891759600 -14400 1 EDT}.. {902041200 -18000 0 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0 CST}.. {1207468800 -18000 1 CDT}.. {1225004400 -21600 0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Caracas

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	284
Entropy (8bit):	4.588048586971241
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2909+ETlDm2OHXoHv8HkISlvFVFQVgVJUF/R/OXFxWnVVFQVgVVvR/e:MB86290XmdHXCvydSltvAUeFZ/O/qVva
MD5:	5DDB49759D58931A06740A14F76B431C
SHA1:	E9AC99265D42D140E12BB4DAAA24FABAC65E79FA
SHA-256:	D558C25F165E956E980AA8F554AB3BF24E91B51EADBD2B1065EF6DFDA0E2F984
SHA-512:	318804ED41F36A3A8746C8CD286116787A768B06CAD6057559D1C7105170DE6EAB807EFA52AA8A0E353491B6F8C47D623D4473C1AEAD20B5C00747E07BB282B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Caracas) {.. {-9223372036854775808 -16064 0 LMT}.. {-2524505536 -16060 0 CMT}.. {-1826739140 -16200 0 -0430}.. {-157750200 -14400 0 -04}.. {1197183600 -16200 0 -0430}.. {1462086000 -14400 0 -04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Catamarca

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.666638841481612
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/29094SXAFB5290/MMXAy:MByMY/MYp/MrRt290mh5290/MK
MD5:	EEB851BE330BCC44A4831763534058B9
SHA1:	A5FC3E69DDBD3C40D9EB4317BBD5BB6C78751B36
SHA-256:	37CD6BDAA6C6EEDFAC3288CA1C11F5CBBE8A17E5F2E790E7635A64B867AFBD87
SHA-512:	7CD0BC822550325EB3198B4AD6CCD38938FA654A03A09C53117560D1FE3FDCD9C892D105F0D7AF44ED52DD7E0475721240D74A10C98619BE9EC4F5410B8FD87D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Catamarca) $TZData(:America/Argentina/Catamarca)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Cayenne

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.832612867310476
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2IAcGE91INMXGm2OHEFvpoeoHsdR4FIUPvGXFkUwXvp3VVV:SlSWB9eg/2909qDm2OHEdGeoHm4vOXF6
MD5:	6052E52C8E5A5F43102C47D895797A1F
SHA1:	23DBD40AE96C84E44ADCD1AC33E7871D217C17BC
SHA-256:	873285F3E13CB68DD28EB109ECAD8D260E11A9FF6DF6A4E8E0D4C00B0182695B
SHA-512:	DDE89C70B6F24AD4F585DC5424A6D029E5C898254C9085C588AE699CED4C8316840FF7C87685D7CFAA2E689F01687985454A0C9E3886342E936C56AB688DF732
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cayenne) {.. {-9223372036854775808 -12560 0 LMT}.. {-1846269040 -14400 0 -04}.. {-71092800 -10800 0 -03}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Cayman

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.774923706273939
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE91mr4IAcGEu5pvn:SlSWB9vsM3y7oDSHAIgpdN/2909Yr49F
MD5:	AD6E086BEDF05A0BEB66990BD9518BEE
SHA1:	FA0B7E8D6931E79092A90F7EECBA2293AE886AE3
SHA-256:	C38C49AE1C3E67BD2118002DCFCC3C0EFB6892FB9B0106908A9282C414D0BF2E
SHA-512:	A1E40422D15DBCB24A6FE353639A1541FAD7F394D20F8AEB32D4E39667BA264C3E815BAA703B88B90D381540168016A0641CA220BACAF05E80EAA698642B6FFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Cayman) $TZData(:America/Panama)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Chicago

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11372
Entropy (8bit):	3.814348526052702
Encrypted:	false
SSDEEP:	96:l6u30Ke1rdJ8SUklvgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:l1EKwdJ8SUkl4aUqtfA604qSBgI7DBch
MD5:	763E23AA7FB20F8D7CB2F0E87FAFD153
SHA1:	B131A10C1C208BB5E5E178ACD21A679FD0537AC5
SHA-256:	C7707AF88D650F90839E7258356E39D85228B33B6DBCC5C065C3D8733AE28CEE
SHA-512:	FE9C5D2EA253338DDFD79CC8ED2F94D6817BD770C0895752EFB1917E2313735C18475D67191C29BCCD53DEFFF35C1BF0CA5D98C92091DDCD1E97CD6302DC73A4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Chicago) {.. {-9223372036854775808 -21036 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1577901600 -21600 0 CST}.. {-1563724800 -18000 1 CDT}.. {-1551632400 -21600 0 CST}.. {-1538928000 -18000 1 CDT}.. {-1520182800 -21600 0 CST}.. {-1504454400 -18000 1 CDT}.. {-1491757200 -21600 0 CST}.. {-1473004800 -18000 1 CDT}.. {-1459702800 -21600 0 CST}.. {-1441555200 -18000 1 CDT}.. {-1428253200 -21600 0 CST}.. {-1410105600 -18000 1 CDT}.. {-1396803600 -21600 0 CST}.. {-1378656000 -18000 1 CDT}.. {-1365354000 -21600 0 CST}.. {-1347206400 -18000 1 CDT}.. {-1333904400 -21600 0 CST}.. {-1315152000 -18000 1 CDT}.. {-1301850000 -21600 0 CST}.. {-1283702400 -18000 1 CDT}.. {-1270400400 -21600 0 CST}.. {-1252252800 -18000 1 CDT}.. {-1238950800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Chihuahua

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6814
Entropy (8bit):	3.8786702185951305
Encrypted:	false
SSDEEP:	96:bo1GK5+yBEzg4GaaECHm3FL5TInckNSNi:m5+yBEzVWEaOkv
MD5:	1C8647651377A373D573DCD21001CC0A
SHA1:	EFFE86F9A5C55FAB00415DD0A103B00AA6B237C6
SHA-256:	A816DC1C4C2FB7509A50CB209D748DAC27C5F858A2842D7E12B2EC620FEA988B
SHA-512:	5E78696E68FD13F1C45D880E49D121A7761CC5747060ADA0756D805B9DB6816DBE7054C88EC5BA0ED4C05D8EA019388195520A4B231E36F47BE99C542108481A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Chihuahua) {.. {-9223372036854775808 -25460 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {820476000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {883634400 -21600 0 CST}.. {891766800 -21600 0 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -25200 0 MST}.. {1143968400 -

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Coral_Harbour

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.844590153688034
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0u55DyXHAIg20u5cvRL/2IAcGE9WtEaQXs+IAcGEi:SlSWB9vsM3y7oDSHAIgpdN/2909qEacn
MD5:	A0BF04CD77026DC1D2749848AB0EE45E
SHA1:	EA0F1BC11379DF2E421675BC5DE4805CE94B96D6
SHA-256:	C8CBF5A29CC1D0827390CA6E98B2EFCF90743C6DD0ECA143B300050DD4164041
SHA-512:	61968B4E42ECC60C801F959D18D13187AD39D9B81FA1A947F6B6862F99D73E3A30849AC4233DB5705D46F5373C42D8748B15BE9B82822971B4F47E601E5766D8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Panama)]} {.. LoadTimeZoneFile America/Panama..}..set TZData(:America/Coral_Harbour) $TZData(:America/Panama)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Cordoba

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.78887878252354
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MSHAIgp/M1ovN/29093+90/M7:MByMY/M7p/M16t290c90/M7
MD5:	C7CCF5CEC7AA60D6063D1C30F4263ADC
SHA1:	FD8E9AEEEE50656FD3C694CA051895DDC8E5590B
SHA-256:	28B84710EADEF7AD5E7FA63EF519A9D93996D3BB91DD9018333DE3AC4D8FB8DD
SHA-512:	6974F8B238977EE5222368C4B79327BB240580819FCA082261D6994781144D81E2E8843B4F1C9D07EFBEE27311C8930BDAC9C0D6D6718F6FB1600D0000576CDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Cordoba) $TZData(:America/Argentina/Cordoba)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Costa_Rica

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	431
Entropy (8bit):	4.506976345480408
Encrypted:	false
SSDEEP:	12:MB86290lnmdHd5CvZN/Mi3yvI8/uF+wSJz/uF+IA/uF+i/X8/uF+ZDVxNv:5mnedIvZN/e5S+w+S+LS+i0S+pB
MD5:	0446EF1A6985A62EDFFB9FFAC7F1DE0E
SHA1:	A43468E120E585E2DCC20205BA1D1E2CCB6C0BC2
SHA-256:	E3061DC6FA9F869F013351A9FDF420448592D7F959C2B4404093432508146F7E
SHA-512:	86D41B0C49489572C3EAEDD5466AA92319C721CCEC9437EBB0F2AAD772FB5ED91A2F2061E00448FB48096B0BAAE9A4E1E644F8AF595B76BE05DBC0C801E6D6ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Costa_Rica) {.. {-9223372036854775808 -20173 0 LMT}.. {-2524501427 -20173 0 SJMT}.. {-1545071027 -21600 0 CST}.. {288770400 -18000 1 CDT}.. {297234000 -21600 0 CST}.. {320220000 -18000 1 CDT}.. {328683600 -21600 0 CST}.. {664264800 -18000 1 CDT}.. {678344400 -21600 0 CST}.. {695714400 -18000 1 CDT}.. {700635600 -21600 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Creston

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.8664633847782905
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/2IAcGE9mM7x/h4y:SlSWB9vsM3y7OBHAIgpONYyHN/2909vr
MD5:	0757DD22C0E297CCE8E6678ECA4B39C7
SHA1:	81B31299F9A35C8BA2EC1F59EC21129FFCDCD52F
SHA-256:	A01DDB460420C8765CE8EF7A7D031ABD7BDB17CFA548E7C3B8574C388AA21E17
SHA-512:	F1AFC0F6371A10E4CB74FB2C8985610AEE6C3511861BC09384EDC99D250E9099A1F4430BFC3B0B396C2702BF9991A5A4ECFD53A82C92883460715FA2C1E04579
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:America/Creston) $TZData(:America/Phoenix)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Cuiaba

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2912
Entropy (8bit):	3.588248620238414
Encrypted:	false
SSDEEP:	48:5tSeSFESoSQSrSsCSeSPS1cSQSQlSsSyZS2SqLSwZS4vSoSUSLpSzS4X3/SxS1S4:rVsE3LMuJALTvn1ZdP7ZbvLfeAh+KIil
MD5:	264E0CEA9491B404993594E64F13479F
SHA1:	6D4D277FA470A2C7AD0A59B5DA3CC15BEEB74E78
SHA-256:	2D8281CF3FD9E859C5206F781E264854FA876CB36562A08C6C01343C65F8A508
SHA-512:	759C19B4DD0E1F7F1176872806BFB1F17ADF9C992E41B96FEA67D77DD67E9DD3C1683E3B6D27FB092C731F534C6A7441BACFFF0301907217A064523B86992E23
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Cuiaba) {.. {-9223372036854775808 -13460 0 LMT}.. {-1767212140 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200 -1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Curacao

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.876961543280111
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/2909C4e90ppv:MByMYbpwt290690b
MD5:	9459043060E33E8EDC74E78332E96EDF
SHA1:	27963FE063965584D0F226BAE9A08EB2954398F0
SHA-256:	ACCF08CF53C9431E226714DF8BEDE3C91BAF62D5BD7B98CA8B50D7258124D129
SHA-512:	215D9AFAA7227F4447177CE2ABA5A6F7F2F46A9D787845DD32F10D5C22BF9CBE4047AF5E0E66FA7A4F70EEE064A7EC7B67949E565C3C5C60C31F3C19D6915D76
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Curacao) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Danmarkshavn

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	3.8794180227436557
Encrypted:	false
SSDEEP:	24:5geNrmFQqFi77FkiVFw1ZFt9SFUXDFH9vMF0mFdS/FyMF8AWXF7HFEJF7cSXHVFS:5/vx7O11pbzvZ+S0xAqe12vey
MD5:	6E37A78AC686A6B48A78541E1900E33C
SHA1:	D41F39FDB6D45921B57341E95A006251B4875961
SHA-256:	968C56F1D0106E1D92C7B094EEF528B6EE1FFA3D7A18BE2F2BA59178C2C0F1E0
SHA-512:	397623149D95FF9A094750EE697F62DF90124BBBE407FB49FBAE335A61629449F2A61EF4471DBD57745B323DFCF3628611CAE9295F2EF7E4A7412A697651FF68
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Danmarkshavn) {.. {-9223372036854775808 -4480 0 LMT}.. {-1686091520 -10800 0 -03}.. {323845200 -7200 0 -02}.. {338950800 -10800 0 -03}.. {354675600 -7200 1 -02}.. {370400400 -10800 0 -03}.. {386125200 -7200 1 -02}.. {401850000 -10800 0 -03}.. {417574800 -7200 1 -02}.. {433299600 -10800 0 -03}.. {449024400 -7200 1 -02}.. {465354000 -10800 0 -03}.. {481078800 -7200 1 -02}.. {496803600 -10800 0 -03}.. {512528400 -7200 1 -02}.. {528253200 -10800 0 -03}.. {543978000 -7200 1 -02}.. {559702800 -10800 0 -03}.. {575427600 -7200 1 -02}.. {591152400 -10800 0 -03}.. {606877200 -7200 1 -02}.. {622602000 -10800 0 -03}.. {638326800 -7200 1 -02}.. {654656400 -10800 0 -03}.. {670381200 -7200 1 -02}.. {686106000 -10800 0 -03}.. {701830800 -7200 1 -02}.. {717555600 -10800 0 -03}.. {733280400 -7200 1 -02}.. {749005200 -10800 0 -03}.. {764730000 -72

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Dawson

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2967
Entropy (8bit):	3.9564096415565855
Encrypted:	false
SSDEEP:	24:5IeVvxBn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5zxKKpj/AOZFCARCeQbvb5wxMN6Ix
MD5:	F494405F3B250668BE00DC3864B9A2DC
SHA1:	20843AD6D95DD5D5950E2946BCAE4ECE2B676F70
SHA-256:	30E875343C81C8DE473E6313A27C55315F38E7CCDBD2CEE5783EC54D269D5807
SHA-512:	9102BD114436D5FE5A1942E31AE692ECE41F910AC1B6E52C02283801D5AA00CFF22D980C61E69928267D3DD34331E301C7324CA631B71AC2FBBDE06D7914F849
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Dawson) {.. {-9223372036854775808 -33460 0 LMT}.. {-2188996940 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800 0 P

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Dawson_Creek

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	4.024810417421672
Encrypted:	false
SSDEEP:	24:5/eUv5wk7Zw9JmnRsw78wP+7bw+7zwN7SynwpBZ7Fwk47H+wW73wo5775w572Iwl:5DuY/YRRvkGZ+R64CjSUlTGS
MD5:	7868720D39782147B2BD6B039A5BF7E0
SHA1:	6F66404E5CCFF7F020269A316D792D5E7AD4C280
SHA-256:	540804BECDEAB92340EF02D32A62BFD550B71A3DB8D829BE426EE4D210004643
SHA-512:	9CCD124FF954CA2988F07286FFE9ED740E0CEF5F4D76BF090367B74A577E91BF5590EDFE12AFC83ACF5CBFC88C5A68867C58082A2777D08C326A7B18889B08E2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Dawson_Creek) {.. {-9223372036854775808 -28856 0 LMT}.. {-2713881544 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-725817600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400082400 -25200 1 PDT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Denver

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8920
Entropy (8bit):	3.8540632258197514
Encrypted:	false
SSDEEP:	96:gjGtwmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:gUwDPlLv/PCenJzS6cy
MD5:	0D649599A899ECB3FCF2783DCEE3E37B
SHA1:	ACC796BE75F41A12FB1F8CCBD2B2839AF9876FFE
SHA-256:	3FE2EE8C05C5D6F268B58BD9FC3E3A845DEA257473B29F7B3FB403E917448F3C
SHA-512:	C10D41AB95439B8E978F12F9F58D1ACC9AD15404123FA5FBA0D1CC716E5CF5DA6BD2252450055AC3998DBCB8DD49F7A82ACD53413E3EE78CDA2C42F603DE2C56
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Denver) {.. {-9223372036854775808 -25196 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-1577898000 -25200 0 MST}.. {-1570374000 -21600 1 MDT}.. {-1551628800 -25200 0 MST}.. {-1538924400 -21600 1 MDT}.. {-1534089600 -25200 0 MST}.. {-883587600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-757357200 -25200 0 MST}.. {-147884400 -21600 1 MDT}.. {-131558400 -25200 0 MST}.. {-116434800 -21600 1 MDT}.. {-100108800 -25200 0 MST}.. {-94669200 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -2

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Detroit

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8430
Entropy (8bit):	3.826664943157435
Encrypted:	false
SSDEEP:	96:SGiS1A5tCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:SG/K5ItON0HY2iUmUFLqU
MD5:	2BBA922E9377D257CBDF6E1367BBB1A2
SHA1:	6F33A44834E8041E78660A326A5DDAF3D7F9DC2A
SHA-256:	84F6897B87D3978D30D35097B78C55434CE55EB65D6E488A391DFC3B3BB5A8FE
SHA-512:	D225824945C08A3521A8288B92B26DFFA712ED3505E72DEDE4A7D1777E58DEA79ADF3F042D22624E4142DD4203BAA4DFF8EB08B7033FDF00059F6C39954EA1A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Detroit) {.. {-9223372036854775808 -19931 0 LMT}.. {-2051202469 -21600 0 CST}.. {-1724083200 -18000 0 EST}.. {-883594800 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-757364400 -18000 0 EST}.. {-684349200 -14400 1 EDT}.. {-671047200 -18000 0 EST}.. {-80506740 -14400 0 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {94712400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {157784400 -18000 0 EST}.. {167814000 -14400 0 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Dominica

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.86856578093135
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290TL3290ppv:MByMYbpwt290Tr290b
MD5:	398D8DBB24CEA2D174EF05F63869C94A
SHA1:	6D0E04165952E873E6ECA33A0E54761B747F0A98
SHA-256:	3DA98AA7D3085845779BE8ED6C93CCBDA92191F17CA67BBF779803E21DA2ABF3
SHA-512:	2652AFD1A3F8A4B84078A964005FE10C64491EC2D47CDE57D5066D07D1D837308FD696F53B9E7B6B0E72F86F9A85128B8CBF5F302F91EADE6D840DF946DE85CD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Dominica) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Edmonton

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8600
Entropy (8bit):	3.8579895970456137
Encrypted:	false
SSDEEP:	96:7SabOGaLm911sF7Lv/PCewtA8CzSPyDLbrcUia:7vf4lLv/PCenJzS6cy
MD5:	EBD169ECA4D45EED28BF7B27809361BC
SHA1:	E89C8484A29D792FB6349CFDFDD30C2FA6B78B6B
SHA-256:	026D51D73D30A3710288F440E0C337E44E3A14D0AA2D7B6C6E53AF43FC72A90C
SHA-512:	45C936ED7D4AF95261180547013454AAEC9FA7672B52AC6077DD99D9FEB6DDD57652FE4EC67BF81F1588384F3027A1872E0C72D9CAEB980B66D2CB6EE9B8ABB0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Edmonton) {.. {-9223372036854775808 -27232 0 LMT}.. {-1998663968 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1600614000 -21600 1 MDT}.. {-1596816000 -25200 0 MST}.. {-1567954800 -21600 1 MDT}.. {-1551628800 -25200 0 MST}.. {-1536505200 -21600 1 MDT}.. {-1523203200 -25200 0 MST}.. {-1504450800 -21600 1 MDT}.. {-1491753600 -25200 0 MST}.. {-1473001200 -21600 1 MDT}.. {-1459699200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {136371600 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {167821200 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {23072

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Eirunepe

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	3.7989525000422963
Encrypted:	false
SSDEEP:	24:5OXUepdkZss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6w:5OXCZsMw57XJh4CxUF/A6GTrtSUUhfL0
MD5:	6766E75702D8C2D1C986DFCEFCE554F9
SHA1:	39553F80D82BC0134FAF70C9830B96BDCBCEFF1C
SHA-256:	48FC987E5999EA79F24797E0450FE4DAB7CF320DFAD7A47A8A1E037077EC42C9
SHA-512:	A812D0D4254BB0B7DB7AE116652D2A8F97D22C59F2709A17D1CE435FCFB38B807A4E0ED6EA114A66897E29D85226875FA84D28B254A5D17BD1CBA95FAD8349B7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Eirunepe) {.. {-9223372036854775808 -16768 0 LMT}.. {-1767208832 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {571204800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\El_Salvador

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.760311149376001
Encrypted:	false
SSDEEP:	6:SlSWB9eg/29078iPDm2OHvJ4YoHxHhgdrV/uF+IcmJ3/uF+ivNv:MB8629078AmdHx4YCJSB/uF+QV/uF+w9
MD5:	CEF7277443EB6990E72C7EA7F79A122C
SHA1:	1D3FEA364B3DC129DE3998A1455D5588EBAA6FF8
SHA-256:	C02C6E79398553BD07BEA0BE4B7F0EBDD8BC821595909CFFB49DE4290A0D1D0F
SHA-512:	E6FC530B2CCF010B8D38BC3F49A6859B5C68F4AB604E6305CE75FBE4FC9FF3FCD0187DEBEF6DAE652EEF9695568DBDE31F426E404CC3CC206D78183E0D919234
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/El_Salvador) {.. {-9223372036854775808 -21408 0 LMT}.. {-1546279392 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Ensenada

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.836337676384058
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0qfSfXHAIg20qfORL/2IAcGE7JM7QIAcGEqfBn:SlSWB9vsM3y7ekHAIgpeON/2907390eB
MD5:	005D9C0E50291616A727CFB74A9FD37E
SHA1:	846AE6720382B4F67B37B4256E45246C81DAF899
SHA-256:	3E363BF82545F24CCE8CFA6EEC97BA6E1C2A7730B2A9CE6C48F784821D308A5D
SHA-512:	452326D11D01825764BC40A77D17444D822F3AA202582233DD8B122798478FA83E3A27A02508EAC4CF0C7922AC2563742D773AA870562AE496B34FBB41FBAD63
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Ensenada) $TZData(:America/Tijuana)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Fort_Nelson

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4578
Entropy (8bit):	3.8944281193962818
Encrypted:	false
SSDEEP:	48:5QIgsB/YRRvkGZ+R64CjSUlTG5Al5pj/A1ZFCARCeQbvb5+:6IgzR864CjSETG5sjgZkR/bvt+
MD5:	4A4E023F635C4202018EA9E8F85B5047
SHA1:	38E121FE2D419413E9E791B6C22BFC8D9F7554BC
SHA-256:	AB15023807E7C7D1026C9970D190F1B405D48952464025242C2BB6C6BBB8391A
SHA-512:	F10D21A2C841224879D1C817FC7F477DF582E1BC3603666B55199C098D51D1D5429F8C088C1083C07FC7588AE5C42A1DFBCC6B7C636AD1BE84ED657807A229E5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Fort_Nelson) {.. {-9223372036854775808 -29447 0 LMT}.. {-2713880953 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-725817600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Fort_Wayne

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.778858143786314
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/290HXYAp4903GK8:MByMY3GK7Kp3GKnt290Hz4903GK8
MD5:	24C369A3091452DCA7AAEBF4F48F5289
SHA1:	2C2174CB16F490689E6FAC17B6D18F4A0DBD2DC9
SHA-256:	C8948616262CF6990739343ABBBD237E572DB49310099E21DD8F9E317F7D11B3
SHA-512:	80F579572754579706B4EEA49BF30456F3231A308E0616DC430E2428A04992412773421542E4F7FE4E4C7491BA88942FA44B49E87E95A2183211AC2AB523B231
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:America/Fort_Wayne) $TZData(:America/Indiana/Indianapolis)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Fortaleza

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	3.784027854102512
Encrypted:	false
SSDEEP:	24:5MeajcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaIBXR8nd:5rChlvEw6kSSx5H4a8tf3fkuoYVZDNRo
MD5:	E7939C9A3F83D73B82A6DE359365EFD4
SHA1:	06D6E257DA7C317CAFAF6C0B04567A2453CC1660
SHA-256:	C0A836BDAF07F0376B7B0833A0AB3D52BA6E3E1D6F95E247E1AD351CD1096066
SHA-512:	E2BEA04084489B26ADD9A768D2580C1FF7EBAC8A3EA36818F49E85FB14E01500D59D53904F5A17F4DABEF27B4CC2FC3F977EE4C125E5CE739BBE90C130ED3B07
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Fortaleza) {.. {-9223372036854775808 -9240 0 LMT}.. {-1767216360 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}.

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Glace_Bay

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8372
Entropy (8bit):	3.8225708746657316
Encrypted:	false
SSDEEP:	192:w4lTPB10KvnpNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/BI:wKCC
MD5:	1C8B0B85BB5578E84A4867546111F946
SHA1:	E08A96F5B369FA53BC1F3F839EC14FF9D334F727
SHA-256:	58C207CBD9DE7A7BB15E48A62CEA9F15DA184B945133DEE88EFF29FD8B66B29E
SHA-512:	54CFBF208AB3E58AFB6BEC40265A452A3C4C684D7F278F51D6495FCA544652A1A5E05BC45F600911191B33C936E5D7D43A28FD2B0884AAB9F63B7AD5EFD574A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Glace_Bay) {.. {-9223372036854775808 -14388 0 LMT}.. {-2131646412 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-536443200 -14400 0 AST}.. {-526500000 -10800 1 ADT}.. {-513198000 -14400 0 AST}.. {-504907200 -14400 0 AST}.. {63086400 -14400 0 AST}.. {73461600 -10800 1 ADT}.. {89182800 -14400 0 AST}.. {104911200 -10800 1 ADT}.. {120632400 -14400 0 AST}.. {126244800 -14400 0 AST}.. {136360800 -10800 1 ADT}.. {152082000 -14400 0 AST}.. {167810400 -10800 1 ADT}.. {183531600 -14400 0 AST}.. {199260000 -10800 1 ADT}.. {215586000 -14400 0 AST}.. {230709600 -10800 1 ADT}.. {247035600 -14400 0 AST}.. {262764000 -10800 1 ADT}.. {278485200 -14400 0 AST}.. {294213600 -10800 1 ADT}.. {309934800 -14400 0 AST}.. {325663200 -10800 1 ADT}

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Godthab

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.973070790103308
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0wQbSeyXHAIg20wQboAFARL/2IAcGE5GZJ4IAcGEH:SlSWB9vsM3y7lbSeSHAIgplbLFAN/291
MD5:	8263D2B39C2EC3B38A179F8BAD5972DD
SHA1:	18D3462F6846768E16036E860DE90FB345C93047
SHA-256:	5FB2CFBA25CE2F49D4C3911AFF8E7E1FF84EFC2D01F5783772E88246BFBC56AC
SHA-512:	C175CAF972459759553001D48921268E9C6268CED56021BA6339F8CE3DD032DA6180E2B82974D3DCD0DC5F21566DFDBFBE1B6CF24E5E893F2335A449452DB27F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Nuuk)]} {.. LoadTimeZoneFile America/Nuuk..}..set TZData(:America/Godthab) $TZData(:America/Nuuk)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Goose_Bay

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10353
Entropy (8bit):	3.864463676759425
Encrypted:	false
SSDEEP:	192:zfSacO8f7/ewzlrfFj18KvnpNWMPm4bPJvSuYUHgA0G19OBYEi/B51B7/Bm6BTdW:zfSacOI7/V3SuYUHgAuCC
MD5:	0D646C67105FD0525E7CCC79585CE9DF
SHA1:	06D91FDD8FEEDC299E40079569372F97A9AC6F04
SHA-256:	52D2478289682BF95BFB93D64D679E888C9D23C0F68DFFF7E6E34BFC44B3D892
SHA-512:	FD672613C2B65E12425415630A2F489917EB80DDED41338C9AA7D5D3C6B54E52C516A32493593F518DACF22A91D7A9D2C96DB9C5F1BE2C3BB9842D274BDC04FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Goose_Bay) {.. {-9223372036854775808 -14500 0 LMT}.. {-2713895900 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1096921748 -12600 0 NST}.. {-1072989000 -12600 0 NST}.. {-1061670600 -9000 1 NDT}.. {-1048973400 -12600 0 NST}.. {-1030221000 -9000 1 NDT}.. {-1017523800 -12600 0 NST}.. {-998771400 -9000 1 NDT}.. {-986074200 -12600 0 NST}.. {-966717000 -9000 1 NDT}.. {-954624600 -12600 0 NST}.. {-935267400 -9000 1 NDT}.. {-922570200 -12600 0 NST}.. {-903817800 -9000 1 NDT}.. {-891120600 -12600 0 NST}.. {-872368200 -9000 0 NWT}.. {-769395600 -9000 1 NPT}.. {-765401400 -12600 0 NST}.. {-757369800 -12600 0 NST}.. {-746044200 -9000 1 NDT}.. {-733347000 -12600 0 NST}.. {-714594600 -9000 1 NDT}.. {-701897400 -12600 0 NST}.. {-683145000 -9000 1 NDT}.. {-67044

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Grand_Turk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7522
Entropy (8bit):	3.84007813579738
Encrypted:	false
SSDEEP:	96:pGStCt/cL1BRv0HY2iU7KKdFL6Aa2K4gSLf8e:pvItOx0HY2iUmUFLqU
MD5:	A17723CE27EC99D1506C45AB1531085B
SHA1:	A83ED7BD09514A829CC8F2EA47BA113F5DCA1090
SHA-256:	560B39485CED4C2A0E85A66EB875331E5879104187D92CB7F05C2F635E34AC99
SHA-512:	110D1253D6915DB046247E4FD3BA9B881146BC3896DE779215E0CC6D1DCC59958C355441955509F5D38E3A3BA166DFD0F2F277000E9E89D6551FBEA0C16974B9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Grand_Turk) {.. {-9223372036854775808 -17072 0 LMT}.. {-2524504528 -18430 0 KMT}.. {-1827687170 -18000 0 EST}.. {284014800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}.. {483519600 -14400 1 EDT}.. {499240800 -18000 0 EST}.. {514969200 -14400 1 EDT}.. {530690400 -18000 0 EST}.. {544604400 -14400 1 EDT}.. {562140000 -18000 0 EST}.. {576054000 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607503600 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638953200 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671007600 -14400 1 EDT}.. {688543200 -18000 0 EST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Grenada

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.892013473075135
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/2905Qb90ppv:MByMYbpwt290Ob90b
MD5:	4B9ABEA103F55509550F8B42D88E84B7
SHA1:	E3AA1BCE5E260264E74F77E59C4071B7E496AB41
SHA-256:	EBED070E8E67C5F12FF6E03FE508BE90789F17C793DFE61237B4045B8222580F
SHA-512:	568E375464FF264C5048CB35995945BDE1D5BCC3A108B2A4D0F8389EBF18B4C58EBB1C2122F10BA777D512504A59C7EFDF6069EABD2A5DEA3189204B7F7A6EB4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Grenada) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Guadeloupe

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.9138787435596765
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/2905AJLr490ppv:MByMYbpwt290qJLr490b
MD5:	92B091A06198E233B73DF12DFCD818D5
SHA1:	C529488D09F86755E4F22CB4F0E3013C3A1B978D
SHA-256:	6CB1930532831D12057FCB484C60DB64A60A4F6D8195DAFD464826923116A294
SHA-512:	55EAE03CDECAC43BEDD3AA1A32C632A46808F29FF4D97A330F818544E4D10B9E9BA909D6627C38065EB7AC8E2C395FA37797F532CCFC8AB89D4698CCDE17F985
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Guadeloupe) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Guatemala

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	399
Entropy (8bit):	4.513185345162455
Encrypted:	false
SSDEEP:	12:MB862906GGmdHKznC972f/uF+mP/uF+K67Jqd3/uF+eBxE/uF+DAWNv:5neQCgfS+6S+K67Yd3S+e0S+1
MD5:	569CDE7CE1AB84C0F16A25E85A418334
SHA1:	EADE79AB6EDD98C7FE8B10B480C5C530CA014F5C
SHA-256:	14F6A98D602F3648C816B110F3A0BA375E1FFE8FA06BEEAB419DC1ABFA6EDCAF
SHA-512:	AE2ACBF09EED857906811BE2984D6BF92BF2955A9FE2F9F3FFEBB6790902F5C2C870F8561CA13AD9CB7826EECA434BED7CFE7D0D2739996BACEE506D0EB730DC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guatemala) {.. {-9223372036854775808 -21724 0 LMT}.. {-1617040676 -21600 0 CST}.. {123055200 -18000 1 CDT}.. {130914000 -21600 0 CST}.. {422344800 -18000 1 CDT}.. {433054800 -21600 0 CST}.. {669708000 -18000 1 CDT}.. {684219600 -21600 0 CST}.. {1146376800 -18000 1 CDT}.. {1159678800 -21600 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Guayaquil

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.745656594295655
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2905xDm2OHHjGeoHv5laITicKpKV0EX/uFhfF/KVg:MB86290jmdHHLCv5FT/gOR/uFpF/Og
MD5:	DF661E312C6CE279CD6829120BE33CF2
SHA1:	4ACDB31E27EF9175C5452BF95F94F9BC280A237F
SHA-256:	6806AA5814BDC679C6EF653C518D2699114BE71D973F49C0864F622038DC2048
SHA-512:	04E7FD01F4DAD981EE8A02487F4A889015C41D07D6DCF420183D387E2188FF3239E345B5D65FB195CA485F5C7B4AD8CFEF51FFFC11EE0C91F0C88FF7B7EF17C1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guayaquil) {.. {-9223372036854775808 -19160 0 LMT}.. {-2524502440 -18840 0 QMT}.. {-1230749160 -18000 0 -05}.. {722926800 -14400 1 -05}.. {728884800 -18000 0 -05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Guyana

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.673559445766137
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2905R3SDm2OHRLx5oH8ZOXFxSyZ1yV/KMMdVVFAKFZ4KVR/ON:MB86290LGmdHBnC8ZODhyV/4d/OeZ4Ke
MD5:	F06C226D8D53EF8859AD91D7EBA5959C
SHA1:	E0B4E6F4ADCB10F1D79FFD928E8684FFE0C0DC5F
SHA-256:	4078D2E361D04A66F22F652E3810CDF7F630CF89399B47E4EC7B1D32B400FD85
SHA-512:	B4385650A0C69B7BD66415CC4BB9FCA854DBB1427E9F2D6C1D8CDB8CCEF9ECBD699C66A83A9AC289DABC5CDBB0A2B044E4097E9A2977AE1802B3BF6E2BB518CF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Guyana) {.. {-9223372036854775808 -13959 0 LMT}.. {-1843589241 -14400 0 -04}.. {-1730577600 -13500 0 -0345}.. {176096700 -10800 0 -03}.. {701841600 -14400 0 -04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Halifax

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11124
Entropy (8bit):	3.8106487461849885
Encrypted:	false
SSDEEP:	192:YpQamC9XD81iWQSufutTLBCN8RWnWQ7Z/xVpmtBwXiCDLxcGMe++wzlrfFj10Kvn:2kXCvNc/1/CC
MD5:	6FB9E47841FF397CE36A36C8280E2089
SHA1:	DA210300DC3D94FC3D8BA0A4531341BCA5C5936C
SHA-256:	01E11C7B07925D05E9E1876C310A2B87E0E80EF115D062225212E472B7A964F1
SHA-512:	F61B5A8A7532BBD54A4976DF17A1C6CF51BCC6DC396482FBE169C3081AF27B6CA863F0CDE3E483C59F5A5BD3365592F6984A97173C736B41D3CEEDAD4263A4E5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Halifax) {.. {-9223372036854775808 -15264 0 LMT}.. {-2131645536 -14400 0 AST}.. {-1696276800 -10800 1 ADT}.. {-1680469200 -14400 0 AST}.. {-1640980800 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-1609444800 -14400 0 AST}.. {-1566763200 -10800 1 ADT}.. {-1557090000 -14400 0 AST}.. {-1535486400 -10800 1 ADT}.. {-1524949200 -14400 0 AST}.. {-1504468800 -10800 1 ADT}.. {-1493413200 -14400 0 AST}.. {-1472414400 -10800 1 ADT}.. {-1461963600 -14400 0 AST}.. {-1440964800 -10800 1 ADT}.. {-1429390800 -14400 0 AST}.. {-1409515200 -10800 1 ADT}.. {-1396731600 -14400 0 AST}.. {-1376856000 -10800 1 ADT}.. {-1366491600 -14400 0 AST}.. {-1346616000 -10800 1 ADT}.. {-1333832400 -14400 0 AST}.. {-1313956800 -10800 1 ADT}.. {-1303678800 -14400 0 AST}.. {-1282507200 -10800 1 ADT}.. {-1272661200 -14400 0 AST}.. {-1251057600

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Havana

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8729
Entropy (8bit):	3.8227313494100867
Encrypted:	false
SSDEEP:	96:BEsWduCtQA/gF6Y3Umjm67yLb5RCzhV28I:BBWACb/gF6Y3UmjBy7
MD5:	564980AECB32F5778422EA15E8956879
SHA1:	545209C95043721C1839CCE5FEFD1A6F2DE3FE5F
SHA-256:	96B62BFBF0C05CF970245597C691F89EBF631175796459642A85287F131D0215
SHA-512:	25FE5DAA55E3466EAE1CDC73918F189403C3360D4E82D72D745FA04A374DE04F479AA9811D6154FC70CC8EA620F18035EA6A3074116806D4405936FA017CE8E6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Havana) {.. {-9223372036854775808 -19768 0 LMT}.. {-2524501832 -19776 0 HMT}.. {-1402813824 -18000 0 CST}.. {-1311534000 -14400 1 CDT}.. {-1300996800 -18000 0 CST}.. {-933534000 -14400 1 CDT}.. {-925675200 -18000 0 CST}.. {-902084400 -14400 1 CDT}.. {-893620800 -18000 0 CST}.. {-870030000 -14400 1 CDT}.. {-862171200 -18000 0 CST}.. {-775681200 -14400 1 CDT}.. {-767822400 -18000 0 CST}.. {-744231600 -14400 1 CDT}.. {-736372800 -18000 0 CST}.. {-144702000 -14400 1 CDT}.. {-134251200 -18000 0 CST}.. {-113425200 -14400 1 CDT}.. {-102542400 -18000 0 CST}.. {-86295600 -14400 1 CDT}.. {-72907200 -18000 0 CST}.. {-54154800 -14400 1 CDT}.. {-41457600 -18000 0 CST}.. {-21495600 -14400 1 CDT}.. {-5774400 -18000 0 CST}.. {9954000 -14400 1 CDT}.. {25675200 -18000 0 CST}.. {41403600 -14400 1 CDT}.. {57729600 -18000 0 CST}.. {73458000 -14400 1 CD

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Hermosillo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	616
Entropy (8bit):	4.348926042114513
Encrypted:	false
SSDEEP:	12:MB86290e2mdH5NCtXwl3UXbTMmxL+voudQCvX70qKOV9kYNv:5Ie5k9WUuwuz/Vyu
MD5:	A2192F251D5A62466AF87B90E0EC5ECF
SHA1:	F86DEC1E79FA877F50DAC1B06FEA870D3C9AA741
SHA-256:	7391A186F8DE1FDD5A61B3887E65DCDB4A2186BFD36BBFFB464B63D9775E922A
SHA-512:	AF3E5C13397C315FA7CB7EDB97510283900414A1B9A25EC9C91115D5F80267162FDD2220D8E49D57561A4B331D70706BC0A37E8BFF0D8922CD344E3A1BCCECA5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Hermosillo) {.. {-9223372036854775808 -26632 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {915174000 -25200 0 MST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indiana\Indianapolis

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7230
Entropy (8bit):	3.882344472808608
Encrypted:	false
SSDEEP:	96:nys0KHK1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:nyBKHkN0HY2iUmUFLqU
MD5:	7824B3F2D20F16A9DCC8E0F7DC45C1B8
SHA1:	77014A0502DA1342EFA41B64C5613839B627354B
SHA-256:	4B114545167326F066AB3A798180896B43AC6FDC3B80D32BCC917B5A4A2359EB
SHA-512:	03F6A18C03E79E9177D16CD7AB75AC117197638370FA675BC2854A5A563021F865F3F0672B237B83098787AB9D419AC33D67F28324B1E25AD8560B5838F70807
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Indianapolis) {.. {-9223372036854775808 -20678 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1577901600 -21600 0 CST}.. {-900259200 -18000 1 CDT}.. {-891795600 -21600 0 CST}.. {-883591200 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indiana\Knox

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8755
Entropy (8bit):	3.8394539560522585
Encrypted:	false
SSDEEP:	96:+q2KeNrdJ8SvAgahLi8hDlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:+FKUdJ8SvPaUqbA604qSBgI7DBch
MD5:	8AF080A022DA0737E94742C50EAAC62E
SHA1:	704F0565B53AA8A20F70B79A7958D4D07085E07A
SHA-256:	F1253F5F3F5AACD1A5E1F4636DD4E083F4B2A8BD995CF3E684CDD384641849F1
SHA-512:	26AAF6D24B2E2B60451E19A514533DFAEC74F01F9B1AEB9F86690669C14130D77AE1CBFB9FC9091E1CD1FC1CBC2799BB05026DB68768C3CCB960355C18D111ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Knox) {.. {-9223372036854775808 -20790 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-725824800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.. {-447267600 -21600 0 CST}.. {-431539200 -18000 1 CDT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indiana\Marengo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7273
Entropy (8bit):	3.8700915866109535
Encrypted:	false
SSDEEP:	96:7qvrv7+X1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:7Kv7+bN0HY2iUmUFLqU
MD5:	C1A10440E6CCE4C5052E2510182D9AA7
SHA1:	56D4F3CCA1245D626BADA74CF3F6BAE8034BF58D
SHA-256:	675162381639598E7100E90663D42780F8EE1CB62BD6DA5B948B494F98C02FE3
SHA-512:	96B71472AD38ECFC589F935D9F5F1C8D42C8E942D8772FB6A77F9B9C0E2BD7A07FA61729E57EC02356121518E33797A784679F8DED2FCA3FC79F5C114783DD57
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Marengo) {.. {-9223372036854775808 -20723 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-599594400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {-21488400 -14400 1 EDT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indiana\Petersburg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7611
Entropy (8bit):	3.87971256165061
Encrypted:	false
SSDEEP:	96:TqervJ8SUklggahyBRP0HY2iU7KKdFL6Aa2K4gSLf8e:TpvJ8SUklvaQN0HY2iUmUFLqU
MD5:	A86042668CD478AFFC05D3383EDEE8FF
SHA1:	6476526F94A247C0ECF3B2813F2C5A4FB93E457E
SHA-256:	23B8FA75CE0A9555DFD84549723A12679FF7FC5FAA58E4B745BA3C547071FF53
SHA-512:	07A5487A087108E6D6E88580865885CA6243EF04BE8263FC913F38CADB8EA016386E8BBAD39F65FD081F1A2F14316FEAF008855E9CF2019B169D9511916AFF67
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Petersburg) {.. {-9223372036854775808 -20947 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-473364000 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 1 CDT}.. {-257965200 -21600 0 CST}.. {-242236800 -18000 1 CDT}.. {-226515600 -21600 0 CST}.. {-210787200 -18000 1 CDT}.. {-195066000 -21600 0 CST}.. {-179337600 -18000 1 CD

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indiana\Tell_City

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7100
Entropy (8bit):	3.8613085681914607
Encrypted:	false
SSDEEP:	96:yqxrvJ8SUklLgzNA604qSScBgN+4ctDzIVQ/c/3hNxTh:yUvJ8SUkl8BA604qSBgI7DBch
MD5:	E7FE9B7CFBC6505C446056967DEBC87B
SHA1:	81ADAD89F040F62E87D2F26D1D98B3E52710F695
SHA-256:	D368123DB703B55244700876906775837D408C274C5A5801D80B77EADB6D5853
SHA-512:	9C0746DE18C80B548AA443D59BB9971BDC304975717C5FCDEBDE72828ACF408FA1D687F87C42E7B8D6D0284C9F792EA236BF79C815947BE773D07364B630AC99
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Tell_City) {.. {-9223372036854775808 -20823 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-292438800 -21600 0 CST}.. {-273686400 -18000 1 CDT}.. {-257965200 -21600 0 CST}.. {-242236800 -18000 1 CDT}.. {-226515600 -21600 0 CST}.. {-210787200 -18000 1 CDT}.. {-195066000 -21600 0 CST}.. {-179337600 -18000 0 EST

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indiana\Vevay

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6563
Entropy (8bit):	3.866646181493734
Encrypted:	false
SSDEEP:	96:juqv01BRP0HY2iU7KKdFL6Aa2K4gSLf8e:CoKN0HY2iUmUFLqU
MD5:	2CCFC3980C321ED8A852759C0BCCB12C
SHA1:	A8BFE02E4E71B28EF8E284E808F6EDE7C231F8FF
SHA-256:	0623233AA39A1A82038A56DF255ADF49E648777375B8499491C8897EBEA1CDF1
SHA-512:	A4C77689BC9BF871C756D05BAC4157F0FD324D10AC7D15F3543344C6F8C7FC9218AB7ADFBCE70C8ECCDD6EC15FD7960503FC7A8223FECE6D4227BF0BB04190C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Vevay) {.. {-9223372036854775808 -20416 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-495043200 -18000 0 EST}.. {-31518000 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {94712400 -18000 0 EST}.. {1136091600 -18000 0 EST}.. {1143961200 -14400 1 EDT}.. {1162101600 -18000 0 EST}.. {1173596400 -14400 1 EDT}.. {1194156000 -18000 0 EST}.. {1205046000 -14400 1 EDT}.. {1225605600 -18000 0 EST}.. {1236495600 -14400 1 EDT}.. {1257055200 -18000 0 EST}.. {1268550000 -144

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indiana\Vincennes

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7226
Entropy (8bit):	3.879195938909716
Encrypted:	false
SSDEEP:	96:Vq8rdJ5UklpRBRP0HY2iU7KKdFL6Aa2K4gSLf8e:VbdJ5Uklp/N0HY2iUmUFLqU
MD5:	56D1930F5FAE2456DEC6C9AB1B0233E1
SHA1:	F6ED52EF769DF2C015C181BCFF3DC0E24497C768
SHA-256:	B8452B6AA739A78AC6D03806463B03D4175639593E19FAA3CA4B0D0FB77F18C9
SHA-512:	AFCFF383DB441DA9154B639A88700D0604F487A20E830146B14061E485A991AD8DC279AF8C0C2329265CF14C901207B9058157FAA1C039082EB7630916834156
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Vincennes) {.. {-9223372036854775808 -21007 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-462996000 -18000 1 CDT}.. {-450291600 -21600 0 CST}.. {-431539200 -18000 1 CDT}.. {-418237200 -21600 0 CST}.. {-400089600 -18000 1 CDT}.. {-386787600 -21600 0 CST}.. {-368640000 -18000 1 CDT}.. {-355338000 -21600 0 CST}.. {-337190400 -18000 1 CDT}.. {-323888400 -21600 0 CST}.. {-305740800 -18000 1 CDT}.. {-289414800 -21600 0 CST}.. {-273686400 -18000 1 CDT

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indiana\Winamac

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7410
Entropy (8bit):	3.8775722319777968
Encrypted:	false
SSDEEP:	96:uq0KeKrv7c1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:unKxv7yN0HY2iUmUFLqU
MD5:	880526DC23E7BDB00506D7EC2A885907
SHA1:	DB3B13A2A4BF80E7B71C7F0604A0A80EF070B9BA
SHA-256:	4B293FDB7680C4597B8C885333719214492ECF09BD5EA342D1EC15F2BF9C8605
SHA-512:	42EEDC5EA28781D62A457F4843F38D0A3FEFCAD83BA01B07CEF0FA169C6440960E04BABD272C5E9AF2F4B0DBB2A786EF9221A48F084F16752E6D0EA66C31911E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Indiana/Winamac) {.. {-9223372036854775808 -20785 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000 1 CDT}.

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Indianapolis

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.7047837427916095
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/2903GfJ4903GK8:MByMY3GK7Kp3GKnt2903GfJ4903GK8
MD5:	DEE404D54FD707C4A27F464B5F19D135
SHA1:	AD95D04738F6B15A93DED1DE6B5FA9F47C8E38CB
SHA-256:	437DA148B94DBA4CEA402169878541DB9C3419ABAB6750D1C36625DD3053019E
SHA-512:	421D6AF30F0C64EA6CB9F9DC4E7EF9E8EE5945F81A5E82A6D959D32AD69F325770DB6A07D8F52EFE7EE7F6C3AD4E1F34AA30A6B5E006C928119A54E746D6FE6B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:America/Indianapolis) $TZData(:America/Indiana/Indianapolis)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Inuvik

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7638
Entropy (8bit):	3.8629745113156004
Encrypted:	false
SSDEEP:	96:/nGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:/GPlLv/PCenJzS6cy
MD5:	DBF9C2CCF786A593C9D6E4F4BB37ACE9
SHA1:	4D2332A530A36E6DB2802DD9FA2DAF5C0594D5EA
SHA-256:	5A1F7F5EDAD0251B73C33E7B5DDEE194646E9D3992B169DC1A64D155765D472C
SHA-512:	70D75371497CED3B6C731C95299CDD5F8F49C3C6EEDDF31EB05D008769D76ACFE8BFA9A2ECE45BD0BA2E279BBEF65945955791EFC04A569F5CAA13665CD2545F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Inuvik) {.. {-9223372036854775808 0 0 -00}.. {-536457600 -28800 0 PST}.. {-147888000 -21600 1 PDDT}.. {-131558400 -28800 0 PST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}.. {671014800 -21600 1 MDT}.. {688550400 -25200 0 MST}.. {702464400 -21600 1 MDT}.. {7200000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Iqaluit

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7671
Entropy (8bit):	3.832645570123566
Encrypted:	false
SSDEEP:	96:7FE5Ct/cQ1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:7FEct/N0HY2iUmUFLqU
MD5:	8020712BBA127EA8AB52E8F5DB14286E
SHA1:	DAEBC76FE10770D3FC2B5E1C14823B2B5543BA35
SHA-256:	AFC4627879F4A618F5E3BA9EA123F3212E161F4CCFD0DF46F3B6B7CD2E2C0D7E
SHA-512:	2F5C63F427A5DEDD5BF2B3867BE4C13774E9276C1472BF4170BCB2DA462B848CC8088743D032765133EE138388DF4217E4FC1475B12D2C8AF657A45ED6FEDE93
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Iqaluit) {.. {-9223372036854775808 0 0 -00}.. {-865296000 -14400 0 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-147898800 -10800 1 EDDT}.. {-131569200 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}.. {483519600 -14400 1 EDT}.. {499240800 -18000 0 EST}.. {514969200 -14400 1 EDT}.. {530690400 -18000 0 EST}.. {544604400 -14400 1 EDT}.. {562140000 -18000 0 EST}.. {576054000 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607503600 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638953200 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671007600 -14400 1 EDT}.. {688543200 -18000 0 EST}.. {7024

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Jamaica

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	847
Entropy (8bit):	4.206296468996689
Encrypted:	false
SSDEEP:	24:5seRvZGjFS/uk1p/uue/udYR/u+zN5hi/uW9/uoUF0/u8Bb/u33RU/uMZ8/unuR3:5jUjFo1pFGzfAYFqB43RMER3
MD5:	95B59E3EA2A270A34BDF98AA899203C8
SHA1:	93599597797F4BAFE5C75179FB795058B1E3527D
SHA-256:	4B9D5177CBA057CD53D53120A49B8A47ECCB00150018581A84851E9D5437D643
SHA-512:	032BC07F9E92B756A0732AECC2DFEC4C89A58B3D6D3CA57A0F99F2AD1D51676804C7B6CE50EB3B37BB8A1EF382168AC83989D609D37C57308E29B51F1FDEFB1E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Jamaica) {.. {-9223372036854775808 -18430 0 LMT}.. {-2524503170 -18430 0 KMT}.. {-1827687170 -18000 0 EST}.. {126248400 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {441781200 -18000 0 EST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Jujuy

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.94277888588308
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MI6HAIgp/MIwRN/290pPGe90/MIz:MByMY/Myp/M9Rt290h390/M4
MD5:	E020D4F9CB1AF91D373CD9F3C2247428
SHA1:	0ADF2E9F8D9F8641E066764BA1BAF068F0332CE9
SHA-256:	4A0495852CD4D0652B82FB57024645916DB8F192EEF9A82AFD580D87F4D496ED
SHA-512:	03190F0E7EC35A358670B1617CB5C17EA3DD41195B2C4B748479D80ABAB4DB395293F688D94B87662D0469F6C5885CF7E7C9A995493A191905753F740DF659E1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Jujuy)]} {.. LoadTimeZoneFile America/Argentina/Jujuy..}..set TZData(:America/Jujuy) $TZData(:America/Argentina/Jujuy)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Juneau

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8682
Entropy (8bit):	3.9620285142779728
Encrypted:	false
SSDEEP:	96:/fCG0rHPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:/aG0rq9DiaJCUbPI+D/iMpCIBSuk
MD5:	8160A0D27EECEF40F6F34A06D5D02BE6
SHA1:	7CAA64F83BAA0C23EE05A72BB1079AA552FA2F3D
SHA-256:	5FBE6A1FA2D3DFE23C7378E425F32BEBCA44735DA25EA075A7E5CE24BFD4049D
SHA-512:	59B8D04595007B45E582E6D17734999074CA67A93F5DF742EFE1EB78DB8ABD359D4C3B213B678C6A46040A13AAB709A994B6A532D720D3EF6FCA2730ABF4885E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Juneau) {.. {-9223372036854775808 54139 0 LMT}.. {-3225223727 -32261 0 LMT}.. {-2188954939 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {309949

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Kentucky\Louisville

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9553
Entropy (8bit):	3.853353361425414
Encrypted:	false
SSDEEP:	96:tfTwKdrdJ9+StCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:tfUKNdJ9+SItON0HY2iUmUFLqU
MD5:	D721B38F1FFF1A6F5C02B72ECC06CDE5
SHA1:	E70D99A9FC1DA9F30389129EE00FE20FA79D66A8
SHA-256:	9EB1F2B19C44A55D6CC9FD1465BAF6535856941C067831E4B5E0494665014BF5
SHA-512:	3C82A8C27026228F359FD96A4306F1BC337DE655FD1BA02C4399162E44DE59AD58CE569DA5AEA36E586C3BDEE7256420AABB84B44D277E244FE5AD771B4BE307
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Kentucky/Louisville) {.. {-9223372036854775808 -20582 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-1546279200 -21600 0 CST}.. {-1535904000 -18000 1 CDT}.. {-1525280400 -21600 0 CST}.. {-905097600 -18000 1 CDT}.. {-891795600 -21600 0 CST}.. {-883591200 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747251940 -18000 1 CDT}.. {-744224400 -21600 0 CST}.. {-620841600 -18000 1 CDT}.. {-608144400 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}.. {-463593600 -18000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Kentucky\Monticello

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8558
Entropy (8bit):	3.869494272122571
Encrypted:	false
SSDEEP:	96:4F8qMahLi8hR1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:4F8HaUqJN0HY2iUmUFLqU
MD5:	AED6497590DA305D16AC034979C8B1E9
SHA1:	AD6F1788310A3A5A761873FEF1A32416B7DBCA89
SHA-256:	1C6C7FB0AE628EB6BB305B51859C4E5594A6B0876C386ED9C1C3355E7CB37AE1
SHA-512:	58D960AB5F2D9F8E4DD0171E5E36CE2E072F74A7AFDBC43F9340BBCF0CDC0D060AC895F9FCF551F4CC7EB6DBF2E9835C8C3D58E87CA4FBC98C720F51C462EDCD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Kentucky/Monticello) {.. {-9223372036854775808 -20364 0 LMT}.. {-2717647200 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-63136800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Knox_IN

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.8670778268802195
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y73GKaHAIgp3GKIN/2901iZ903GKT:MByMY3GKDp3GKIt290Q903GKT
MD5:	50434016470AC512A8E2BEBA0BCEBC15
SHA1:	F3541F6EE201FA33C66042F5C11A26434D37D42C
SHA-256:	D66E77E6FF789D4D6CA13CDB204B977E1FE64BE9AFEE7B41F2C17ED8217FD025
SHA-512:	EB1FF97050B7E067DCB68FF7C8F912C8A0C02144BB8E2EAA58C1136C6CC4A2B98C897DD23BB1E9C82D9AF6D028EE45227F97676CB34B6B830CDF5D707B990E57
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Knox)]} {.. LoadTimeZoneFile America/Indiana/Knox..}..set TZData(:America/Knox_IN) $TZData(:America/Indiana/Knox)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Kralendijk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.9362668992592456
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/2901Qv090ppv:MByMYbpwt290ev090b
MD5:	FE9CEC6C50DF451B599B98AE8A434FF7
SHA1:	60F997825766662B2C5415FBE4D65CEA6D326537
SHA-256:	5AF9B28C48661FDC81762D249B716BA077F0A40ECF431D34A893BB7EABA57965
SHA-512:	1311605021871BAFAF321AA48B352262C6BA42149101CCD4FDD4000435B2584AC564E0F76D481BB181767C010FD922BAA4E4EBB401AC2FF27B21874D89332872
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Kralendijk) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\La_Paz

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.902526230255025
Encrypted:	false
SSDEEP:	6:SlSWB9eg/290WDm2OHphvoHvKZdcyFXmBVVON:MB86290ymdHphvCvKfcyy/ON
MD5:	3BC04900A19D0152A31B353C6715A97B
SHA1:	58A6D49E0B6FA00CBEAFD695D604D740AD63C54E
SHA-256:	5488D98AA3C29D710C6AF92C42ACE36550A5BFF78C155CDF8769EE31F71CF033
SHA-512:	65302935090F98A81443A1E1158911F57C3A1564564CD401CA72DDBF66D967DB564EF5AE8A4083D83984B9EF55AB53159010EFE2DB5D7A723F7EA61A1795322D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/La_Paz) {.. {-9223372036854775808 -16356 0 LMT}.. {-2524505244 -16356 0 CMT}.. {-1205954844 -12756 1 BST}.. {-1192307244 -14400 0 -04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Lima

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	460
Entropy (8bit):	4.2444415392593875
Encrypted:	false
SSDEEP:	12:MB86290B2mdH4VCvvCOt/Os/OCQXR/uFfC3/O3e/uFbs/OX/OqF/O+8/OOS1F5/D:59etvqOVLOR/uGD/utsg38xSP5r
MD5:	5F41E848D2DDE91261F45CB577B1B0A9
SHA1:	DF284499CF57479ADE5E1D3DC01D6DCCF6AFDFE1
SHA-256:	6E01002F264DF9A6FC247F95399F4F42DCCC7AB890B0C259DE93DCC97DEC89CE
SHA-512:	2F5472F812734E892182632B8A34A4AD7B342541D0C3F1107BD95FFBE25D9351A0CDF5F58F35A1F37365DDF8A8A5D883C89C3CC40A9AD09D54CA152DC6BE1A09
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Lima) {.. {-9223372036854775808 -18492 0 LMT}.. {-2524503108 -18516 0 LMT}.. {-1938538284 -14400 0 -05}.. {-1002052800 -18000 0 -05}.. {-986756400 -14400 1 -05}.. {-971035200 -18000 0 -05}.. {-955306800 -14400 1 -05}.. {-939585600 -18000 0 -05}.. {512712000 -18000 0 -05}.. {544248000 -18000 0 -05}.. {638942400 -18000 0 -05}.. {765172800 -18000 0 -05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Los_Angeles

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9726
Entropy (8bit):	3.8515163794355916
Encrypted:	false
SSDEEP:	192:/uX68CWSgG0U9bFzN6IkWq/WHQt/RY4yP:/uX68CWSgGVbGBt/M
MD5:	4D4F198238E4E76753411896239041C3
SHA1:	AD41D199DF0B794B5AB7F165C8A141787FAAC9A9
SHA-256:	DA3F7572F04E6AE78B8F044761E6F48D37EE259A9C1FE15A67072CC64A299FDB
SHA-512:	BA39D174B73B1D4B09E8AC07291BED0B9658A4330AE50881080F0E37C35BD8A6F55C49F1D649ED1F19CE47002435D8724048759DFC813BF9C2E9B06B581486FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Los_Angeles) {.. {-9223372036854775808 -28378 0 LMT}.. {-2717640000 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-687967140 -25200 1 PDT}.. {-662655600 -28800 0 PST}.. {-620838000 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589388400 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557938800 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526489200 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Louisville

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.911677030377383
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y71PiKp4o2HAIgp1PiKp4BvN/290hp4901PiKp44v:MByMYPyApPydt290P490Pyi
MD5:	ACE87B25FE5604C83127A9F148A34C8C
SHA1:	25C8D85B4740C53F40421D0DADCA95225EAB7829
SHA-256:	F85C1253F4C1D3E85757D3DEA4FD3C61F1AA7BE6BAAE8CB8579278412905ACB2
SHA-512:	AC0662B19F336474B146E06778E1FB43B941ABC8FD51BDB31B2640C94CCDFBE7659960EF4FD18329AFA7AD11316FC08D3CF33BB27931EA70AA7218667A8D0737
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Kentucky/Louisville)]} {.. LoadTimeZoneFile America/Kentucky/Louisville..}..set TZData(:America/Louisville) $TZData(:America/Kentucky/Louisville)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Lower_Princes

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.900350318979456
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290h48h490ppv:MByMYbpwt290/490b
MD5:	83CE86174ADB5F276AABD26FE132BB55
SHA1:	925E3F4A5DB1A2C33B3A537C8DBC9CFE309FA340
SHA-256:	1E786229B84CE86DB6316B24C85F7CF4CFE66011F973053AD0E108BFCC9A9DE2
SHA-512:	BA2AC5571D772B577735BC8E43FF8023228BC61A974DCCE0EAE20EC9B11FC757E56CABDAE00933A99834108114E598B7EC149BB017EB80BE18301A655F341A36
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Lower_Princes) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Maceio

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1539
Entropy (8bit):	3.7453889877550512
Encrypted:	false
SSDEEP:	48:5QChlvEw6kSSx5H4a8tf3fkuoLdNYVZDNR8nd:OIlvEwJSSxdF8tfMuoLdNYVZJR8nd
MD5:	EB0EDF4E075E3CF9F8EDF2B689C2FE54
SHA1:	9713D7E8AA0E7164824657D00DE6C49483D2BD19
SHA-256:	F65C5957D434A87324AAD35991E7666E426A20C40432540D9A3CB1EEE9141761
SHA-512:	0A0D1E4E0BD7D854E8F139E6F7A9BBC66422B73F7A6C2E1F1B6D2CA400B24B3D220AB519B6AEAA743443E9A4B748709CDF2C276BF52C5382669B12734A469125
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Maceio) {.. {-9223372036854775808 -8572 0 LMT}.. {-1767217028 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Managua

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	611
Entropy (8bit):	4.303621439025158
Encrypted:	false
SSDEEP:	12:MB86290znTjmdHOYCvprv5EU/dLAyW+/uF+kX8/uF+RZ//dAWcP/QAWcx/uF+rbE:5GnPeOdvhxD1pLS+S8S+RVqzo4xS+3SJ
MD5:	FB09D1F064C30F9E223FA119A8875098
SHA1:	C66173FEB21761AEA649301D77FBB77ACF3A6FB1
SHA-256:	F0F0CCE8DE92D848A62B56EF48E01D763B80153C077230C435D464CF1733BA38
SHA-512:	BC3D841FF48FD0DE7C9ABF5DAE3A42C876BD4D7FBD6684B4513EC7ECC92D938A7133BCC873AD46E453DD1863E843E5C7DD14FFDB41B593E90BEB5CD8F7E66202
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Managua) {.. {-9223372036854775808 -20708 0 LMT}.. {-2524500892 -20712 0 MMT}.. {-1121105688 -21600 0 CST}.. {105084000 -18000 0 EST}.. {161758800 -21600 0 CST}.. {290584800 -18000 1 CDT}.. {299134800 -21600 0 CST}.. {322034400 -18000 1 CDT}.. {330584400 -21600 0 CST}.. {694260000 -18000 0 EST}.. {717310800 -21600 0 CST}.. {725868000 -18000 0 EST}.. {852094800 -21600 0 CST}.. {1113112800 -18000 1 CDT}.. {1128229200 -21600 0 CST}.. {1146384000 -18000 1 CDT}.. {1159682400 -21600 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Manaus

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	3.7842934576858482
Encrypted:	false
SSDEEP:	24:5GnqeKwnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQz:5mSeSFESoSQSrSsCSeSPS1cSQSQlSsSQ
MD5:	E42719A9B0165490BB9E0E899EFB3643
SHA1:	2991D7EC31F47E32D2C8DB89A0F87D814122DD1B
SHA-256:	DC54E6D4FE14458B0462FA0E15B960FD4290930ADC0D13453BF49B436ED8C143
SHA-512:	F75024E27A2D679A667EA70EC948F983C7B823FDA5962DD88697D61147A6C2B1499E58BA8B01170653C4D025900491AE8E21925500DE39EACBAF883F7E62D874
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Manaus) {.. {-9223372036854775808 -14404 0 LMT}.. {-1767211196 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200 -1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Marigot

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.900738604616686
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290zzJ/90ppv:MByMYbpwt290zzN90b
MD5:	8C60DE8E522FE5D51EACD643FD8EA132
SHA1:	2E09A71DF340ECA6F7AEBD978070D56A627049EC
SHA-256:	5C26D7CE93F91CC4F5ED87E9388B1B180EF9D84681044FD23CC01A628A1284CA
SHA-512:	D2D522D041AFA638542F6FF00F5F40325E3F117C5035BA71F676B4956B054542C67A753055D17E2E2EEA925F13EACC0969D01EC18E40D274D8EA408F92777EA2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Marigot) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Martinique

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.849143012086458
Encrypted:	false
SSDEEP:	6:SlSWB9eg/290zlEDm2OHfueoHv9dMIqR5lRfT/VVFUFkmR/lAov:MB86290zimdHfnCv9dMIqR5lVb/uFkmD
MD5:	CFE10EE56115D3A5F44E047B3661D8ED
SHA1:	03F598CFC9AEDE2F588339B439B2361F2EBDE34F
SHA-256:	D411FB42798E93B106275EC0E054F8F3C4E9FB49431C656448739C7F20C46EDE
SHA-512:	25D6760FDF2F1B0DD91A41D29BDB7048FAE27A03F7B9D9C955ECF4C32E8402836D007B39FE62B93E7BEA017681A0C8AFC1C4CAFD823B0A6C41EDAF09DDF3435D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Martinique) {.. {-9223372036854775808 -14660 0 LMT}.. {-2524506940 -14660 0 FFMT}.. {-1851537340 -14400 0 AST}.. {323841600 -10800 1 ADT}.. {338958000 -14400 0 AST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Matamoros

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6745
Entropy (8bit):	3.842851851460931
Encrypted:	false
SSDEEP:	96:nD5NA604qSScBgN+4ctDzIVQ/c/3hNxTh:nDbA604qSBgI7DBch
MD5:	2CE5A1AA4D5AEC9B94FA980FAA0222AB
SHA1:	40838538813002C9E69F8FD244E77D4C22CF654F
SHA-256:	6738B94878D0CF4D88206858ABA03D18B0A2DE71D8F051B7D19C2C367DD59D79
SHA-512:	C6097A3EEDB0E68F3FE9E97816AF76631D0239EF843DEBA87096D8DB6B0E9787FA3820062871A9B22F58833B7B36F51F25B738AD671A21665BE49EAD71CC17F6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Matamoros) {.. {-9223372036854775808 -24000 0 LMT}.. {-1514743200 -21600 0 CST}.. {568015200 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {599637600 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Mazatlan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6841
Entropy (8bit):	3.872535525478649
Encrypted:	false
SSDEEP:	96:WNG1GK5+yBEzg4GaaECHm3FL5TInckNSNi:/5+yBEzVWEaOkv
MD5:	CBCB4A9A77EE76C16C8EC9DDD3231ABC
SHA1:	270B2C3C8F5A2EFD47E4DFA22521E36CEFD5A774
SHA-256:	F1E4E853758A3D79013D5B24AE45FDFD41A7C110949A5C5DB96CF14B479FA741
SHA-512:	F64FFDA679E360E50C95DFA45CE866E51DC87B440E984CCABDD57E2C1C3F2FAD44256AE44FAA84E0F577B22CD1A80F891E14BF811D6D83ADA9B19DE32692175F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Mazatlan) {.. {-9223372036854775808 -25540 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-873828000 -25200 0 MST}.. {-661539600 -28800 0 PST}.. {28800 -25200 0 MST}.. {828867600 -21600 1 MDT}.. {846403200 -25200 0 MST}.. {860317200 -21600 1 MDT}.. {877852800 -25200 0 MST}.. {891766800 -21600 1 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -2520

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Mendoza

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.812188311941308
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MeHAIgp/MSvYovN/290zpH+90/MX:MByMY/M/p/MSA6t290zpe90/MX
MD5:	2A3BFEEFBB684FB3B420A6B53B588BDC
SHA1:	CC5C0BB90D847CCBB45688A8DA460AD575D64617
SHA-256:	D6B308A1619F2DE450DACBFEF0E11B237DF7375A80C90899DD02B827688CB4B8
SHA-512:	4A35C80D3454E039383FFEB06DC84933B3201BE2487C42A448AF3DA5ABAEEB9882263C011CDD3194E121EC1C31FC80120BF7829F280A79996E376CFA828EE215
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Mendoza)]} {.. LoadTimeZoneFile America/Argentina/Mendoza..}..set TZData(:America/Mendoza) $TZData(:America/Argentina/Mendoza)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Menominee

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.8311875423131534
Encrypted:	false
SSDEEP:	96:6quShLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:6lSUqtfA604qSBgI7DBch
MD5:	C74D31382279219F805D2B138C58FBF7
SHA1:	06E2FED0A3BDF62F3D390A4054B6A2D7C1863DD3
SHA-256:	B0863F8B66F0848020651B69E7997307D62209259AE653FDC1A0FAFC8E793068
SHA-512:	7B42CBDC119651E2B2EE8B8F934801D3147A8B72EE060A0D0EA1C0C12CA9ABD03F1A102A85BF8E7424B45620151CE107D16A9173F4AA7597EDB3109840C1B2AE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Menominee) {.. {-9223372036854775808 -21027 0 LMT}.. {-2659759773 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-757360800 -21600 0 CST}.. {-747244800 -18000 1 CDT}.. {-733942800 -21600 0 CST}.. {-116438400 -18000 1 CDT}.. {-100112400 -21600 0 CST}.. {-21484800 -18000 0 EST}.. {104914800 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200 -18000 1 CDT}.. {278492400 -21600 0 CST}.. {294220800 -18000 1 CDT}.. {309942000 -2160

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Merida

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6651
Entropy (8bit):	3.8421369120684714
Encrypted:	false
SSDEEP:	48:5bu36fELf0On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAqy6:1qehpYtpjyrz7nKED4KPddGEYA/Gx
MD5:	BEA04423DB05D122622807857EFD2B36
SHA1:	EE2A2AB89DFFFE2880801E8667AF2AD627E641EC
SHA-256:	2B4FACFC69A195C646842A8B47AFE76D755CEEDAD536DEE7ECE79302BAF97223
SHA-512:	D860332F4A50F886600E9DCF3F0ACA6CC6FAD1421ECCAF0E67D0CB76F5FBFA1DC0F243F0B312A3CFB0614BD76C6A76C45E5C6F582073B23FEC4B72E77950E2EC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Merida) {.. {-9223372036854775808 -21508 0 LMT}.. {-1514743200 -21600 0 CST}.. {377935200 -18000 0 EST}.. {407653200 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0 CST}.. {1207468800 -18000 1 CDT}.. {1225004400 -21600 0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Metlakatla

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6705
Entropy (8bit):	3.985641709481311
Encrypted:	false
SSDEEP:	96:4DCG0haiaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:42G0IiaJCUbPI+D/iMpCIBSuk
MD5:	4999FE49C1640402CB432BC1EB667479
SHA1:	2ED0044927A66856090793ED6E5FF634617C8C40
SHA-256:	2574831391092AD44D7B2806EEF30D59CE3BAE872111917DD39EC51EFDD62E5F
SHA-512:	39DE1D24037F3FFA3101BBAA885939074E596479F68013CDA9CE53A061EA704F63FB55C15B68B66B0E29E3F07ADC0BDC2D78A2D289277E75D2EF95F54988DB74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Metlakatla) {.. {-9223372036854775808 54822 0 LMT}.. {-3225223727 -31578 0 LMT}.. {-2188955622 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {30

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Mexico_City

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7035
Entropy (8bit):	3.8457960083650584
Encrypted:	false
SSDEEP:	48:5CBU/UI+n36fELf5On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10B:EBNqehpYtpjyrz7nKED4KPddGEYA/Gx
MD5:	8688CD1F2C071314E56666D70DAD8261
SHA1:	32F9C882D148BB9568F719099B3DCE25B53FB43C
SHA-256:	3458EAF721C1CDF565B5ADDB487B4F1B93FA46744E9E5FC91D74787173B233A4
SHA-512:	02A110943B2458DA20BC6D2568B19819B4831DAAD6968EC9D1A523DD81D5499AB21630F865C9CF70AEBE54D39CE72A0F833B91492E694F3117E32E06432F30DB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Mexico_City) {.. {-9223372036854775808 -23796 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {-975261600 -18000 1 CDT}.. {-963169200 -21600 0 CST}.. {-917114400 -18000 1 CDT}.. {-907354800 -21600 0 CST}.. {-821901600 -18000 1 CWT}.. {-810068400 -21600 0 CST}.. {-627501600 -18000 1 CDT}.. {-612990000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001836800 -21600 0 CST}.. {1014184800 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {10357020

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Miquelon

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7080
Entropy (8bit):	3.5379714312244217
Encrypted:	false
SSDEEP:	192:2UViR+iORv7bw1aW5AnMyxH5e+fHbxMfOp6D7bF8qMmqyiqV1mjZe7JhlgXY7FWN:02l5qJZS
MD5:	C68889AA813C399939FCFA54E9CE0DFB
SHA1:	F3D58D7BEFF2D1CB94FECE00C31FEF5BDF58C231
SHA-256:	1B131AC968F95652667BD7EB1F6D667C8F679B31270D82B4B4271E787386CCCA
SHA-512:	EBAF8210919E34668E9DDFCB546E5A62F35954957AAE956B6302BF296C7D4CF51E1B10FB13217CB3EEB430DAC246217EB4E9250CB4109C95D8A4367457D02771
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Miquelon) {.. {-9223372036854775808 -13480 0 LMT}.. {-1850328920 -14400 0 AST}.. {326001600 -10800 0 -03}.. {536468400 -10800 0 -02}.. {544597200 -7200 1 -02}.. {562132800 -10800 0 -02}.. {576046800 -7200 1 -02}.. {594187200 -10800 0 -02}.. {607496400 -7200 1 -02}.. {625636800 -10800 0 -02}.. {638946000 -7200 1 -02}.. {657086400 -10800 0 -02}.. {671000400 -7200 1 -02}.. {688536000 -10800 0 -02}.. {702450000 -7200 1 -02}.. {719985600 -10800 0 -02}.. {733899600 -7200 1 -02}.. {752040000 -10800 0 -02}.. {765349200 -7200 1 -02}.. {783489600 -10800 0 -02}.. {796798800 -7200 1 -02}.. {814939200 -10800 0 -02}.. {828853200 -7200 1 -02}.. {846388800 -10800 0 -02}.. {860302800 -7200 1 -02}.. {877838400 -10800 0 -02}.. {891752400 -7200 1 -02}.. {909288000 -10800 0 -02}.. {923202000 -7200 1 -02}.. {941342400 -10800 0 -02}.. {954651600 -7200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Moncton

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10507
Entropy (8bit):	3.8204583916930557
Encrypted:	false
SSDEEP:	192:X9+FPHyXFRsivcQYM+T7Z/xVQzxmtBWIXrObx29x8sLxcGMe++wzlrfFjxKvnpNM:gF6L0d0F2TzNc/1cYUH+CC
MD5:	80B88F57B837CD2478815796618A6AC6
SHA1:	CC2BE0213E9F0D3B307A8311D7A1013582E8A338
SHA-256:	D977D045DE5CDAEB41189B91963E03EF845CA4B45E496649B4CB541EE1B5DD22
SHA-512:	9410CBD706CAABFFF88DFF75235597D844B45A061EBD796F6708D7CEAB680273571A17935B7CCFC7C466ABF293C286D0886F47880E692F74C4E8BFB41729C73C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Moncton) {.. {-9223372036854775808 -15548 0 LMT}.. {-2715882052 -18000 0 EST}.. {-2131642800 -14400 0 AST}.. {-1632074400 -10800 1 ADT}.. {-1615143600 -14400 0 AST}.. {-1167595200 -14400 0 AST}.. {-1153681200 -10800 1 ADT}.. {-1145822400 -14400 0 AST}.. {-1122231600 -10800 1 ADT}.. {-1114372800 -14400 0 AST}.. {-1090782000 -10800 1 ADT}.. {-1082923200 -14400 0 AST}.. {-1059332400 -10800 1 ADT}.. {-1051473600 -14400 0 AST}.. {-1027882800 -10800 1 ADT}.. {-1020024000 -14400 0 AST}.. {-996433200 -10800 1 ADT}.. {-988574400 -14400 0 AST}.. {-965674800 -10800 1 ADT}.. {-955396800 -14400 0 AST}.. {-934743600 -10800 1 ADT}.. {-923947200 -14400 0 AST}.. {-904503600 -10800 1 ADT}.. {-891892800 -14400 0 AST}.. {-883598400 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-757368000 -14400 0 AST

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Monterrey

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6714
Entropy (8bit):	3.843663571428462
Encrypted:	false
SSDEEP:	48:5JZKy36fELf0On9uhcinzPPoUlWQnH7eelN5Lh9LY5LpfLyZ3Moonskfm10qNKAO:XwDqehpYtpjyrz7nKED4KPddGEYA/Gx
MD5:	7BAF644224F6045B791D64A3AA41B515
SHA1:	FCB940F91B8A7AE599433460C27953890FA38F27
SHA-256:	63813975BC90A2AE8A6500D7A3173A3C81C060F8B5AAA3E86D5FDC4D5F06ABD8
SHA-512:	F2DD85E8F1875274A6ACD3B9F90869ABA0539CFD564DC7DEA490AE3B7DC66B83D6F76EC3F1389FD3DFC111E5A198B7AB9AEE54CCE9A3B9C6871BE0DB211FEB76
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Monterrey) {.. {-9223372036854775808 -24076 0 LMT}.. {-1514743200 -21600 0 CST}.. {568015200 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {599637600 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {891763200 -18000 1 CDT}.. {909298800 -21600 0 CST}.. {923212800 -18000 1 CDT}.. {941353200 -21600 0 CST}.. {954662400 -18000 1 CDT}.. {972802800 -21600 0 CST}.. {989136000 -18000 1 CDT}.. {1001833200 -21600 0 CST}.. {1018166400 -18000 1 CDT}.. {1035702000 -21600 0 CST}.. {1049616000 -18000 1 CDT}.. {1067151600 -21600 0 CST}.. {1081065600 -18000 1 CDT}.. {1099206000 -21600 0 CST}.. {1112515200 -18000 1 CDT}.. {1130655600 -21600 0 CST}.. {1143964800 -18000 1 CDT}.. {1162105200 -21600 0 CST}.. {1175414400 -18000 1 CDT}.. {1193554800 -21600 0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Montevideo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2936
Entropy (8bit):	3.6410670126139046
Encrypted:	false
SSDEEP:	48:5JgQkS4SaEcSyS0sZSUS2kSVSXSulSASX5kAXJMsCXrUari3akaWCa3M+lafpI6L:X5kH4c9GT0E01jm5keJMRXrUEi3akaWO
MD5:	D78DEBC7C0B15B31635DDC34C49248BC
SHA1:	DB2FF76DB3A79BE52E2DFD4C7B8B6592946772F9
SHA-256:	214F97A3BCB2378CCE23D280EA6A3B691604F82E383628F666BE585BB8494932
SHA-512:	E5FCD0B54F61910E70B1D0EE9911C5B4AFF850F16B651A01D69A63A97880913B0BAB99B0D864C4E613594734FA72CCA0E9607B1ADB6E75957C790990114FD0A4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Montevideo) {.. {-9223372036854775808 -13491 0 LMT}.. {-1942690509 -13491 0 MMT}.. {-1567455309 -14400 0 -04}.. {-1459627200 -10800 0 -0330}.. {-1443819600 -12600 0 -0330}.. {-1428006600 -10800 1 -0330}.. {-1412283600 -12600 0 -0330}.. {-1396470600 -10800 1 -0330}.. {-1380747600 -12600 0 -0330}.. {-1141590600 -10800 1 -0330}.. {-1128286800 -12600 0 -0330}.. {-1110141000 -10800 1 -0330}.. {-1096837200 -12600 0 -0330}.. {-1078691400 -10800 1 -0330}.. {-1065387600 -12600 0 -0330}.. {-1047241800 -10800 1 -0330}.. {-1033938000 -12600 0 -0330}.. {-1015187400 -10800 1 -0330}.. {-1002488400 -12600 0 -0330}.. {-983737800 -10800 1 -0330}.. {-971038800 -12600 0 -0330}.. {-954707400 -10800 1 -0330}.. {-938984400 -12600 0 -0330}.. {-920838600 -10800 1 -0330}.. {-907534800 -12600 0 -0330}.. {-896819400 -10800 1 -0330}.. {-853621200 -9000 0 -03}.. {-84

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Montreal

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.748877320903638
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEzQ21h4IAcH:SlSWB9vsM3y7RQtHAIgpRQPN/290zQgp
MD5:	9130CD86BD6417DB877BF9D8F3080CE1
SHA1:	76C37982C37FE54ED539AC14B5A513817E42937C
SHA-256:	97F48948EF5108FE1F42D548EA47C88D4B51BF1896EE92634C7ED55555B06DBD
SHA-512:	EE036350AF95414392BD93DFF528F67D9A93EB192A30056ECBC3D2396AB4B2938B3C096C3EC2BC739294D4C4B7261C427B0AAEB9559F5381CB7F375892781820
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Montreal) $TZData(:America/Toronto)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Montserrat

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.878534808314885
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290zQ1HK90ppv:MByMYbpwt290zQ490b
MD5:	CB5988A2508285B42C2BD487B8F9D6E1
SHA1:	EAD740A566245B682CE5E284D389DFAE66DF05D9
SHA-256:	6C3EE46983A3DAA91C9ADF4B18D6B4B80F1505B0057569B66D5B465D4C09B9C1
SHA-512:	48796213A67F0E3BC56B54CE4D8BE098E74BA5808C9A1082D9381CB729ADFA2ACB9CE9E39A3244B3901405761C97AEE28D44C3BF7239ECC71175C62E152029C4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Montserrat) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Nassau

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.785765433607229
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/2IAcGEwEzEeIAcGu:SlSWB9vsM3y7RQtHAIgpRQPN/290xzEf
MD5:	F7DAD684104D917E0F29F6951EA627AC
SHA1:	E57B5CA730D90C5865CF32FEC4872F71E033D21C
SHA-256:	A889810B8BB42CD206D8F8961164AD03CCFBB1924D583075489F78AFA10EAF67
SHA-512:	8284F2A357A32B2F5A211904F65E3B5C37B77C9BF38C85DFA0A95A73457F3076EC12F09BC767B4D0B8FC86BF69D01A17A7BF685BAB72F3E519A397D050DA0C3B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:America/Nassau) $TZData(:America/Toronto)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\New_York

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11373
Entropy (8bit):	3.8110553140357086
Encrypted:	false
SSDEEP:	96:HeohzORhK1a8phYvNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:+uORhK1a8phYloSItON0HY2iUmUFLqU
MD5:	385C3BDD3E41E5E75CEF0658322B5CDE
SHA1:	0334C21C8316ED2EE16FC98B1E8867D5E0916C00
SHA-256:	7BA7DA179AA7DF26AC25E7ACCD9BD83784174445285A0D9CCBD7D6A9AA34F4BC
SHA-512:	764B680FB8414B5AC8FB110247C19B1004A4453DD2BAC94BF3CFD80281FF3679A5B1D212238509165E022269503ED14A54B0EF73AF7014344752E6A627657D1F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/New_York) {.. {-9223372036854775808 -17762 0 LMT}.. {-2717650800 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-1577905200 -18000 0 EST}.. {-1570381200 -14400 1 EDT}.. {-1551636000 -18000 0 EST}.. {-1536512400 -14400 1 EDT}.. {-1523210400 -18000 0 EST}.. {-1504458000 -14400 1 EDT}.. {-1491760800 -18000 0 EST}.. {-1473008400 -14400 1 EDT}.. {-1459706400 -18000 0 EST}.. {-1441558800 -14400 1 EDT}.. {-1428256800 -18000 0 EST}.. {-1410109200 -14400 1 EDT}.. {-1396807200 -18000 0 EST}.. {-1378659600 -14400 1 EDT}.. {-1365357600 -18000 0 EST}.. {-1347210000 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-123895440

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Nipigon

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8100
Entropy (8bit):	3.8314265228376105
Encrypted:	false
SSDEEP:	96:xhZ8gEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:xAgEItON0HY2iUmUFLqU
MD5:	54722EA33AAC411AA1D51D5E00423937
SHA1:	C6D1E5EAC6A72CCE738E465C8AA32CC76FD1DDC7
SHA-256:	BB4BA3C15C626F6F94AC026A7C3D5DFE3854B17CBFA3F540FFAFFD9D5B491083
SHA-512:	E66F7C2AEFB483526A7F11292B4F5E9C972DB12BAEF42110A45C49DCA5EA1DA2482A9FACA223D9F543F5ABE92CC54311ADA1852332DB184AE49CCFCED8D9405C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nipigon) {.. {-9223372036854775808 -21184 0 LMT}.. {-2366734016 -18000 0 EST}.. {-1632070800 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-923252400 -14400 1 EDT}.. {-880218000 -14400 0 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {136364400 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {167814000 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {357116400 -14400 1 EDT}.. {372837600 -18000 0 EST}.. {388566000 -14400 1 EDT}.. {404892000 -18000 0 EST}.. {420015600 -14400 1 EDT}.. {436341600 -18000 0 EST}.. {452070000 -14400 1 EDT}.. {467791200 -18000 0 EST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Nome

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8680
Entropy (8bit):	3.965662913874442
Encrypted:	false
SSDEEP:	96:OrBvOs5vzC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:OrBvOsM9DiaJCUbPI+D/iMpCIBSuk
MD5:	9A5F536932FED5A93E2C3DEB81960CD1
SHA1:	8E78396D280DD3A9564CEFC7FB722437F3C4D003
SHA-256:	8E971C9560CCE548B46626D072E62AB0F4C9682BF6A6ABFB4D0E8D63745402FE
SHA-512:	60CFDBCE87F9CD7F27E071D66B97E60F62E56F413DC867BC809490B30D00045D0757710D6B5724148E2A28BD1E45FB662391820E6350D998002BF67B16776645
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nome) {.. {-9223372036854775808 46702 0 LMT}.. {-3225223727 -39698 0 LMT}.. {-2188947502 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Noronha

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	3.78056049136398
Encrypted:	false
SSDEEP:	24:5TenykFxCFbF3YCFE2FBCFDFr9CFaFPBCFoF2CFTFKCFDuF1CF2F1CFWFhCFGF3a:5quY9EmFYBosNZNW/bWsBzgCccq7JYN9
MD5:	B4F4530FCE4BF5690042A2DA40413D56
SHA1:	52D5F2102485F5B326C888A287ED83CA18833BBC
SHA-256:	9011C76295E6B17CC1973876B497BEE21B9E6562FB25DF66140F811A1FFA9765
SHA-512:	08CAF75226D190D9FF0AA62AD84B13F1BF9047338A690847DF5B448BDB731A877F3E186298AFD704F4F4E133FF3F3128B098F9D90AE9A8E726AE52F84A7DA2E3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Noronha) {.. {-9223372036854775808 -7780 0 LMT}.. {-1767217820 -7200 0 -02}.. {-1206961200 -3600 1 -02}.. {-1191366000 -7200 0 -02}.. {-1175378400 -3600 1 -02}.. {-1159830000 -7200 0 -02}.. {-633823200 -3600 1 -02}.. {-622072800 -7200 0 -02}.. {-602287200 -3600 1 -02}.. {-591836400 -7200 0 -02}.. {-570751200 -3600 1 -02}.. {-560214000 -7200 0 -02}.. {-539128800 -3600 1 -02}.. {-531356400 -7200 0 -02}.. {-191368800 -3600 1 -02}.. {-184201200 -7200 0 -02}.. {-155167200 -3600 1 -02}.. {-150073200 -7200 0 -02}.. {-128901600 -3600 1 -02}.. {-121129200 -7200 0 -02}.. {-99957600 -3600 1 -02}.. {-89593200 -7200 0 -02}.. {-68421600 -3600 1 -02}.. {-57970800 -7200 0 -02}.. {499744800 -3600 1 -02}.. {511232400 -7200 0 -02}.. {530589600 -3600 1 -02}.. {540262800 -7200 0 -02}.. {562125600 -3600 1 -02}.. {571194000 -7200 0 -02}.. {592970400 -

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\North_Dakota\Beulah

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8557
Entropy (8bit):	3.8810445182855253
Encrypted:	false
SSDEEP:	96:WEktwmGaLV911sF9A604qSScBgN+4ctDzIVQ/c/3hNxTh:WBwDPPA604qSBgI7DBch
MD5:	10AF9E9461DD03DA4F0AF0595EB36E6C
SHA1:	57AC9BDE3AC665E49D9D2463A4BFA38C053A4A54
SHA-256:	D0D8B108453265B60F525A4EC04DE9555087CD6AC5DDBA980B3A96CF0FCD68D1
SHA-512:	B6DC7D2709A19B911E086C988DB8346F42DBF7601D9E51E3093C6AF897570E43E5F1C101FE88BC5251F3DCC3B532DB22FFE8A12A4D0151BC52AF3E6DDEA7D23A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/Beulah) {.. {-9223372036854775808 -24427 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\North_Dakota\Center

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8557
Entropy (8bit):	3.867423227197841
Encrypted:	false
SSDEEP:	96:ZEktwmGaLV9tZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:ZBwD6fA604qSBgI7DBch
MD5:	33C03AD65753D7ADB45FC4899B504D1A
SHA1:	ED719BB67A64DB49901BA38A945A6BA998646B8D
SHA-256:	ABC2B6C97D9E9FBA37AC582ADBA2CE996890D090060E083405D75CDAED9EABE0
SHA-512:	69592E8A370C8A5173827500CDDF8190AB44EA87CD7E0C416055CB7958B13A737801EA6B0FFE6032CB3F14F05001BF9DA83E4AEB20F385019B2985ECE7ACB40E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/Center) {.. {-9223372036854775808 -24312 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\North_Dakota\New_Salem

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8560
Entropy (8bit):	3.879452555978431
Encrypted:	false
SSDEEP:	96:GEktwmGaLV9nlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:GBwD2fA604qSBgI7DBch
MD5:	3D3DC12209293086FD843738A4FE87FB
SHA1:	8103DFA18B5F3F36AF0B53FA350E0F2D300E6289
SHA-256:	8803FF7C81C933B57178B9D3C502FB4268D9AA594A3C638A7F17AF60B12D300D
SHA-512:	39BB939780A71B817F82D2B7F56815D33926D150525161051A9950E5A98BA9184670AFC884A1C69D56EADBD6198E3082975448EFBA5FE8A336DB071E6BAB8EF2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/North_Dakota/New_Salem) {.. {-9223372036854775808 -24339 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -2160

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Nuuk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7429
Entropy (8bit):	3.5470060859729253
Encrypted:	false
SSDEEP:	192:0ixKXpbzvZ+FxAqe12voJ0euJFNgIHc/QEeF5Z1V8tCSfifK3facfzQWWLQelXuC:0LRJq9LstgV
MD5:	FC9CEA4B9654D0957F55CB0E1B25A3E7
SHA1:	8BFC3E8CEC34C4087579D3DA727143E3EC045B77
SHA-256:	12917DAAA60134BFE56E6979BB27B58A3F295C32BAE02B233E849BCED6B8BCA2
SHA-512:	355628F2EFF86605653A1EE7D976CE8B3229A4169D35576F6007FABAB37DD280D8F296EE88BECE3D84D3A1C476F23275D1D77CAF157E9A98672CBF14801D7292
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Nuuk) {.. {-9223372036854775808 -12416 0 LMT}.. {-1686083584 -10800 0 -03}.. {323845200 -7200 0 -02}.. {338950800 -10800 0 -03}.. {354675600 -7200 1 -02}.. {370400400 -10800 0 -03}.. {386125200 -7200 1 -02}.. {401850000 -10800 0 -03}.. {417574800 -7200 1 -02}.. {433299600 -10800 0 -03}.. {449024400 -7200 1 -02}.. {465354000 -10800 0 -03}.. {481078800 -7200 1 -02}.. {496803600 -10800 0 -03}.. {512528400 -7200 1 -02}.. {528253200 -10800 0 -03}.. {543978000 -7200 1 -02}.. {559702800 -10800 0 -03}.. {575427600 -7200 1 -02}.. {591152400 -10800 0 -03}.. {606877200 -7200 1 -02}.. {622602000 -10800 0 -03}.. {638326800 -7200 1 -02}.. {654656400 -10800 0 -03}.. {670381200 -7200 1 -02}.. {686106000 -10800 0 -03}.. {701830800 -7200 1 -02}.. {717555600 -10800 0 -03}.. {733280400 -7200 1 -02}.. {749005200 -10800 0 -03}.. {764730000 -7200 1 -0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Ojinaga

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6843
Entropy (8bit):	3.877923791759769
Encrypted:	false
SSDEEP:	48:5gUq33FS1YluOQiLvf3PCeq5r3xod8CzSP2IZ5Sy4DLbrc6HiviVN:So1c7Lv/PCewtA8CzSPyDLbrcUia
MD5:	32BDE9C2C59F2A34D3B9F98BC9894A99
SHA1:	04A24DC4A3C2A0D7C9C8E0001E320662778A78BF
SHA-256:	549E92BDEC98D21C5C4A996F954671A2F0262463415BF294D122500246309BC4
SHA-512:	A33E583EC5B2B274C4247C109F37F9A4495ED9094849F6A8E68145EBF6A1906B3DD0B31BB7690261FEDA9C72F2288F4D1121365F544B9EC1343E208B472D0660
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Ojinaga) {.. {-9223372036854775808 -25060 0 LMT}.. {-1514739600 -25200 0 MST}.. {-1343066400 -21600 0 CST}.. {-1234807200 -25200 0 MST}.. {-1220292000 -21600 0 CST}.. {-1207159200 -25200 0 MST}.. {-1191344400 -21600 0 CST}.. {820476000 -21600 0 CST}.. {828864000 -18000 1 CDT}.. {846399600 -21600 0 CST}.. {860313600 -18000 1 CDT}.. {877849200 -21600 0 CST}.. {883634400 -21600 0 CST}.. {891766800 -21600 0 MDT}.. {909302400 -25200 0 MST}.. {923216400 -21600 1 MDT}.. {941356800 -25200 0 MST}.. {954666000 -21600 1 MDT}.. {972806400 -25200 0 MST}.. {989139600 -21600 1 MDT}.. {1001836800 -25200 0 MST}.. {1018170000 -21600 1 MDT}.. {1035705600 -25200 0 MST}.. {1049619600 -21600 1 MDT}.. {1067155200 -25200 0 MST}.. {1081069200 -21600 1 MDT}.. {1099209600 -25200 0 MST}.. {1112518800 -21600 1 MDT}.. {1130659200 -25200 0 MST}.. {1143968400 -21

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Panama

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.970379147398626
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2IAcGEu5YfMXGm2OHGf8xYoHv5BidhZvFsc1HRX1va0v:SlSWB9eg/290ZDm2OHDxYoHv5GhZd93p
MD5:	AA408A43079EC8933DE271BE3DA2B502
SHA1:	421A867DB3FD4779C5F759D0B657D8EB5FB2218B
SHA-256:	990213DDE00ADCEB74C8D1ECAF81B9C77963E4AB1F35767F7349236FC8E917DF
SHA-512:	1FB740527555A8E128E05709D05720A249BCBA4B6434D00226C07426E6283AA48973F75268F36E6044F0F0650E012781C8E5519B7EA916C625BBF018B29E9961
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Panama) {.. {-9223372036854775808 -19088 0 LMT}.. {-2524502512 -19176 0 CMT}.. {-1946918424 -18000 0 EST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Pangnirtung

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7736
Entropy (8bit):	3.8533019559841972
Encrypted:	false
SSDEEP:	192:tTqPm4bPJWXtRbALtuO/N0HY2iUmUFLqU:Izod
MD5:	6BA298F9CEB6406802A01C13313F8EF1
SHA1:	D77C113CFA927EF65461781FD080F590C8CFCBB9
SHA-256:	1FB962ECC1E5F02E1001C70460FFF720B114554F9AA7956D6DA154DBEA87B4D7
SHA-512:	C7F4E2DA503A3167098CFAB7AEC8D75A32D6B081E6777DE7BA3D6B4558D0C44D2CD8A0F1626968295031BABFD2CB96B031B4C00A44F2C554B5B217AE67E69EB4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Pangnirtung) {.. {-9223372036854775808 0 0 -00}.. {-1546300800 -14400 0 AST}.. {-880221600 -10800 1 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-147902400 -7200 1 ADDT}.. {-131572800 -14400 0 AST}.. {325663200 -10800 1 ADT}.. {341384400 -14400 0 AST}.. {357112800 -10800 1 ADT}.. {372834000 -14400 0 AST}.. {388562400 -10800 1 ADT}.. {404888400 -14400 0 AST}.. {420012000 -10800 1 ADT}.. {436338000 -14400 0 AST}.. {452066400 -10800 1 ADT}.. {467787600 -14400 0 AST}.. {483516000 -10800 1 ADT}.. {499237200 -14400 0 AST}.. {514965600 -10800 1 ADT}.. {530686800 -14400 0 AST}.. {544600800 -10800 1 ADT}.. {562136400 -14400 0 AST}.. {576050400 -10800 1 ADT}.. {594190800 -14400 0 AST}.. {607500000 -10800 1 ADT}.. {625640400 -14400 0 AST}.. {638949600 -10800 1 ADT}.. {657090000 -14400 0 AST}.. {671004000 -10800 1 ADT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Paramaribo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	253
Entropy (8bit):	4.784405839512086
Encrypted:	false
SSDEEP:	6:SlSWB9eg/290olofDm2OHekeoHXFIV/1Vw/9vVOzFZg/VVFAKV:MB86290oloLmdHeVCXqV/k/9v4zW/OW
MD5:	BFCE7E2618D6935031D6941AD6DDD8E3
SHA1:	1953CD224FB2363B10372C0476760F3FB020CB00
SHA-256:	B3EE44B3526BEDFC25B806371D3C465FDBD6CC647F30BF093750651E4A0C1BE4
SHA-512:	31262DF034E084DA4CDB57B99178594C29129F61F3535E5D8245B8BB4AB6BF314307B0F5E58B74C349684CD761C9CDE44EB10407FB135BA6427D3D1E9DA99B40
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Paramaribo) {.. {-9223372036854775808 -13240 0 LMT}.. {-1861906760 -13252 0 PMT}.. {-1104524348 -13236 0 PMT}.. {-765317964 -12600 0 -0330}.. {465449400 -10800 0 -03}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Phoenix

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	496
Entropy (8bit):	4.444598497301421
Encrypted:	false
SSDEEP:	12:MB86290OXmdH514YCvb8o1W4S9xRvhhHRVxORBYUNv:5tekdvYP1x52yq
MD5:	062ECA57C0B795780240CD7AFE70BDA0
SHA1:	89D71A11DD8D4E000F7FADBDDC77C4C1DC1195F7
SHA-256:	DFA0EC91804B789A1A7E1B1977710435D2589A5B54C1579C8E1F5BF96D2FD007
SHA-512:	7D123AA872E0B8286A26E338AE0F8E0D7A6F0F2EA8B1EBEC6DBB59477C812985CB246AD397D0901A58FDB7FF14171CF60169DC15C538B95C58BD2D46106A7A4D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Phoenix) {.. {-9223372036854775808 -26898 0 LMT}.. {-2717643600 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-820519140 -25200 0 MST}.. {-796841940 -25200 0 MST}.. {-94669200 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-56221200 -25200 0 MST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Port-au-Prince

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6613
Entropy (8bit):	3.8549788442269395
Encrypted:	false
SSDEEP:	48:5Ux+E2p3T6ZqrNSMEBPMcywh4NF5zCC7IOTWa1HW1241UWK9BDL+3XC4BMrS2LxP:KOfS0HY2iU7KKdFL6Aa2K4gSLf8e
MD5:	A720323DF122C70C1530788DB24700BA
SHA1:	20674BD7D84CC686ABBB5D6B36B520A5E9C813ED
SHA-256:	A89C580899AD2FF8DF45A783BB90D501DC32C28B92931CA18ABD13453E76244B
SHA-512:	02B71E537B9FDAF1B68E381F0007CCBBA53EB70719ED38F51B56C5BFA64C7E3D9797053C9DE3A920E5CAFA09BBC062FCED62B5D6B9213AFA8286B95DEDAB0532
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Port-au-Prince) {.. {-9223372036854775808 -17360 0 LMT}.. {-2524504240 -17340 0 PPMT}.. {-1670483460 -18000 0 EST}.. {421218000 -14400 1 EDT}.. {436334400 -18000 0 EST}.. {452062800 -14400 1 EDT}.. {467784000 -18000 0 EST}.. {483512400 -14400 1 EDT}.. {499233600 -18000 0 EST}.. {514962000 -14400 1 EDT}.. {530683200 -18000 0 EST}.. {546411600 -14400 1 EDT}.. {562132800 -18000 0 EST}.. {576050400 -14400 1 EDT}.. {594194400 -18000 0 EST}.. {607500000 -14400 1 EDT}.. {625644000 -18000 0 EST}.. {638949600 -14400 1 EDT}.. {657093600 -18000 0 EST}.. {671004000 -14400 1 EDT}.. {688543200 -18000 0 EST}.. {702453600 -14400 1 EDT}.. {719992800 -18000 0 EST}.. {733903200 -14400 1 EDT}.. {752047200 -18000 0 EST}.. {765352800 -14400 1 EDT}.. {783496800 -18000 0 EST}.. {796802400 -14400 1 EDT}.. {814946400 -18000 0 EST}.. {828856800 -14400 1 EDT}

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Port_of_Spain

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.919510214047913
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290e7490ppv:MByMYbpwt290190b
MD5:	4AB394CB233B101627136EB5E070CF9B
SHA1:	F00600CD2DB10FE157C3696F665B9759EEA85F99
SHA-256:	A4952380C89A6903FFE5BF8707B94B1BB72568FFD03DB04BF4D98E38AC82EEB7
SHA-512:	58F4AD08FA10F1884FA641C4EA778C0FC013EABBD68DF5DE04D5B301227396260C3D669DB33DD6A6B33F1550C24BBD7777D756DF0D61CEEAF5EC6541EDFA296C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Port_of_Spain) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Porto_Acre

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.866417687745155
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7thteSHAIgpth9RN/290msh490th4:MByMYdIp7t290v490I
MD5:	6B570E79FA2AA7D6CB1E56A11EE0A37C
SHA1:	396A2C9BBE4F264DD5A4F2E44D3E63C57F52186B
SHA-256:	52921EEA2A1925DF06CEA4638ED4128FAAA8FBA40ED4E0741650B419E5152DCB
SHA-512:	FA75A179664BED02A0F5BC1B7C3DD5F3E986544A151634BA4C4401476F5999714C89E240D9AF805484D1BEC04A1A562157FAEECA1603C4FF8CFFB424B9DEB560
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:America/Porto_Acre) $TZData(:America/Rio_Branco)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Porto_Velho

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	3.851275104153641
Encrypted:	false
SSDEEP:	24:5Xe4QJnSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/8:5kSeSFESoSQSrSsCSeSPS1cSQSQlSsSX
MD5:	03046BA6F8344C32AD7A22748DC871AB
SHA1:	AB9ED078D80AE99EF6DE4BF34AC45359B82D1284
SHA-256:	E6E6F6753E7D443052A64D4DB07B8D443CE13A573946E7D0A19CDD4BBA4A2F04
SHA-512:	620953BB4C8CF203262EC0C1F807543D24B9894C3B531AE57F7CEF630452CC9AC7CA41D43A6D8891F9CF17594E9EE34CF501F8508E7C0669A8E5EF9C70B6EAA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Porto_Velho) {.. {-9223372036854775808 -15336 0 LMT}.. {-1767210264 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {5712012

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Puerto_Rico

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.781646667761219
Encrypted:	false
SSDEEP:	6:SlSWB9eg/290piDm2OH9VoHvMlFoeVVF70ZVVFUFkzk/lLJpR/lAov:MB862908mdHvCvMlGe/J0Z/uFkzk/lL1
MD5:	E2E2E0D6677FFF2E37BBFC3522F2A9AA
SHA1:	4C1C93E14FBC00B8B1E78B8D9631599164305EB1
SHA-256:	2981248A9F14EBFC8791EC5453170376CBD549557E495EA0E331CC18556C958E
SHA-512:	F056B03EB9945823F5284C840E06E298DD2DE854F1555CD16D0BB19D962B73EF34A05683E6369B0D89CB7C3F7D082C312CCA6F8C6A0BB53F5C75FE4A863FCD95
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Puerto_Rico) {.. {-9223372036854775808 -15865 0 LMT}.. {-2233035335 -14400 0 AST}.. {-873057600 -10800 0 AWT}.. {-769395600 -10800 1 APT}.. {-765399600 -14400 0 AST}.. {-757368000 -14400 0 AST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Punta_Arenas

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3698
Entropy (8bit):	3.6242875066986078
Encrypted:	false
SSDEEP:	96:22SW+xUQjzoMUBI0nuUoDKlHslPlgiot7JC/Xk8NWse4r4g5xCEmSdLkUsZOn+ZW:28+xUQjzoMUBI0nuUoDK6lPlgiot7JCV
MD5:	11B8DD9FB854C62D7692EDD2445C6F90
SHA1:	51F2ABF95D73CA21674D1AA1C5F50501F76A7F3D
SHA-256:	22418567D55A0E38CAB005665271D9279A384856FDF0CE5A9AEABDCD66CCBC72
SHA-512:	B657DE13FF71268ABA1790AED7D60CC1DA867434CE78421AD023BDECCC5E1BA9863952029E07FB577B57A3247FA9157B2C0AA9F894658B3F032CC36DDE701887
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Punta_Arenas) {.. {-9223372036854775808 -17020 0 LMT}.. {-2524504580 -16966 0 SMT}.. {-1892661434 -18000 0 -05}.. {-1688410800 -16966 0 SMT}.. {-1619205434 -14400 0 -04}.. {-1593806400 -16966 0 SMT}.. {-1335986234 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}.. {37767600 -14400 0 -04}.. {55915200 -10800 1 -04}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Rainy_River

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8104
Entropy (8bit):	3.8351355650290304
Encrypted:	false
SSDEEP:	96:InJkLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:IJ3qtfA604qSBgI7DBch
MD5:	98E0F428A3773CE6FF0CEBF2F88EA81A
SHA1:	3DFA7D21A31C99078A139C5F41740B8EAD4085C2
SHA-256:	B1630FA919D652F30D23253E1C561BB76FB4D28844A2F614D08B0A25B17CFB27
SHA-512:	11C8E1F15B3FDC36DAD12229038BE10DA231872F804BD9FFF1786192541C4ABAFB27099C24EC3122F92A0D94D7D4A6E1ACD0A05845EC614982176A859B74E9FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rainy_River) {.. {-9223372036854775808 -22696 0 LMT}.. {-2366732504 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-923248800 -18000 1 CDT}.. {-880214400 -18000 0 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {136368000 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {167817600 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200 -18000 1 CDT}.. {278492400 -21600 0 CST}.. {294220800 -18000 1 CDT}.. {309942000 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CS

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Rankin_Inlet

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7614
Entropy (8bit):	3.8349162993762267
Encrypted:	false
SSDEEP:	96:Wi8h4ZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:bqOfA604qSBgI7DBch
MD5:	793DAEDB7E3077DE52DCC3C8A7CBEC5B
SHA1:	37562E9F28D51DED41FFD5FF2FF19E2E4E453B7A
SHA-256:	AA8866D58BEAB07548180628FF423887BBF48AADB1B55392B288F7310F94A9B1
SHA-512:	68A32B41DC2D3E730D6BE53656B0D566AB1BCC1E189A2FFDB5687A947EF4F4008BC17456F8CE0D59C838EEA87A44400231A44E6AB35BEDBF5D7779E1CD7EFD8A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rankin_Inlet) {.. {-9223372036854775808 0 0 -00}.. {-410227200 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {7

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Recife

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	3.78262494063765
Encrypted:	false
SSDEEP:	24:5aLexyGcChlrLPsw6kSS3h5R14eH8tf3GvIkuoYVZaI1kR8nd:5eTChlvEw6kSSx5H4a8tf3fkuoYVZDm+
MD5:	4D12651CEE804EB9F29567CB37F12031
SHA1:	54B2613475B8BDB1DBCCA53A4895DA021F66BDC0
SHA-256:	A36AD4614FC9A2A433712B555156EDE03980B88EB91D8DC7E8B10451D6D7F7D3
SHA-512:	E6690F6B6DF613C8B7289A2DB71FBC9B87B997707A6C3B4B45BDE8F347082AE8C69F212BAACE50F3C04E325ABE0976AF1F61107BDF8A15D5B88F11FAE11A9D00
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Recife) {.. {-9223372036854775808 -8376 0 LMT}.. {-1767217224 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Regina

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1781
Entropy (8bit):	4.034282439637634
Encrypted:	false
SSDEEP:	12:MB86290hjmdHfCv24Q1NAvHaE+YB+Q4kRcMxIeRUVX/SEQd1rRR9xRv0+Ro/wPjp:5EjeavTGOtAVvSRBpx0yq1epwD+yz+
MD5:	14B29B4391B643E5707096ADCC33C57E
SHA1:	B3F875ABB79C634C74307B7CB7B276B13AEE11D1
SHA-256:	50105E788288CF4C680B29BBDCDE94D8713A5361B38C6C469FD97CF05503FF7D
SHA-512:	D92A51547DF2C1AB6E6CDEFF34C07B755D3F6BB5E7DD1907693E7658EDE4D2BADC5DEFDB658ADD0F8D8F14B3B87CEA17BC00DAC364C5CB7ACBF8778C245276A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Regina) {.. {-9223372036854775808 -25116 0 LMT}.. {-2030202084 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1251651600 -21600 1 MDT}.. {-1238349600 -25200 0 MST}.. {-1220202000 -21600 1 MDT}.. {-1206900000 -25200 0 MST}.. {-1188752400 -21600 1 MDT}.. {-1175450400 -25200 0 MST}.. {-1156698000 -21600 1 MDT}.. {-1144000800 -25200 0 MST}.. {-1125248400 -21600 1 MDT}.. {-1111946400 -25200 0 MST}.. {-1032714000 -21600 1 MDT}.. {-1016992800 -25200 0 MST}.. {-1001264400 -21600 1 MDT}.. {-986148000 -25200 0 MST}.. {-969814800 -21600 1 MDT}.. {-954093600 -25200 0 MST}.. {-937760400 -21600 1 MDT}.. {-922039200 -25200 0 MST}.. {-906310800 -21600 1 MDT}.. {-890589600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-748450800 -21600 1 MDT}.. {-732729600 -25200 0 MST

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Resolute

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7610
Entropy (8bit):	3.8312000314798085
Encrypted:	false
SSDEEP:	96:li8h4Z80NA604qSScBgN+4ctDzIVQ/c/3hNxTh:EqOzA604qSBgI7DBch
MD5:	541EACD872723603971058CB205121D7
SHA1:	8F7DFD5ECA2913846D9342839AE1C60882153DA0
SHA-256:	643CC43E3F906779C040E1F0C20E78D6E95CC7301B3C7370A8ADBCBD76A8C5E8
SHA-512:	971D06D3FB67B7AE79EEDB6D3EBB805B5992C2BF4A7166016B405E21BFB25D9A87A757E8065073D5FBEB9084F6F742269A5BF432BF2F03D30913DB092E1AB3A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Resolute) {.. {-9223372036854775808 0 0 -00}.. {-704937600 -21600 0 CST}.. {-147895200 -14400 1 CDDT}.. {-131565600 -21600 0 CST}.. {325670400 -18000 1 CDT}.. {341391600 -21600 0 CST}.. {357120000 -18000 1 CDT}.. {372841200 -21600 0 CST}.. {388569600 -18000 1 CDT}.. {404895600 -21600 0 CST}.. {420019200 -18000 1 CDT}.. {436345200 -21600 0 CST}.. {452073600 -18000 1 CDT}.. {467794800 -21600 0 CST}.. {483523200 -18000 1 CDT}.. {499244400 -21600 0 CST}.. {514972800 -18000 1 CDT}.. {530694000 -21600 0 CST}.. {544608000 -18000 1 CDT}.. {562143600 -21600 0 CST}.. {576057600 -18000 1 CDT}.. {594198000 -21600 0 CST}.. {607507200 -18000 1 CDT}.. {625647600 -21600 0 CST}.. {638956800 -18000 1 CDT}.. {657097200 -21600 0 CST}.. {671011200 -18000 1 CDT}.. {688546800 -21600 0 CST}.. {702460800 -18000 1 CDT}.. {719996400 -21600 0 CST}.. {73391

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Rio_Branco

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	3.8413073465060457
Encrypted:	false
SSDEEP:	24:5Ybe/k5Yss/uuD/uVK/uNC/uvFe/uxJs/u74O/u83C/uc8J/uhF8/uNHs/ulU6Gs:505YsMw57XJh4CxUF/A6GTrtSUDwr
MD5:	7E23FDE0E158E8ED2E7536EDE70D2588
SHA1:	319052BE076DC79F130E807D68B11CCAA0636340
SHA-256:	28082D20872B61D6098D31D1C40F12464A946A933CD9AF74475C5AF384210890
SHA-512:	BE078ED12F05AB5CEE5D77212EB76A01A1BC52EEAA17E3B91D93B88D75E5281B6AF164E712A9AB0F57A21B3CDB20F6FCCADB73CAC4745B5D2E665D18F9F06B55
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Rio_Branco) {.. {-9223372036854775808 -16272 0 LMT}.. {-1767209328 -18000 0 -05}.. {-1206950400 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1175367600 -14400 1 -05}.. {-1159819200 -18000 0 -05}.. {-633812400 -14400 1 -05}.. {-622062000 -18000 0 -05}.. {-602276400 -14400 1 -05}.. {-591825600 -18000 0 -05}.. {-570740400 -14400 1 -05}.. {-560203200 -18000 0 -05}.. {-539118000 -14400 1 -05}.. {-531345600 -18000 0 -05}.. {-191358000 -14400 1 -05}.. {-184190400 -18000 0 -05}.. {-155156400 -14400 1 -05}.. {-150062400 -18000 0 -05}.. {-128890800 -14400 1 -05}.. {-121118400 -18000 0 -05}.. {-99946800 -14400 1 -05}.. {-89582400 -18000 0 -05}.. {-68410800 -14400 1 -05}.. {-57960000 -18000 0 -05}.. {499755600 -14400 1 -05}.. {511243200 -18000 0 -05}.. {530600400 -14400 1 -05}.. {540273600 -18000 0 -05}.. {562136400 -14400 1 -05}.. {57120480

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Rosario

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.801485647578614
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MSHAIgp/M1ovN/290rI5290/M7:MByMY/M7p/M16t290r190/M7
MD5:	90830F3B1F91FE48AC2944C7C92A3F6E
SHA1:	777377AE4959DDD2B472EB6041A23A5B93D64BB6
SHA-256:	0117D33D4F326AA536162D36A02439FBD5F2EB3B4F540B5BA91ED7747DDAC180
SHA-512:	20A371E4550E402AFEB83EF19EFFF6B3C0D7A68DCAA06AD894D04DB63B7096560E701C45B455B23A98BB20FE3B590F920219152415CA506AEDA427BB1381B826
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Cordoba)]} {.. LoadTimeZoneFile America/Argentina/Cordoba..}..set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Santa_Isabel

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.869058214823402
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7ekHAIgpeON/290tX2U490eBn:MByMYMpJt290c90m
MD5:	F4E62378AA05771D348AA6DA516CD386
SHA1:	07FCA813693F7944CBCBB128F2F2FE32929D37A2
SHA-256:	3B4C2F3A5B9CD22A73F05187C032723D07BB53C9946D04D35E1BA1CB90CA0A62
SHA-512:	E9F6CEB824D656CA25A72BF8EB4347A22E1A8E40410F01E0C2EDE19ACAF32D76540399796B3EBC7781C8B5D48C1A6B2C856CA06158AE37D95C95CF0567DFA2E5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:America/Santa_Isabel) $TZData(:America/Tijuana)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Santarem

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	3.8200568741699223
Encrypted:	false
SSDEEP:	24:5zeUdunSRs//SFs/pS9/MHSW/WOSr/nSso/TSL/SSU/iS5X/LcSi/xScd/ZlSQ/h:52SeSFESoSQSrSsCSeSPS1cSQSQlSsSU
MD5:	7F2658032008F2C1308F121C2EBF2479
SHA1:	B6F24E818B4424C0DEF818C103D1DA5359958932
SHA-256:	4A397BD937DE1D7E6A941D18001B34D4CD195AEFD08951C30C7EE8E48656AA0E
SHA-512:	F78853AA75F58A85555DD79E08A7487E5161854650DBF480189790D855738FEDCBDA936870067DE40FE000861008A9E9AAF61DF02B6B30B96038C61B5E1F1C1D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santarem) {.. {-9223372036854775808 -13128 0 LMT}.. {-1767212472 -14400 0 -04}.. {-1206954000 -10800 1 -04}.. {-1191358800 -14400 0 -04}.. {-1175371200 -10800 1 -04}.. {-1159822800 -14400 0 -04}.. {-633816000 -10800 1 -04}.. {-622065600 -14400 0 -04}.. {-602280000 -10800 1 -04}.. {-591829200 -14400 0 -04}.. {-570744000 -10800 1 -04}.. {-560206800 -14400 0 -04}.. {-539121600 -10800 1 -04}.. {-531349200 -14400 0 -04}.. {-191361600 -10800 1 -04}.. {-184194000 -14400 0 -04}.. {-155160000 -10800 1 -04}.. {-150066000 -14400 0 -04}.. {-128894400 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-99950400 -10800 1 -04}.. {-89586000 -14400 0 -04}.. {-68414400 -10800 1 -04}.. {-57963600 -14400 0 -04}.. {499752000 -10800 1 -04}.. {511239600 -14400 0 -04}.. {530596800 -10800 1 -04}.. {540270000 -14400 0 -04}.. {562132800 -10800 1 -04}.. {571201200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Santiago

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8871
Entropy (8bit):	3.5333393351633897
Encrypted:	false
SSDEEP:	192:5Gv/IxUQjzoMUBI0nuUoDK6lPlgiot7JC/k8NWse4r4g5xCEmMQUs8nCxvisEbzQ:5Aa9TzDCjg32+E
MD5:	0659C7482FC6121AF4714DA6E2188069
SHA1:	79D8B13C54AEDE9EDC191EB92F8CD6BE936490F4
SHA-256:	B2D7FD4DB34800C9EF9BD73CDDB1105543CCED05F3E2AC99F3E5E2F6CF340AE2
SHA-512:	C138C580648D7EAAB22828EA4318F6FAEEF618B994C2E05AF23ACF03A279506053C85BFDBC03B9E32B1CA5826713D7FFC249CE33B3F0EA734A2E4CE626AAB3A3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santiago) {.. {-9223372036854775808 -16966 0 LMT}.. {-2524504634 -16966 0 SMT}.. {-1892661434 -18000 0 -05}.. {-1688410800 -16966 0 SMT}.. {-1619205434 -14400 0 -04}.. {-1593806400 -16966 0 SMT}.. {-1335986234 -18000 0 -05}.. {-1335985200 -14400 1 -05}.. {-1317585600 -18000 0 -05}.. {-1304362800 -14400 1 -05}.. {-1286049600 -18000 0 -05}.. {-1272826800 -14400 1 -05}.. {-1254513600 -18000 0 -05}.. {-1241290800 -14400 1 -05}.. {-1222977600 -18000 0 -05}.. {-1209754800 -14400 1 -05}.. {-1191355200 -18000 0 -05}.. {-1178132400 -14400 0 -04}.. {-870552000 -18000 0 -05}.. {-865278000 -14400 0 -04}.. {-740520000 -10800 1 -03}.. {-736376400 -14400 0 -04}.. {-718056000 -18000 0 -05}.. {-713649600 -14400 0 -04}.. {-36619200 -10800 1 -04}.. {-23922000 -14400 0 -04}.. {-3355200 -10800 1 -04}.. {7527600 -14400 0 -04}.. {24465600 -10800 1 -04}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Santo_Domingo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	616
Entropy (8bit):	4.330655351784895
Encrypted:	false
SSDEEP:	12:MB86290/StmdHhvCvuCY/h/uFkS/5MVvMrW//MVvMrpx/m0XVvMr4UB/47VvMr/d:5+seQvuCY5/u/REfk+xxdbUBQpu652GO
MD5:	FAD0621010889164ADC4472003C9391F
SHA1:	C4EE0B8D6925338D17D5745DE9D45FA3C628DFC5
SHA-256:	2217E72B11A90F2D679C175DE3CC0F2FED4C280C9FF9707CFFAF118BF9A06A4B
SHA-512:	90E8E5A109CD72458C7796CF0324F63E543CCD63D13A09A3DD28EDC8B2793C964C18E79FDF0C5067C5A481B7FB03E8413139C32F59DA07E9D7893378ABBBD2B3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Santo_Domingo) {.. {-9223372036854775808 -16776 0 LMT}.. {-2524504824 -16800 0 SDMT}.. {-1159773600 -18000 0 EST}.. {-100119600 -14400 1 EDT}.. {-89668800 -18000 0 EST}.. {-5770800 -16200 1 -0430}.. {4422600 -18000 0 EST}.. {25678800 -16200 1 -0430}.. {33193800 -18000 0 EST}.. {57733200 -16200 1 -0430}.. {64816200 -18000 0 EST}.. {89182800 -16200 1 -0430}.. {96438600 -18000 0 EST}.. {120632400 -16200 1 -0430}.. {127974600 -18000 0 EST}.. {152082000 -14400 0 AST}.. {975823200 -14400 0 AST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Sao_Paulo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2900
Entropy (8bit):	3.6548008349990755
Encrypted:	false
SSDEEP:	48:5uFChlvEwR9xSSx5H4a8tf3fku+da2XUd23t8VZDG8+w/ghBPWTRz908a9zRgwun:cFIlvEwZSSxdF8tfMu+da2kdCt8VZy8n
MD5:	F6B732A862659EB131C2E6FEC00E9734
SHA1:	49517DF63BC5B6FEC875CE9477BBF84F4072FA31
SHA-256:	0E7BA1C5A3FA3DABDAA226BFE1E8D797A3835EA554828881AB5E365EDA09B92E
SHA-512:	670A5B604B5EA0F5FA15083BC1EA115B7EFD449F9EAC4518E109493591893DD3627AFC6628E0EDD1953E932E2A7AD9B5A379526548677158EC445366E4ED7166
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sao_Paulo) {.. {-9223372036854775808 -11188 0 LMT}.. {-1767214412 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-195429600 -7200 1 -02}.. {-189381600 -7200 0 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Scoresbysund

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6839
Entropy (8bit):	3.565857684485945
Encrypted:	false
SSDEEP:	192:9OgtbdF7TI7nYUYXg9W/OAcv7vuShytWi0PnvLrqPoKR2XszXckXtogYN4Ezlk0X:PJr9Q7TMq+ML
MD5:	D1BF579FE8123E8EE9248A51E794CC78
SHA1:	BF9CB9BED143C7529719E0C1E2F88BE1AC9F8DD4
SHA-256:	158BD9E4EB0B9DFF3F2D3E2DBA72F217B73423012DD33A688FD57852124E884A
SHA-512:	78192AC38912021F848592D0B208CB122EFFC6DDB326540FFAADA4FD3322B7A442FD1116F408D64B8788520B46545DFAE571EA42046D62A282A97ECCD5663655
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Scoresbysund) {.. {-9223372036854775808 -5272 0 LMT}.. {-1686090728 -7200 0 -02}.. {323841600 -3600 0 -01}.. {338961600 -7200 0 -02}.. {354679200 0 0 +00}.. {370400400 -3600 0 -01}.. {386125200 0 1 +00}.. {401850000 -3600 0 -01}.. {417574800 0 1 +00}.. {433299600 -3600 0 -01}.. {449024400 0 1 +00}.. {465354000 -3600 0 -01}.. {481078800 0 1 +00}.. {496803600 -3600 0 -01}.. {512528400 0 1 +00}.. {528253200 -3600 0 -01}.. {543978000 0 1 +00}.. {559702800 -3600 0 -01}.. {575427600 0 1 +00}.. {591152400 -3600 0 -01}.. {606877200 0 1 +00}.. {622602000 -3600 0 -01}.. {638326800 0 1 +00}.. {654656400 -3600 0 -01}.. {670381200 0 1 +00}.. {686106000 -3600 0 -01}.. {701830800 0 1 +00}.. {717555600 -3600 0 -01}.. {733280400 0 1 +00}.. {749005200 -3600 0 -01}.. {764730000 0 1 +00}.. {780454800 -3600 0 -01}.. {796179600 0 1 +00}.. {8

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Shiprock

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.888573146674231
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/2IAcGEtOFBx+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/290tO09Z
MD5:	2FF74846ADF32AA3A9418376775B7F25
SHA1:	130D7548DFFEBCE74969962E335B40299D7C5C54
SHA-256:	BF4FAB3AE72CC7FA4F9E34CF0551A85C54A084CD826DF5D9CC684DE6188E84DB
SHA-512:	9E52C017E595EEF1C68C8A1943416A9109D7DB4C32D25F83D05213C4200869A50E2E726894E39ECA364C558BB7F5566F6150CEA5D3CB14D1DEAE28C3D8C810E0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:America/Shiprock) $TZData(:America/Denver)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Sitka

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8651
Entropy (8bit):	3.959337076866423
Encrypted:	false
SSDEEP:	96:IGCG0hPC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:I5G0A9DiaJCUbPI+D/iMpCIBSuk
MD5:	7CCB6902749079A0496F1E2E2137448E
SHA1:	3D0ED7BF1C26659F6794E26AE3869F8AB925B6DF
SHA-256:	ABB08435CAE80119068A85984BFFE9C1596F4FB90F07CC01124C907E5162C189
SHA-512:	0B5B2DCECC70F357DB6D590AB63E600C572EA6B3F430565EFEB29777B1901AAC55CACC7495C668F739201076B180402141BC1B2ED2357E9B4DFBABF3B122AB44
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Sitka) {.. {-9223372036854775808 53927 0 LMT}.. {-3225223727 -32473 0 LMT}.. {-2188954727 -28800 0 PST}.. {-883584000 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-757353600 -28800 0 PST}.. {-31507200 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400 -25200 1 PDT}.. {278499600 -28800 0 PST}.. {294228000 -25200 1 PDT}.. {3099492

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\St_Barthelemy

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.932842207797733
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290txP90ppv:MByMYbpwt2907P90b
MD5:	CBFA61DBF6F7459CF8D517402B29998E
SHA1:	A562B29C9470DBD25480966B0462433124BA4164
SHA-256:	353CDBD46BA8C7472A93E9E800A69105801F6784B22EC50A59294CDC3BE40E18
SHA-512:	00B333EAA2C32EDDA8F06457AD0E10013A0147B20F504F4F1096656F731A7C1896D5ABD83E7EDBD5D4E7DA587EE9BFA796539EB1E9F4056D75D1FDF203251150
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Barthelemy) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\St_Johns

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11289
Entropy (8bit):	3.8713946894934614
Encrypted:	false
SSDEEP:	192:PmxVjd1cO8f7/EjUhSicN6zvfwb+8YbTE0M0J:PmrcOI7/EjiskY01J
MD5:	8F068899DA75663128320633E1881333
SHA1:	E9161B45D7B11A2DD6E9679AC080E84EC51561E3
SHA-256:	E2917204B0C843C32051BB371CF6D0AD272C02720B9C0D913AC072C8ABE1EC64
SHA-512:	2200E9B9D816157330ADAEA7383635876E5A37329B1AF9613D38BCFBE8143835837A25132A94E44A61DB8058ED98B1A33F295EA64BC1F4CE30966D52BB0B673D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/St_Johns) {.. {-9223372036854775808 -12652 0 LMT}.. {-2713897748 -12652 0 NST}.. {-1664130548 -9052 1 NDT}.. {-1650137348 -12652 0 NST}.. {-1640982548 -12652 0 NST}.. {-1632076148 -9052 1 NDT}.. {-1615145348 -12652 0 NST}.. {-1609446548 -12652 0 NST}.. {-1598650148 -9052 1 NDT}.. {-1590100148 -12652 0 NST}.. {-1567286948 -9052 1 NDT}.. {-1551565748 -12652 0 NST}.. {-1535837348 -9052 1 NDT}.. {-1520116148 -12652 0 NST}.. {-1503782948 -9052 1 NDT}.. {-1488666548 -12652 0 NST}.. {-1472333348 -9052 1 NDT}.. {-1457216948 -12652 0 NST}.. {-1440883748 -9052 1 NDT}.. {-1425767348 -12652 0 NST}.. {-1409434148 -9052 1 NDT}.. {-1394317748 -12652 0 NST}.. {-1377984548 -9052 1 NDT}.. {-1362263348 -12652 0 NST}.. {-1346534948 -9052 1 NDT}.. {-1330813748 -12652 0 NST}.. {-1314480548 -9052 1 NDT}.. {-1299364148 -12652 0 NST}.. {-1283030948 -9052 1 ND

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\St_Kitts

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.907031043022691
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290tMp490ppv:MByMYbpwt290g490b
MD5:	D521F2D9B28C5374FC3BD540C6B6F40D
SHA1:	39A3D86CB71F742F33B02F50B316638815B3CD4E
SHA-256:	EDB9457A7C64E47062BDC6458FD3BCFCD6C37820F1A2BC89DFE99ED77355011F
SHA-512:	05C1BE92550A962904ED3BB7DECCAC16FCB54D258F24F2AEDF755FCC44E4FEF5F86AB663945809F5D7AFA64178E807BBDAE77048270ED516DFF2C7720A746D52
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Kitts) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\St_Lucia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.9037013606484905
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290tY90ppv:MByMYbpwt290a90b
MD5:	9392E5A7BD198B0308F9271E4C7E59B2
SHA1:	A902440920A0318BC930957C74804A9A51EF7818
SHA-256:	6727A509BB937CB3446D41B57826DE70C7028E96F088AB5B7F803BEAA18279E8
SHA-512:	6DA1EAC390E72905DF1A14D82362B499D20FAD6D85F3DF116AE01E566D5D19C6D16E56DA72C458BB6143345EF45F35A53B245488C641D80BFBA200B16A59719E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Lucia) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\St_Thomas

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.919272465019375
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290tXIMFJ490ppv:MByMYbpwt290tJ490b
MD5:	49D0C8DAFCA053C9967EDCC4C0A484B1
SHA1:	7B4999D4B9AD93306BD411DF2946D741EC597770
SHA-256:	974AEED3D79124B50265C83D84F23CBE4F0328D00C75F42DD3ABC5D4C0A78DE1
SHA-512:	378E3657B26C5A039FF82ECCAC7797FF45CBC6479596629B3048164EE4E035F4ECFC557AA9EAF6848E78999B4FF8C63E53C7163BDF6F626ED6111004490D6F80
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Thomas) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\St_Vincent

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.909053768717241
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290tzb+Q90ppv:MByMYbpwt290xyQ90b
MD5:	6CFB23E7164605CDE380FB7C4D88DF11
SHA1:	CC513B29AD7B59E600DBCBC97927EB632558F657
SHA-256:	6B19404D295964EF66F47802836BB728FCE8E6481115797C0B5F200C354D7C8A
SHA-512:	728987D0925B6E12E8A220920BEDF94180880E78F3F08F6AC740E6304B22D446846068CEA499F61E7032ADB2E700CE31954921D478C9A8B6CB599E05A6292EA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/St_Vincent) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Swift_Current

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	874
Entropy (8bit):	4.253846650171654
Encrypted:	false
SSDEEP:	12:MB86290hEbmdHLCvYX4Q19xRv0+RmwPj+uLkQOzL3+ORL4FXgenM7RSslKA1PyKp:5zeOvT4xuyqoYaAxt7l
MD5:	C91F801CC5E9F78B966D1DF2259C38A8
SHA1:	D29C970CBFC74684D46AAAD543B73B520775632C
SHA-256:	939B25C9412B9E25D73F552E87826999FC8C929770E66491D1E4530046D3E758
SHA-512:	093378E61DE9310F9C48170CBB0FDBD3C79E184DA1489F759B20BCE410006A9D5A793C82E79A46E0AFF0DAA47D9DBAFD605959E491BA9ED4E55D26F293642D32
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Swift_Current) {.. {-9223372036854775808 -25880 0 LMT}.. {-2030201320 -25200 0 MST}.. {-1632063600 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-747241200 -21600 0 MDT}.. {-732729600 -25200 0 MST}.. {-715791600 -21600 1 MDT}.. {-702489600 -25200 0 MST}.. {-684342000 -21600 1 MDT}.. {-671040000 -25200 0 MST}.. {-652892400 -21600 1 MDT}.. {-639590400 -25200 0 MST}.. {-631126800 -25200 0 MST}.. {-400086000 -21600 1 MDT}.. {-384364800 -25200 0 MST}.. {-337186800 -21600 1 MDT}.. {-321465600 -25200 0 MST}.. {-305737200 -21600 1 MDT}.. {-292435200 -25200 0 MST}.. {-273682800 -21600 1 MDT}.. {-260985600 -25200 0 MST}.. {73472400 -21600 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Tegucigalpa

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	341
Entropy (8bit):	4.638828647226646
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2903fDm2OHskeoHxbV1ULhgdrV/uF+IcmJ3/uF+ivi9/uF+SNv:MB862903LmdHsVCn1ULSB/uF+QV/uF+q
MD5:	4C4034ABAB9E4804CCB23E51694044C9
SHA1:	7DB24CE83AB2C07E6F6784D27C4E3AC0F149D080
SHA-256:	1F0503579B0DDDBAF88814A278127D9CD7019EDD3C35F4CBFC0EF11C0EDAFE5B
SHA-512:	0BC366CD3AB2E1388D11770DC8DEC1FC94C48FDC846ABB6C487828BF9FF15CD9A1C15B33E08F6E48B7F4A6F2AD1617FF12B359784CA4C32256D72422E6825105
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tegucigalpa) {.. {-9223372036854775808 -20932 0 LMT}.. {-1538503868 -21600 0 CST}.. {547020000 -18000 1 CDT}.. {559717200 -21600 0 CST}.. {578469600 -18000 1 CDT}.. {591166800 -21600 0 CST}.. {1146981600 -18000 1 CDT}.. {1154926800 -21600 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Thule

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6890
Entropy (8bit):	3.8331465442823704
Encrypted:	false
SSDEEP:	192:mJInJuFW4ng2CEBJuQaeEy9P19OBYEi/B51B7/Bm6BTd69xK7KjhVbHyR3h1gOZM:miFCC
MD5:	D93B62D5F7EEBC28AC047BED2307CAE8
SHA1:	8B3E02240A01B5AA42D30E86005E880916432227
SHA-256:	7FB0CBB101D3B6FBB6B9DAD5446BBF9E6AEC65EC38472739E604F68F6AA9AB7B
SHA-512:	3648106F4DF84CFD94AAD4E9430F8D3BBCB38A9196DE9A59246DFBBC170FADBF106DD1FD08FE2E4F7319BFFB1C2607E4F5D563C222CED8267483D1A0C388CCE5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thule) {.. {-9223372036854775808 -16508 0 LMT}.. {-1686079492 -14400 0 AST}.. {670399200 -10800 1 ADT}.. {686120400 -14400 0 AST}.. {701848800 -10800 1 ADT}.. {717570000 -14400 0 AST}.. {733903200 -10800 1 ADT}.. {752043600 -14400 0 AST}.. {765352800 -10800 1 ADT}.. {783493200 -14400 0 AST}.. {796802400 -10800 1 ADT}.. {814942800 -14400 0 AST}.. {828856800 -10800 1 ADT}.. {846392400 -14400 0 AST}.. {860306400 -10800 1 ADT}.. {877842000 -14400 0 AST}.. {891756000 -10800 1 ADT}.. {909291600 -14400 0 AST}.. {923205600 -10800 1 ADT}.. {941346000 -14400 0 AST}.. {954655200 -10800 1 ADT}.. {972795600 -14400 0 AST}.. {986104800 -10800 1 ADT}.. {1004245200 -14400 0 AST}.. {1018159200 -10800 1 ADT}.. {1035694800 -14400 0 AST}.. {1049608800 -10800 1 ADT}.. {1067144400 -14400 0 AST}.. {1081058400 -10800 1 ADT}.. {1099198800 -14400 0 AST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Thunder_Bay

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	3.832494305415669
Encrypted:	false
SSDEEP:	96:tDbEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:tvEItON0HY2iUmUFLqU
MD5:	8DD2E298AEB672F32AD8B44A0A84431A
SHA1:	9687C478FC6803F4FFCA125D921DF821181B8E75
SHA-256:	0F95CE0A36415B43E7B5E6CD790D3BD9EF6D53F4B7AA0235360C0847CBB3F0C1
SHA-512:	9380327C04FC48A61423F161DFD4AC1C431278D5B392F585DCEB1D893CB8212C4093A92D5D089BC23DF0B5BB6F99595937999A6B1E843DAE1AF36D76B0858281
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Thunder_Bay) {.. {-9223372036854775808 -21420 0 LMT}.. {-2366733780 -21600 0 CST}.. {-1893434400 -18000 0 EST}.. {-883594800 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {18000 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {94712400 -18000 0 EST}.. {126248400 -18000 0 EST}.. {136364400 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {167814000 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600 -14400 1 EDT}.. {278488800 -18000 0 EST}.. {294217200 -14400 1 EDT}.. {309938400 -18000 0 EST}.. {325666800 -14400 1 EDT}.. {341388000 -18000 0 EST}.. {35711

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Tijuana

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8755
Entropy (8bit):	3.8517632099398114
Encrypted:	false
SSDEEP:	96:c4uS6mjvZk53mtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:J6jFOzN6IkWq/WHQt/RY4yP
MD5:	8F912B1F7E3144EE787E4386B1AE2AF1
SHA1:	60236FC9AB9C06F614C76357915B57B286721BC6
SHA-256:	FE3681F580ED7F3F2FD21F510DFF1BEF81BD521737F5846FA15FD309E44E69BE
SHA-512:	87EA33079EEFED848150884BC41131B2CC49B0AAA5FA10C0700818A8C292F1F3AD928E98C98EF34EFC48F0E3AFB3CBBBE3D09C483A2CDA545DFF7CB77D29CB3E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Tijuana) {.. {-9223372036854775808 -28084 0 LMT}.. {-1514736000 -25200 0 MST}.. {-1451667600 -28800 0 PST}.. {-1343062800 -25200 0 MST}.. {-1234803600 -28800 0 PST}.. {-1222963200 -25200 1 PDT}.. {-1207242000 -28800 0 PST}.. {-873820800 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-761677200 -28800 0 PST}.. {-686073600 -25200 1 PDT}.. {-661539600 -28800 0 PST}.. {-504892800 -28800 0 PST}.. {-495039600 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463590000 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431535600 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-400086000 -25200 1 PDT}.. {-386780400 -28800 0 PST}.. {-368636400 -25200 1 PDT}.. {-355330800 -28800 0 PST}.. {-337186800 -25200 1 PDT}.. {-323881200 -28800 0 PST}.. {-305737200 -25200 1 PDT}.. {-292431600 -28800 0 PST}.. {-283968000 -28800 0 PST}.. {189331200 -28800 0 PST}.. {19

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Toronto

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11248
Entropy (8bit):	3.8061065077303926
Encrypted:	false
SSDEEP:	96:lBew85RnK1a8phYBNXEtCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:lBq5RnK1a8phYTXEItON0HY2iUmUFLqU
MD5:	0D906EC3F658730131A65C5A770D885F
SHA1:	BFA72C43BCE0F37F795E974457FBE4A664687B38
SHA-256:	5A98C6BEDDA4DF608051D702A8E037093A8068E1B85F8F55D42B4468F45662A5
SHA-512:	CC634DAF4EEC7F57E3AB0C20D891380A7F96DE79602A7B57C6C2BF229DD76A69B399A689FA6D0675380B1432C2115B0C8577DC49C3C9E567A08CAD6FCC3599BC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Toronto) {.. {-9223372036854775808 -19052 0 LMT}.. {-2366736148 -18000 0 EST}.. {-1632070800 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1609441200 -18000 0 EST}.. {-1601753400 -14400 1 EDT}.. {-1583697600 -18000 0 EST}.. {-1567357200 -14400 1 EDT}.. {-1554667200 -18000 0 EST}.. {-1534698000 -14400 1 EDT}.. {-1524074400 -18000 0 EST}.. {-1503248400 -14400 1 EDT}.. {-1492365600 -18000 0 EST}.. {-1471798800 -14400 1 EDT}.. {-1460916000 -18000 0 EST}.. {-1440954000 -14400 1 EDT}.. {-1428861600 -18000 0 EST}.. {-1409504400 -14400 1 EDT}.. {-1397412000 -18000 0 EST}.. {-1378054800 -14400 1 EDT}.. {-1365962400 -18000 0 EST}.. {-1346605200 -14400 1 EDT}.. {-1333908000 -18000 0 EST}.. {-1315155600 -14400 1 EDT}.. {-1301853600 -18000 0 EST}.. {-1283706000 -14400 1 EDT}.. {-1270404000 -18000 0 EST}.. {-1252256400 -14400 1 EDT}.. {-1238954400

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Tortola

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.864308662322047
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290RRKl290ppv:MByMYbpwt290V90b
MD5:	21D152A2359A4EFDE6DCC304F16096F3
SHA1:	961B3CFB351615604981114A115D396D1F2006A2
SHA-256:	46A236EC38F3A122D414208328A462B2A937392ECC6C55F673FB7A402F118D96
SHA-512:	04A2AD6DDC2E7B0D3F95DA1C731FF553F8CBC0DD6BDFC36FB2EDCE755612103E3B4EA6F3AB7FE63CA60976538EFABF40827539DFC35B7E83129BD48471FE514B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Tortola) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Vancouver

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	3.8481935495337356
Encrypted:	false
SSDEEP:	192:sOR864CjSAG5a9bFzN6IkWq/WHQt/RY4yP:sO664CjSAGYbGBt/M
MD5:	9423BC81647BC4C37888860CE0518BBB
SHA1:	37E6E6554576D1DD36C3494EAF0BD169003D870D
SHA-256:	00B5FB8F37DFF43925C501AEAB039F39F058E002572C4203286317046CC1D700
SHA-512:	1830CA2B62B7CA6EEB5A924D2148925DF7DD87A7B93B21F4F023E4678EF42DC20BFF57F702923E10F4382FE6757323D21414D094E99FEEB43316DE4A7E5A909E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Vancouver) {.. {-9223372036854775808 -29548 0 LMT}.. {-2713880852 -28800 0 PST}.. {-1632060000 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-747237600 -25200 1 PDT}.. {-733935600 -28800 0 PST}.. {-715788000 -25200 1 PDT}.. {-702486000 -28800 0 PST}.. {-684338400 -25200 1 PDT}.. {-671036400 -28800 0 PST}.. {-652888800 -25200 1 PDT}.. {-639586800 -28800 0 PST}.. {-620834400 -25200 1 PDT}.. {-608137200 -28800 0 PST}.. {-589384800 -25200 1 PDT}.. {-576082800 -28800 0 PST}.. {-557935200 -25200 1 PDT}.. {-544633200 -28800 0 PST}.. {-526485600 -25200 1 PDT}.. {-513183600 -28800 0 PST}.. {-495036000 -25200 1 PDT}.. {-481734000 -28800 0 PST}.. {-463586400 -25200 1 PDT}.. {-450284400 -28800 0 PST}.. {-431532000 -25200 1 PDT}.. {-418230000 -28800 0 PST}.. {-4

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Virgin

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.914983069791254
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290RXgr490ppv:MByMYbpwt290xg090b
MD5:	9F7DA15BE387B8F7DEC5DFFE069F3505
SHA1:	D298B963B0048E9ECA3BC7B85248506AB1388479
SHA-256:	561D9D04B0CE0F96A9C351C7D5C30AA1D5A42A3D70066CD9AF0DA6CBC5388DBE
SHA-512:	606C2A918633C74BD2954D39B00EFA2CD9DA852BC7034F129A04258A65DC74942FA0826E9BC6E4433926E7F1375612554B04845077E434D0CD3BD15832DC6B95
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Virgin) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Whitehorse

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2971
Entropy (8bit):	3.9652694533791917
Encrypted:	false
SSDEEP:	24:5CeFvmpn4nRfngnSSXRwEg7MkwY7Twbg7Uwr70vwHg7b6wa7gAHwc7/wzZg7ywJP:5BmCKpj/AOZFCARCeQbvb5wxMN6Ix
MD5:	2F2D39B5FB844E170FA7B6AF11B948CA
SHA1:	3D89672134D979FCF65225A58249380D9C8A4A65
SHA-256:	8E0BC71BD7146145DDE3C064AE205DF08124FE2402853A9655B0EB799E90F31F
SHA-512:	6C046D1133C8CCF697C8FB553A1F539948F71FA80BA447B87AA8D1D1D7113B32A6B764C5C1734C615319A27961B6116FCA087EB571869119BE87656FCA351498
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Whitehorse) {.. {-9223372036854775808 -32412 0 LMT}.. {-2188997988 -32400 0 YST}.. {-1632056400 -28800 1 YDT}.. {-1615125600 -32400 0 YST}.. {-1596978000 -28800 1 YDT}.. {-1583164800 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-147884400 -25200 1 YDDT}.. {-131554800 -32400 0 YST}.. {315561600 -28800 0 PST}.. {325677600 -25200 1 PDT}.. {341398800 -28800 0 PST}.. {357127200 -25200 1 PDT}.. {372848400 -28800 0 PST}.. {388576800 -25200 1 PDT}.. {404902800 -28800 0 PST}.. {420026400 -25200 1 PDT}.. {436352400 -28800 0 PST}.. {452080800 -25200 1 PDT}.. {467802000 -28800 0 PST}.. {483530400 -25200 1 PDT}.. {499251600 -28800 0 PST}.. {514980000 -25200 1 PDT}.. {530701200 -28800 0 PST}.. {544615200 -25200 1 PDT}.. {562150800 -28800 0 PST}.. {576064800 -25200 1 PDT}.. {594205200 -28800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Winnipeg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9695
Entropy (8bit):	3.8209220355628766
Encrypted:	false
SSDEEP:	96:pOEhc8/rvNZONqXXyIjNA604qSScBgN+4ctDzIVQ/c/3hNxTh:pY8DvbO+A604qSBgI7DBch
MD5:	E8DB00D2B99B308018F4F5E48AC47C3A
SHA1:	8841467CB264DC9F87FABAADBE90EE2C8DACC80F
SHA-256:	F3FC5F6D93D1D9EB0F3DED33873F33C47F841797D96439966F8E0A5A189941FA
SHA-512:	5D684B07332ED53F9F8CB71FFF3B6D0F848426A5E4D9E7DA84E49E358C666F1C3BB9CF21352D939B35B558FC691839E24BC84656317F73C768B474AF5AC480EB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Winnipeg) {.. {-9223372036854775808 -23316 0 LMT}.. {-2602258284 -21600 0 CST}.. {-1694368800 -18000 1 CDT}.. {-1681671600 -21600 0 CST}.. {-1632067200 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1029686400 -18000 1 CDT}.. {-1018198800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-746035200 -18000 1 CDT}.. {-732733200 -21600 0 CST}.. {-715795200 -18000 1 CDT}.. {-702493200 -21600 0 CST}.. {-684345600 -18000 1 CDT}.. {-671043600 -21600 0 CST}.. {-652896000 -18000 1 CDT}.. {-639594000 -21600 0 CST}.. {-620755200 -18000 1 CDT}.. {-607626000 -21600 0 CST}.. {-589392000 -18000 1 CDT}.. {-576090000 -21600 0 CST}.. {-557942400 -18000 1 CDT}.. {-544640400 -21600 0 CST}.. {-526492800 -18000 1 CDT}.. {-513190800 -21600 0 CST}.. {-495043200 -18000 1 CDT}.. {-481741200 -21600 0 CST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Yakutat

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8683
Entropy (8bit):	3.957710943557426
Encrypted:	false
SSDEEP:	96:po1acs6yyyxC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:p4acsW9DiaJCUbPI+D/iMpCIBSuk
MD5:	18EC35FCEC15CE9304818E22222411EF
SHA1:	F4A04B3E2B5F55C9582F578C3142E706C4EB6BD6
SHA-256:	79B44F245D86A4EC299D1A9A2EDB2AB92D50AB5A7C1C03759D283AC4070F9005
SHA-512:	40AC47AC278DF22C7ECFF568456E7C3767B38701B9A2E2639C2201DC53CDD794CF7521BCB773A8AF2A8D4A034D3BBD35BF9788FB5B4E4D51A7A139B3B3353479
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yakutat) {.. {-9223372036854775808 52865 0 LMT}.. {-3225223727 -33535 0 LMT}.. {-2188953665 -32400 0 YST}.. {-883580400 -32400 0 YST}.. {-880203600 -28800 1 YWT}.. {-769395600 -28800 1 YPT}.. {-765381600 -32400 0 YST}.. {-757350000 -32400 0 YST}.. {-31503600 -32400 0 YST}.. {-21474000 -28800 1 YDT}.. {-5752800 -32400 0 YST}.. {9975600 -28800 1 YDT}.. {25696800 -32400 0 YST}.. {41425200 -28800 1 YDT}.. {57751200 -32400 0 YST}.. {73479600 -28800 1 YDT}.. {89200800 -32400 0 YST}.. {104929200 -28800 1 YDT}.. {120650400 -32400 0 YST}.. {126702000 -28800 1 YDT}.. {152100000 -32400 0 YST}.. {162385200 -28800 1 YDT}.. {183549600 -32400 0 YST}.. {199278000 -28800 1 YDT}.. {215604000 -32400 0 YST}.. {230727600 -28800 1 YDT}.. {247053600 -32400 0 YST}.. {262782000 -28800 1 YDT}.. {278503200 -32400 0 YST}.. {294231600 -28800 1 YDT}.. {30995

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\America\Yellowknife

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7737
Entropy (8bit):	3.8656193813344064
Encrypted:	false
SSDEEP:	96:42GaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:uPlLv/PCenJzS6cy
MD5:	A7606AE597027C26BC90702B2BCC80E9
SHA1:	7B2AB2E0A23B8D770D1305A171DBCCE2D471EF2F
SHA-256:	B33838F12640C64BA4F10F50657EC4D8D5B30FD226DA4ACA21B169B53AD30576
SHA-512:	B18711B4110D6DB0CC7A6EF66639E1B38323F0B61DA4F5287A51BC9EC8534133568C6D3E4F18F6328564DAD291E0CA707768DE4478DD502A40FFD189C08114A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Yellowknife) {.. {-9223372036854775808 0 0 -00}.. {-1104537600 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-147891600 -18000 1 MDDT}.. {-131562000 -25200 0 MST}.. {315558000 -25200 0 MST}.. {325674000 -21600 1 MDT}.. {341395200 -25200 0 MST}.. {357123600 -21600 1 MDT}.. {372844800 -25200 0 MST}.. {388573200 -21600 1 MDT}.. {404899200 -25200 0 MST}.. {420022800 -21600 1 MDT}.. {436348800 -25200 0 MST}.. {452077200 -21600 1 MDT}.. {467798400 -25200 0 MST}.. {483526800 -21600 1 MDT}.. {499248000 -25200 0 MST}.. {514976400 -21600 1 MDT}.. {530697600 -25200 0 MST}.. {544611600 -21600 1 MDT}.. {562147200 -25200 0 MST}.. {576061200 -21600 1 MDT}.. {594201600 -25200 0 MST}.. {607510800 -21600 1 MDT}.. {625651200 -25200 0 MST}.. {638960400 -21600 1 MDT}.. {657100800 -25200 0 MST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Casey

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	478
Entropy (8bit):	4.205595904143294
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2L09xSDm2OHE5QMFUH+KNUoTVsBEE0ZZICxZbDtVby:MB862LcUmdHE5QMFi+KdTVPZIwXDy
MD5:	7D8132A23238C14CCEDD520BBEB49F77
SHA1:	A8BAE9269DAA2AC535B292E1AE8632B451A0BBA5
SHA-256:	04247ACB2B4FA126D13F4573FF74D15A89CF42B2C5CD7E688D5BB1C1FD3972BF
SHA-512:	74FCB14037B0AE11A95B036791D69037590F8EC7F09D90A866E6A6CAAD6D58E4EC3723A3BB356FBF0E25ED1239A5820A8513EBF6653578E4BFB8988D6D20EF13
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Casey) {.. {-9223372036854775808 0 0 -00}.. {-31536000 28800 0 +08}.. {1255802400 39600 0 +11}.. {1267714800 28800 0 +08}.. {1319738400 39600 0 +11}.. {1329843600 28800 0 +08}.. {1477065600 39600 0 +11}.. {1520701200 28800 0 +08}.. {1538856000 39600 0 +11}.. {1552752000 28800 0 +08}.. {1570129200 39600 0 +11}.. {1583596800 28800 0 +08}.. {1601740860 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Davis

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	324
Entropy (8bit):	4.360007144607037
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2L0mDm2OHEfwz0/MVSYyF/KZ7VoX/MVSYyF/VpVQVF9RXhNXSMVSYy6:MB862LVmdHEIjsF/KZOksF/Vp6v9RRFl
MD5:	97AA556F7EF06786B76316133794F4E9
SHA1:	B3CDA284DE80987B954E2CC9BFA3ED33462CDD4F
SHA-256:	2F36D2E13D7E251322B7A7B30F39645393525CEB49A2B5C26F27797F2AAF4D7F
SHA-512:	14C6F17252C2AC89D86FE00BD8A8934D627C85478B0AB08AB6237988922D18616B00878498FFFC0E1978308BC6D775E2DC3ADCEF827AB0A06B214BE4DDABAB52
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Davis) {.. {-9223372036854775808 0 0 -00}.. {-409190400 25200 0 +07}.. {-163062000 0 0 -00}.. {-28857600 25200 0 +07}.. {1255806000 18000 0 +05}.. {1268251200 25200 0 +07}.. {1319742000 18000 0 +05}.. {1329854400 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\DumontDUrville

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.938579775653117
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yci/452HAIgObi/4oA6N/2L0/3Zp5/4pv:MByMdNXiU5t2Lkwv
MD5:	CC22302B9FAE52E36A2A35C0361E774B
SHA1:	45CFD95A5821C4C4FDF2E1519F08029FF0BE664B
SHA-256:	96F2AB9A9FFCD10598FDF105F68460CC4B4EBC1F18054D1BC8E39DF6AD24D1AC
SHA-512:	FC9084D7B16EAA985681762F2658D32C77EE186D8D3C7225093CC5CB4A6AEB74A3D0A41A904EB6C8AEF7DB110A89497BAFAF811BBC26103F96E5E1D4D4E1002A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Port_Moresby)]} {.. LoadTimeZoneFile Pacific/Port_Moresby..}..set TZData(:Antarctica/DumontDUrville) $TZData(:Pacific/Port_Moresby)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Macquarie

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8447
Entropy (8bit):	3.850137279218428
Encrypted:	false
SSDEEP:	96:s1qigkx6WsYyS391QiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:s1q05h1QiAmcOM6e0pj
MD5:	81C612A1544910544173687C416841C6
SHA1:	4A707B403F0B9556A3D3D50B08BE0F56660F3F0B
SHA-256:	C4EA7F1C0B5A0FAE653419F1C6D058BDDD745A3CDBA11900005C157DF23DDC01
SHA-512:	122E2DC3D8D61CCDB83E03C9487DD29AABE7AB3F71FE4F6315209AF0BBCFD01FBDC3A1E3F6D910FB0D690378DF852170A9819D8C1EF96BE6BC8C0811BFB453A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Macquarie) {.. {-9223372036854775808 0 0 -00}.. {-2214259200 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1669892400 39600 0 AEDT}.. {-1665388800 36000 0 AEST}.. {-1601719200 0 0 -00}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {28932480

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Mawson

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.7511104559982
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2L0GRHEzyeyFNMXGm2OHvavFeVU/VPKVVFSTVF9svUX0VQr:SlSWB9eg/2L0zyfXDm2OHEVy/Ur9s/Vg
MD5:	7A2AD9BD8F8DEE5C600CABF2D5E9D07B
SHA1:	CF5D230A29946B7FA3ECD8EB99F1EF1BF0FA5B50
SHA-256:	ACA533B8BC82296373EDEC82F6E0AA45A34D817C7C18FF5E8E94B81C0BD30259
SHA-512:	95F8FA68735E88AB15C403191928FA4AA5D1628453BE64B87EE7E8DF9F35FB5DA74A3CED5F5289A13D84A8A12BBB86734E578059CA8B6405399CFF5E33C9384C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Mawson) {.. {-9223372036854775808 0 0 -00}.. {-501206400 21600 0 +06}.. {1255809600 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\McMurdo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.880387042335617
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3ycqXHAIgObOvRN/2L0z6/fy:MByMdTiYt2LrK
MD5:	88EE32AE5C538AEBFDE2D1D944ED5B2B
SHA1:	55E7234E6FFF298182A6C8889A9F506CDCE7C959
SHA-256:	E9D99293C5B275D8E0D7B066084177EDF670D5B52B81E87608BAB02025F33155
SHA-512:	45A3EA146CA719BA6F22E99EAA57AC1DED1C762E19BDFBA176E5FEAC36EC58586F771572DD16ACE09E660F97DEB91A701BA1B1F1AEF3BD8688F3451C0772420A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/McMurdo) $TZData(:Pacific/Auckland)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Palmer

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2613
Entropy (8bit):	3.6082359166067905
Encrypted:	false
SSDEEP:	48:5fzJS6S4wRSenSOaf7HSKSkSqS7STslSmSMSCSxygSiXS/SrS+S9SfShS7SoSlSL:jdeRtnxaf7HlPlgiot7JC/Xk8NWse4rf
MD5:	BDFA5908E735F866FEC16F6B481AD385
SHA1:	524AEE21BB97D923A8812A5722AF2FEA43B4D971
SHA-256:	1637381A20E9D5C6A530F110BDB08D9515E675C9206F000407D8511074948E61
SHA-512:	3D65C7941BA15A698264848F9B6F43ED5B63D4CF86D495334E8E1DC381D63435E9424BBBC389229693D20044FDB8425A7CC805AB5EA055F59D3E0DD4C7AC2A28
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Palmer) {.. {-9223372036854775808 0 0 -00}.. {-157766400 -14400 0 -04}.. {-152654400 -14400 0 -04}.. {-132955200 -10800 1 -04}.. {-121122000 -14400 0 -04}.. {-101419200 -10800 1 -04}.. {-86821200 -14400 0 -04}.. {-71092800 -10800 1 -04}.. {-54766800 -14400 0 -04}.. {-39038400 -10800 1 -04}.. {-23317200 -14400 0 -04}.. {-7588800 -10800 0 -03}.. {128142000 -7200 1 -03}.. {136605600 -10800 0 -03}.. {389070000 -14400 0 -04}.. {403070400 -10800 1 -04}.. {416372400 -14400 0 -04}.. {434520000 -10800 1 -04}.. {447822000 -14400 0 -04}.. {466574400 -10800 1 -04}.. {479271600 -14400 0 -04}.. {498024000 -10800 1 -04}.. {510721200 -14400 0 -04}.. {529473600 -10800 1 -04}.. {545194800 -14400 0 -04}.. {560923200 -10800 1 -04}.. {574225200 -14400 0 -04}.. {592372800 -10800 1 -04}.. {605674800 -14400 0 -04}.. {624427200 -10800 1 -04}.. {63712

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Rothera

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.829975802206526
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2L0GRHEsKRsMXGm2OHvavFN/H3VVFVGAvFv:SlSWB9eg/2L0rRsDm2OHEN/VVFAKV
MD5:	C330982049AA053DA62B926627D2F2FA
SHA1:	050CE68265F1A183F0173C825AC59EAE8B6AB9EB
SHA-256:	943F10D8E836773F0B7ACD13ED8422C0B27813C7BBE0B09B57697D1D70D21ECE
SHA-512:	DE9953D0E505D6B110C0CC4E756B5B0311646C9CA4703A33B92147D36CFB4C288D73851E6766CE1432F41AB51B5D0A1D58680BDB4E28F067E1D36F670B4A192E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Rothera) {.. {-9223372036854775808 0 0 -00}.. {218246400 -10800 0 -03}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\South_Pole

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.906125935761354
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3ycqXHAIgObOvRN/2L0tlo+ply:MByMdTiYt2LMq+p8
MD5:	8095A3749DBDE05377836D74A4EEFE33
SHA1:	6987CA972B63AE26A65654961588D51D3EF2166C
SHA-256:	88057832175BB642B23FC99F788A2F78A24005CF1F84A7B1B5E8C84FB8F4D4C1
SHA-512:	9066104C9C16D2AB88523D651C74CE268468E093A497D128D0D12A986BD62DBC1388A56ED1737C2AFACF04185CF06FD0EE66797A3390B2F0E1EB08A4D92AAFAD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:Antarctica/South_Pole) $TZData(:Pacific/Auckland)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Syowa

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.871844665431957
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2L0GRHEtWlFBQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2L0tQB
MD5:	CA52057130DCF506D11A7CC069F4FBA3
SHA1:	2C38B7E7872BB41C3569DFCB539C3EC3AAE24FDD
SHA-256:	2488805DE4FEA42305689F679F1AE2D80B1E934E657FEA329AD39A82DAC63022
SHA-512:	B19D409870939C8F0834C6C028239E010EE5128DFA6E97D4903BECA229B04FE530EA376B936767D9BFE21709720C1791289D8E3622B17C18F2680B0670794A02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Antarctica/Syowa) $TZData(:Asia/Riyadh)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Troll

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5370
Entropy (8bit):	3.5134546899897146
Encrypted:	false
SSDEEP:	96:YveRdmbxnKIJqU9XThVIsopb8BcrFgoZVlzeEG+PtJ:UeRdmNnKIIajfopb3FVVJ
MD5:	442F495C36B31CA5D7A9BEFF12105AEF
SHA1:	B3F6CA5B4A5756F9B2C09A27198F7A651CC6032D
SHA-256:	6FD5AB8B7B308CDCEA4B747A81D8675988AE218813C91714FC4CA97919CEBEA5
SHA-512:	C6EAECC26D67D218615EBB5602639DAB62A2578BD9683553D765DC1AC5580627D29B6F911388F5F1BFC284278EA4EBECE94630D3C6B95FF9EF93D3D61A3C2028
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Troll) {.. {-9223372036854775808 0 0 -00}.. {1108166400 0 0 +00}.. {1111885200 7200 1 +02}.. {1130634000 0 0 +00}.. {1143334800 7200 1 +02}.. {1162083600 0 0 +00}.. {1174784400 7200 1 +02}.. {1193533200 0 0 +00}.. {1206838800 7200 1 +02}.. {1224982800 0 0 +00}.. {1238288400 7200 1 +02}.. {1256432400 0 0 +00}.. {1269738000 7200 1 +02}.. {1288486800 0 0 +00}.. {1301187600 7200 1 +02}.. {1319936400 0 0 +00}.. {1332637200 7200 1 +02}.. {1351386000 0 0 +00}.. {1364691600 7200 1 +02}.. {1382835600 0 0 +00}.. {1396141200 7200 1 +02}.. {1414285200 0 0 +00}.. {1427590800 7200 1 +02}.. {1445734800 0 0 +00}.. {1459040400 7200 1 +02}.. {1477789200 0 0 +00}.. {1490490000 7200 1 +02}.. {1509238800 0 0 +00}.. {1521939600 7200 1 +02}.. {1540688400 0 0 +00}.. {1553994000 7200 1 +02}.. {1572138000 0 0 +00}.. {1585443600 7200 1 +02}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Antarctica\Vostok

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.825276519494304
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2L0GRHEoKcMFPMXGm2OHvavFYd/bVFXKVVFSTVVn:SlSWB9eg/2L0XcMFPDm2OHEsVFXK/UX
MD5:	EEF1A803C78FEDC2848A967F8F7C8C28
SHA1:	AC0E8008EFE4EF1A393478C82724335EA30BF1CD
SHA-256:	1EFDAE8A23BA4EE37E7992F3C9DCADA6C2E95AF82A955A4C6597E7295C950855
SHA-512:	F19EA119EA4F354099402FDEEAAA551AA2C5FC1295E40B5A82E5896CB41F0C86AD8CAA86FDC4E7BD30AAF0ABAF2794FE7B177C4FE25A89F1C744C400A140AA88
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Antarctica/Vostok) {.. {-9223372036854775808 0 0 -00}.. {-380073600 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Arctic\Longyearbyen

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.968479138333469
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVyWJooeyXHAIgoqxWJz5RL/2XbeLo4cA4FH/h8Qas:SlSWB9vsM3ymSDSHAIgoXN/2XbUyAK8K
MD5:	3FE28E22313BA8C8100254644DBFD164
SHA1:	46F917F0E706CD072B89C06652DAA032CD67AD98
SHA-256:	944A38702A5176A082755897F1E4B1C88D5721CB499245E2FE51D2CFD849A23F
SHA-512:	BF6E42C039C780EB62CFD69B0375EFF9D459E6468CAFE2323A086D2EB2039B97F805BC361962C72F51F527E96B51973298F13774427E38A28E851A9D19664820
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Oslo)]} {.. LoadTimeZoneFile Europe/Oslo..}..set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Oslo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Aden

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.829666491766117
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFK4h4WFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKs46
MD5:	60D7F3194F19179E0CF0F561F9C40EE6
SHA1:	B079EC49485CFBFFB7A5BE6149319B75684258E9
SHA-256:	8FCDDB246932BAED880B70C0CA867057E7989AEA55EDDC174430E1055CD1058D
SHA-512:	0BDC86B1D473D4875C6F7C092F955D0999E6C1F2EF83CFC7726A3C5BFEB0F5CB8E00B1F0CBC1F91F806EC635C472927504DF681A32DAC55EF372DA16FEA9EF40
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Aden) $TZData(:Asia/Riyadh)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Almaty

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1637
Entropy (8bit):	3.732051305399264
Encrypted:	false
SSDEEP:	24:5qehddmvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10SvPFu+a+CK/Eu3CWuD0Vob1:5YvdJqxiF0rvK50Sv9fGSM
MD5:	D6BCB21F65642F36A159AFD72EC93953
SHA1:	D3E670E579924E6E4F04AB574D48334FF521D8B2
SHA-256:	06DC608C0B8CDD69CCE66A6BF86F141C46DF39CB45312E684E46F19ED8CAFF15
SHA-512:	9A633B629873E5EE5AF923A94865EBE5FD9ECA181B2C47B7368A0828468715E07AD3FD825D5E2312D2D0BA1FA5490E3817C36B6339824C8012A0B75538C4A0DC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Almaty) {.. {-9223372036854775808 18468 0 LMT}.. {-1441170468 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {695768400 21600 0 +06}.. {701812800 25200 1 +06}.. {717537600 21600 0 +06}.. {733262400 25200 1 +06}.. {748987200 21600 0 +06}.. {764712

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Amman

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7301
Entropy (8bit):	3.7085177447035047
Encrypted:	false
SSDEEP:	96:Fz0T52akyId7+xOXdkwqeIFcvQdaKkIQV9aOBmGILnNoRkEKnFj/XmJmoTSVI:FY85S0VqXFcvQMZUnNrK
MD5:	C5521EB658601F0C03F3122A1529B7B9
SHA1:	0B0F9BD69F3B49DF5D25A9F567471409D7467ED8
SHA-256:	AA5E87C065E5AA4516F1AA50E1840EE22683D3B4C25A4E00CA92C53F96C6D062
SHA-512:	B16039183DF4AF64768F4956075E9557988466E4FC327968712958186CB8F804C1F1B0ED80F5EC7900521CC5710E8AA0DD6716C3B58F7B31116E22CB5785C000
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Amman) {.. {-9223372036854775808 8624 0 LMT}.. {-1230776624 7200 0 EET}.. {108165600 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {215643600 7200 0 EET}.. {231285600 10800 1 EEST}.. {244501200 7200 0 EET}.. {262735200 10800 1 EEST}.. {275950800 7200 0 EET}.. {481154400 10800 1 EEST}.. {496962000 7200 0 EET}.. {512949600 10800 1 EEST}.. {528670800 7200 0 EET}.. {544399200 10800 1 EEST}.. {560120400 7200 0 EET}.. {575848800 10800 1 EEST}.. {592174800 7200 0 EET}.. {610581600 10800 1 EEST}.. {623624400 7200 0 EET}.. {641167200 10800 1 EEST}.. {655074000 7200 0 EET}.. {671839200 10800 1 EEST}.. {685918800 7200 0 EET}.. {702856800 10800 1 EEST}.. {717973200 7200 0 EET}.. {733701600 10800 1 EEST}.. {749422800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Anadyr

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2086
Entropy (8bit):	3.7698340044911616
Encrypted:	false
SSDEEP:	24:5DeEdVrEOeFt7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5ZejsFLrcZwvJt2F+doTr9Q3G80
MD5:	6EFC35043BDCA4AB61D72E931DB954E6
SHA1:	F0B4E76C154DC773073E41AA8E94030E972A986A
SHA-256:	D9DF64FDA4638F7604624B0F68A885D5ABADB1DE12AF1AF5581C2AF7DD971562
SHA-512:	16AE582B113D6960C73B64620A8AF20F9D436AA4B3EC8E881617AED3389EB4357931882103F162F19EE8202953A7E6FB4FDD6D7760FB7621F4DB9D229AD13F17
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Anadyr) {.. {-9223372036854775808 42596 0 LMT}.. {-1441194596 43200 0 +12}.. {-1247572800 46800 0 +14}.. {354884400 50400 1 +14}.. {370692000 46800 0 +13}.. {386420400 43200 0 +13}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Aqtau

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	3.7149890651919644
Encrypted:	false
SSDEEP:	48:5uvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIkhYwr:sFBNKs6b03zB0WJEuDa7sFZiKWaN6TiF
MD5:	A72FB1FE01C93BD7E0A8136635C72639
SHA1:	2383CF839F50784D4BF8B7EDDB324C80E2DDD0DC
SHA-256:	96B510AF9B8C6BC1DFA84E9ED5E072F3FD484EEB66BBEBC7B6826ED859ED9027
SHA-512:	061FECE3C750C0229638DD8AF38FB3E8E48E59E0DE1B13BCFE46483A7A170B71B9BCB0D6F110B6B2EF68510FA940F9066F14CBD59829E222D6644D3657CE1893
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtau) {.. {-9223372036854775808 12064 0 LMT}.. {-1441164064 14400 0 +04}.. {-1247544000 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {7647156

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Aqtobe

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	3.721746335201775
Encrypted:	false
SSDEEP:	48:5FUvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQR:PwaBNKs6b03zB0WJEuDa7sFZiKWaN6Tt
MD5:	E278B985BD2515DBCAED8CB741BE9208
SHA1:	BC9F5E72C430661D7ED1AF04571CE5D0F73DD18D
SHA-256:	991638FA2AB2A2F7A091A23D78D99306EE73A740F1A03FBAC448EDCAB55A0E38
SHA-512:	9951DB729B837647CC4B3D2E605525DCCBAFFD39D76460331BF62235DCAE5E4470CDA578F940B1739AABFEC55D293FF60D79AE0EFDFE1EB64E84571881FDEA6A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Aqtobe) {.. {-9223372036854775808 13720 0 LMT}.. {-1441165720 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Ashgabat

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	878
Entropy (8bit):	3.937249024843323
Encrypted:	false
SSDEEP:	24:5ggeRMdIQvNcDvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKTob3CGcr:5gbkvNSvNhQQvmRKqv0fvzQIovWdvEGD
MD5:	259179C7A1CA04F9F3A373B6C8FCB8C5
SHA1:	D042DF8EFD8EC1473B45B1131BD5EB714F1B2C17
SHA-256:	13745BFA25E6E2D8D0FABAE42CB7C37CF9F974CFB343D4FE84E4E2D64A25926B
SHA-512:	703BEAD5A1E5B3816D98057A08A87C2139F418787F38561FE35175B84E2005365727F85D1B949CC5DF464B207A7D01BB65FB1A632E73DDA523E843B82D76FBBD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ashgabat) {.. {-9223372036854775808 14012 0 LMT}.. {-1441166012 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +05}.. {370720800 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Ashkhabad

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.801820439218014
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8xEYM4DyXHAIgN/ZEYovFvWARL/2WFKUNSH+WFKYEQ:SlSWB9vsM3yR+HAIgH8VWAN/2wKUNSeq
MD5:	5193EF7ADB646798801245BC50C8DDA6
SHA1:	83ED851CBC60EFB330A8FC119E1BED5B4C0BA630
SHA-256:	2C752F641B98E3C05B14AE31330D1F198DAA4A7E354BA9670C7754926BFB891A
SHA-512:	E940E1BE67A9AC895F3D060B1CB34797A429147A9DC2AC0F1162D37D86661EF217EDABA720F0AE3796186FE801229210AC785BB4511CBBE5A41791D236101D8C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ashgabat)]} {.. LoadTimeZoneFile Asia/Ashgabat..}..set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Atyrau

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	3.7265766742957402
Encrypted:	false
SSDEEP:	48:55TvFlvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQJ:XrFBNKs6b03zB0WJEuDa7sFZiKWaN6Tl
MD5:	0236793F90ABC6F68718DDBB44AF5E2F
SHA1:	A5EFAEEF9B9159E748A3FED231F8A978E400482E
SHA-256:	4B7B118E6AE72D41740CF0CB2BD8E970700758DCBC0DD6F298199D841DF8408E
SHA-512:	851C7A9C110790454312BB9C5B5D3C426365EEF4673191B9ABB2E4A32301894C5FB1ADCBE2A4C67BEE416AD63FB8BED85F94EF9BF42473DA4BFFA7824935A1D5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Atyrau) {.. {-9223372036854775808 12464 0 LMT}.. {-1441164464 10800 0 +03}.. {-1247540400 18000 0 +05}.. {370724400 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764715

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Baghdad

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	3.7261419515679393
Encrypted:	false
SSDEEP:	24:5/eVvyGiHD6UC4UrUomFMmUZcjbUKNFcUEUvUOpU8MYUWCUlbf/U9bUiUUybUQUF:5m8G9mFdnNF1FfsTuvQXHCe
MD5:	690013310A46BD1AE250A5E019353809
SHA1:	0DF434C7EEB707DC071007FAB112F4DEB37E936F
SHA-256:	D20B75D2604C3B742C1629C5EE02CFF6783E472249982B272B68F2A6DE9BDC38
SHA-512:	FF8C33E55E4F006C38D3FD37A1AD3E1200718CA374ECBEAE8255C7635912F0BB23A59A600BF7130D5660A24C515F726E8440D0D908E560CB59F74059638E6AA2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baghdad) {.. {-9223372036854775808 10660 0 LMT}.. {-2524532260 10656 0 BMT}.. {-1641005856 10800 0 +03}.. {389048400 14400 0 +03}.. {402264000 10800 0 +03}.. {417906000 14400 1 +03}.. {433800000 10800 0 +03}.. {449614800 14400 1 +03}.. {465422400 10800 0 +03}.. {481150800 14400 1 +03}.. {496792800 10800 0 +03}.. {512517600 14400 1 +03}.. {528242400 10800 0 +03}.. {543967200 14400 1 +03}.. {559692000 10800 0 +03}.. {575416800 14400 1 +03}.. {591141600 10800 0 +03}.. {606866400 14400 1 +03}.. {622591200 10800 0 +03}.. {638316000 14400 1 +03}.. {654645600 10800 0 +03}.. {670464000 14400 1 +03}.. {686275200 10800 0 +03}.. {702086400 14400 1 +03}.. {717897600 10800 0 +03}.. {733622400 14400 1 +03}.. {749433600 10800 0 +03}.. {765158400 14400 1 +03}.. {780969600 10800 0 +03}.. {796694400 14400 1 +03}.. {812505600 10800 0 +03}.. {82831

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Bahrain

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.784355129067593
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8hkXHAIgNvZORL/2WFKENUKMFB/4WFKKB:SlSWB9vsM3yBkHAIgPON/2wKENUr/4wT
MD5:	1B5E0D449DAEF469D586A853CB3073AD
SHA1:	FD735B0472B31644E787767B82B737CC39EC4175
SHA-256:	3D437037FBF2BBDF969C8E71967080947F24860D431B39F5D8F23151316ABCD5
SHA-512:	2A2DC33D4258A5E1AE59172883F3B11723798ED35CF5AF1B8BA81A8807DC6F8222C8044D82B152EF6AF43E7350FEB2625D4406C6C7DD309CE65810EA3D3286B6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Qatar)]} {.. LoadTimeZoneFile Asia/Qatar..}..set TZData(:Asia/Bahrain) $TZData(:Asia/Qatar)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Baku

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2149
Entropy (8bit):	3.6155622322573713
Encrypted:	false
SSDEEP:	24:5/eFdqlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUTIEjvZJ+76:5RsUf8mFpNWFny1ZGMte3aivUKo
MD5:	294DFC98F67AC00A188EC3D3B87C501C
SHA1:	93C434CD9AA170E35AD676C88EE09986A94EC02A
SHA-256:	873E8F08B87610D0DAFE239D32345248A4595C6B13D1DA83EC214D78E88FA12C
SHA-512:	5346082CCA733724C0D2C36B768467E59BA9ED6452B6CF1BA923AF4F0D2BC05C67DB49E804CA81DAD449D30D0835026D708D9AB632D02FDA1EA1A0BF717111DE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Baku) {.. {-9223372036854775808 11964 0 LMT}.. {-1441163964 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 14400 0 +04}.. {820440000 14400 0 +04}.. {828234000 18000 1 +05}.. {846378000 14400 0 +04}.. {852062400

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Bangkok

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.911309754748998
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKELYOiMXGm2OHB+keoHvZKmrROpDovFFsQ+8EXVeVSYe:SlSWB9eg/2wKELeDm2OHxeoHvZ3FO1og
MD5:	9AC4947AC29C797055B7EBFA4F6AC710
SHA1:	E7758A9A8BFA255F6B2D27F5366D9FE2A26DDF6C
SHA-256:	6E72BA908F250FD45D554A12E3E7B3BD2F1C02A6C2431F806FD2A054F843AA90
SHA-512:	F9D0F0CB7D3726C2AB3B5049429172D9DD4BA21353F6F98570CBA4EE969F7D97BD973CB165AECFF930AFFA8633E8052624D44EE7FB91763681ED3F78A61F4F98
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bangkok) {.. {-9223372036854775808 24124 0 LMT}.. {-2840164924 24124 0 BMT}.. {-1570084924 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Barnaul

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2117
Entropy (8bit):	3.7025684250364725
Encrypted:	false
SSDEEP:	24:5VeTtXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEnsr:5n40yVRB7VfXucdKmtTTDOV
MD5:	6CC13B6910412A3A3D16CA36ADF00352
SHA1:	061CF4A8FEA8C139F50F96E6B6506B50ED3DD792
SHA-256:	992F93A7975F8CD4E94D96B3BA1ECFB3585E52A53F4442A15993402D3F955F66
SHA-512:	4E9750B1C3C0BA4F7922BCBC76276A3E74031D78A98E21DC59F66D6EA8E1B70865BBEB50A6B77EB0423421A18428B97B47412053CE15213128CEED669F4DD6E8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Barnaul) {.. {-9223372036854775808 20100 0 LMT}.. {-1579844100 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {76470

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Beirut

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8024
Entropy (8bit):	3.7230911686481774
Encrypted:	false
SSDEEP:	96:4nBKPP8LFH0TDkywaZb1QSCK5VUjiO1PoBQpo7778CZicJZS80EGcLt4Mok1MgJl:4M38LCRZb+sAiO1PoBQpo1ikjD
MD5:	1D99E2BBB01B1669403CFBAF7E03F733
SHA1:	DBDD58C7FD195FC602C4541D6F416CC96094C121
SHA-256:	17AF14646D562AFE17DCCFD1D2FBA95C122F3E0263906A36EB48BFF04ACF233E
SHA-512:	98524E8DCD17C090058F17BDA1200D9801EB1B14EB5CEB8C31149A4A402A53BA4923A2AFF457E0A72DAA601D88095247806F945F704000F874FCBF73631DD135
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Beirut) {.. {-9223372036854775808 8520 0 LMT}.. {-2840149320 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1473645600 10800 1 EEST}.. {-1460948400 7200 0 EET}.. {-399866400 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336794400 10800 1 EEST}.. {-323578800 7200 0 EET}.. {-305172000 10800 1 EEST}.. {-291956400 7200 0 EET}.. {-273636000 10800 1 EEST}.. {-260420400 7200 0 EET}.. {78012000 10800 1 EEST}.. {86734800 7200 0 EET}.. {105055200 10800 1 EEST}.. {118270800 7200 0 EET}.. {136591200 10800 1 EEST}.. {149806800 7200 0 EET}.. {168127200 10800 1 EEST}.. {181342800 7200 0 EET}.. {199749600 10800 1 EEST}.. {212965200 7200 0 EET}.. {231285600 10800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Bishkek

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1669
Entropy (8bit):	3.7443715330695735
Encrypted:	false
SSDEEP:	48:5qvdJqxiF0rvK5XvV4vUzvCjvT7voPvkPvJUbvn0vYpv99v3uvuWvKJhv3T:Ad1mzK5/VkULCbTjoHkHJUDnQYV9p3mO
MD5:	1EE8FF3DF0D931A140ADBB021EB3BFEB
SHA1:	F1F15EF70C4E9F456849AF89CAC97AD747D9E192
SHA-256:	1D5E9A8F6A04273AF741F648EF10718B004A60D7884FE432DDF85A8F558BEA98
SHA-512:	155539A5CF21A34FBFACBF1652D934BF32255F4E505E60B3B4D8B5F2F7FAE552E6CB4824D8608A9C56370F58E48702335995BBD16B7A296A86A72A615FBC8ABC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Bishkek) {.. {-9223372036854775808 17904 0 LMT}.. {-1441169904 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {683586000 18000 0 +05}.. {703018800 21600 1 +05}.. {717530400 18000 0 +05}.. {734468400 21600 1 +05}.. {748980000 18000 0 +05}.. {765918000 21600 1 +05}.. {78042

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Brunei

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.843807524560784
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKXeAMMkSMXGm2OHCQdvVVoHsWUOVFW/FvOVSSFdaUMWO:SlSWB9eg/2wK0iDm2OHCIvVVoH3UuW/N
MD5:	37B0C37CDDEE62E6002AF3D09B0B6225
SHA1:	75F1329492C231587FE233175D9B71112DA09B08
SHA-256:	A4216B59F2478DE7E88A99E2B11BBBD93070477D7E62BFD453D1CA430EBB4834
SHA-512:	6FDC5C74F927970DA261A5842D9647E97163009A2902C8A8AB6DFAACF261485AB179495D2D72FAC513D1A27F662553F1F0EEC8687E009EA5753D5A9E6B0A0D34
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Brunei) {.. {-9223372036854775808 27580 0 LMT}.. {-1383464380 27000 0 +0730}.. {-1167636600 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Calcutta

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.774027471796823
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq864DyXHAIgN1QvRL/2WFKh0s+WFKvovn:SlSWB9vsM3ya4DSHAIgcvN/2wKN+wKvy
MD5:	8BB098AB77CB0469B1FA0E0B64C4A9E7
SHA1:	88C73626985071DD0923E1CAB343ACCD854A7297
SHA-256:	1BAEF7850111D2C33B2A766A8AE804534ABA1711BF80A4087A89656DDD8469D5
SHA-512:	82216A7F787AF20A4C97C7AA754CD6BE979FEF24137CF9A8B18EECA5E8FBCF12834DD8A6FC9CD2357D807F1629806745B46B11DC0472E0284E18DCCC983897DE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kolkata)]} {.. LoadTimeZoneFile Asia/Kolkata..}..set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Chita

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2086
Entropy (8bit):	3.6981807774781017
Encrypted:	false
SSDEEP:	48:5Bpr1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2M:95PhtjLiII2ZFlgd
MD5:	69E03A5CEB689E19B60168C0F7EBAE8E
SHA1:	95C6396EB753753B4FE4AE1B98D76332523E72A4
SHA-256:	10B6F435B05D887176A4D90CA5AC957F327F62F36F15D6F6E4F81844662429B9
SHA-512:	DFA72EDC54A11F0840ADBEE7F5AD8EA472AA52A1F196292F1341CD92A68FB2EC0A5BC7DE6C8E83C975420DB4B76CECD4393370FDB2C09F86EC11A50E540F6F02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Chita) {.. {-9223372036854775808 27232 0 LMT}.. {-1579419232 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647012

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Choibalsan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	3.775783980828041
Encrypted:	false
SSDEEP:	48:5th5fSW2sp4Qh2rRSQnGw7GywvWbC25XrMYWG4AIQTUhp9pkTGdXguHaena44XY5:rh5kpmWG29QFUmD
MD5:	540A7304A62ABB8D7F84454ABD6E2556
SHA1:	52C37529929218A668D7A4AD6FD1B5FE0A727E16
SHA-256:	94B2C14EF45C695EF6B19D94722E1BCBB629A595F2866DBA80F00A66721040B5
SHA-512:	3B535D109DB369E301D6B412F21EC990976B997826F22B2E16ECEEEB048D60F064C7CA1A616393DC2F1B491BAC0548DC0965B9EA149A95280FFDBCAD6726EF0F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Choibalsan) {.. {-9223372036854775808 27480 0 LMT}.. {-2032933080 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 36000 0 +09}.. {433778400 32400 0 +09}.. {449593200 36000 1 +09}.. {465314400 32400 0 +09}.. {481042800 36000 1 +09}.. {496764000 32400 0 +09}.. {512492400 36000 1 +09}.. {528213600 32400 0 +09}.. {543942000 36000 1 +09}.. {559663200 32400 0 +09}.. {575391600 36000 1 +09}.. {591112800 32400 0 +09}.. {606841200 36000 1 +09}.. {622562400 32400 0 +09}.. {638290800 36000 1 +09}.. {654616800 32400 0 +09}.. {670345200 36000 1 +09}.. {686066400 32400 0 +09}.. {701794800 36000 1 +09}.. {717516000 32400 0 +09}.. {733244400 36000 1 +09}.. {748965600 32400 0 +09}.. {764694000 36000 1 +09}.. {780415200 32400 0 +09}.. {796143600 36000 1 +09}.. {811864800 32400 0 +09}.. {828198000 36000 1 +09}.. {843919200 32400 0 +09}.. {8596

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Chongqing

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.865222436335267
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKh2V7/4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKho4wKU
MD5:	C5DC40C6325391F7247251ADB2C07F78
SHA1:	3DDB1BF94532FB1F1271095B9C8CAA779BC545EF
SHA-256:	A87382DC5F3C3141547A65E3746AF1DAF94B51468B96DA6CEF30E95754C97D37
SHA-512:	062FF8D5E5392E5372B0405EDF3C7CF997AC33F95EBFFAA9CC9AB82BBE27B60C80255FCCEE9E6F5E02CBFCB163F99984BB2103217FFD1F80BDEC5C684BF2F61A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chongqing) $TZData(:Asia/Shanghai)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Chungking

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.889115378893491
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFK7LeL9J4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wK7LUT4wj
MD5:	C3676771EB813B346F58A7B574D0D7B5
SHA1:	A473EF621309E019F29F3DEF95C38593775B8404
SHA-256:	D6D2B4A761C547F1F853AE901AC71AB49FBE825037079C4E0C89DC940AE4A822
SHA-512:	21C3A5D499E6E0427FBF585CA8CC5D99D193C586483AB107C4D8E9F9DC8412021E8E019A314757DAFE1225D2635F6D48E9C54A511709863F22A02449FA201E02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Chungking) $TZData(:Asia/Shanghai)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Colombo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	369
Entropy (8bit):	4.465596050904646
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKr+iDm2OHgoHvZv9tdvjSWV/FSQipPUrKkTD/k5QqRVVFSQOR/UIp:MB862zZmdHgCvZvJvj1Nj+Phkv/YtvjA
MD5:	9541BB43E79AB0C6E8163945B5BFB1BF
SHA1:	C4994420DB8313DECDE19B4B9F6C5DB0126A95A7
SHA-256:	E5B5E6D607A15DA65CB00C92C35A63EAF25F547E64CB34BB419CB8CFC2714B1B
SHA-512:	46F623B3F7CF8A50F97DD812521398EB9100C9CDFB967C18EF1BD112306AAEB3C9CB224424E48611CB8CC21D1DC3D820DD83032D12BC9DF19301CF07786FA664
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Colombo) {.. {-9223372036854775808 19164 0 LMT}.. {-2840159964 19172 0 MMT}.. {-2019705572 19800 0 +0530}.. {-883287000 21600 1 +06}.. {-862639200 23400 1 +0630}.. {-764051400 19800 0 +0530}.. {832962600 23400 0 +0630}.. {846266400 21600 0 +06}.. {1145039400 19800 0 +0530}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Dacca

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.786111096226559
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8ntyXHAIgN6KyFvRL/2WFK1S2WFKwBn:SlSWB9vsM3yHtSHAIgMKON/2wKM2wKwB
MD5:	BA575D37459540907A644438071277F8
SHA1:	14CF10D6AABBAF7BAE42B3B9641D8469C206567F
SHA-256:	B3AD560F66EA330E54A147017E6E6AB64452A5255D097B962D540836D7B19EE7
SHA-512:	9CA386EF4D812B00C2E63558B81B273F92BBCA98AF304C9FD6FC166210FC4E2F92B769E1D6FB96B670650DC76EFFAD2FC6E39AE12C24B47EAED4E50A2AFAC2D7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dhaka)]} {.. LoadTimeZoneFile Asia/Dhaka..}..set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Damascus

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8311
Entropy (8bit):	3.719987853637512
Encrypted:	false
SSDEEP:	96:8YI5WpVAdVGlkBOLh8X0CkBheIFlPup7YI6z0Y3lV9Jitv5F6Ya7vEzg93kn/R:8dIpqdk6BrqhXFlPUsz57AbV
MD5:	DCB84F498498C06953E7FC1A4FD9AF17
SHA1:	5B5A115CDA727C9439667E3E95CA3333E49BA810
SHA-256:	7D44F4C16E862752D399999B9F0B1E4E8ED5D80C1322A980094801DD8A4A03EB
SHA-512:	DC143B6DB263377413D4BBC9575236D525F6ED898934CB9A2FC1E3B32E1235F2D86BD8E133B38463DFC143EC2F6E8AA9184048479A4E797C39D63A1AD364BB74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Damascus) {.. {-9223372036854775808 8712 0 LMT}.. {-1577931912 7200 0 EET}.. {-1568592000 10800 1 EEST}.. {-1554080400 7200 0 EET}.. {-1537142400 10800 1 EEST}.. {-1522630800 7200 0 EET}.. {-1505692800 10800 1 EEST}.. {-1491181200 7200 0 EET}.. {-1474243200 10800 1 EEST}.. {-1459126800 7200 0 EET}.. {-242265600 10800 1 EEST}.. {-228877200 7200 0 EET}.. {-210556800 10800 1 EEST}.. {-197427600 7200 0 EET}.. {-178934400 10800 1 EEST}.. {-165718800 7200 0 EET}.. {-147398400 10800 1 EEST}.. {-134269200 7200 0 EET}.. {-116467200 10800 1 EEST}.. {-102646800 7200 0 EET}.. {-84326400 10800 1 EEST}.. {-71110800 7200 0 EET}.. {-52704000 10800 1 EEST}.. {-39488400 7200 0 EET}.. {-21168000 10800 1 EEST}.. {-7952400 7200 0 EET}.. {10368000 10800 1 EEST}.. {23583600 7200 0 EET}.. {41904000 10800 1 EEST}.. {55119600 7200 0 EET}.. {73526400 10800 1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Dhaka

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.412125512631861
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKwiDm2OHEmVFnoHv9vX+Yl7UIFckVVFSQiL/FG/UIvy/Ur9i/Ur97:MB862Y2mdHzdCv9P+Y9vvjeQlP9/9VkK
MD5:	B5496A038AC230B9D75AA22BB2BE6BDD
SHA1:	ACFD9C78F803F344272E8E188C41ED969EBADA16
SHA-256:	BFC4562055CC4355E79F9EFAA580A4C6A658285916159A5D390A0CDA96A97E98
SHA-512:	AB05D0176DADC1ED03CC526C372B9827A5FA03459E4F4B4365C6CE4B6FBDA043514A9D3FE2DA747159C5A1BC0E07727E6578A101E42B4DB120AF9624368C5FEA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dhaka) {.. {-9223372036854775808 21700 0 LMT}.. {-2524543300 21200 0 HMT}.. {-891582800 23400 0 +0630}.. {-872058600 19800 0 +0530}.. {-862637400 23400 0 +0630}.. {-576138600 21600 0 +06}.. {1230746400 21600 0 +06}.. {1245430800 25200 1 +06}.. {1262278800 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Dili

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.597480383845617
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKCXeSDm2OHnBGeoH1mpvyvScHTU71avScr:MB862qXbmdHnBvC1SyHHq8Hr
MD5:	316DDF860FA234621698EB473E558DB7
SHA1:	35BF955F764555945CF8B314B8E881DAD6CF557B
SHA-256:	8BC2E0D77AC35B6D63E11B820AC45EC23A4195ED773680C600C772FDF4B953F8
SHA-512:	D1A8D5F1DAAB7827BDCBC14506AF8681FD1ED94C6101CC4A3C8CC2A76EA7D3649038069158C539A2007A1B0734FBD87DE120415E07A3F08F44417100C95459F5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dili) {.. {-9223372036854775808 30140 0 LMT}.. {-1830414140 28800 0 +08}.. {-879152400 32400 0 +09}.. {199897200 28800 0 +08}.. {969120000 32400 0 +09}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Dubai

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.97292023820863
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKQUMXGm2OHvkdoHsQK23NVsRYovV:SlSWB9eg/2wKQUDm2OHvsoHxVNSN
MD5:	861BA4A0A71E6C3F71B90074275FD57C
SHA1:	BC6FC5233340BB19AE4BD0BA563875479AC0A2B9
SHA-256:	3DB174F1568BC23BF467A3DC7BAF8A2A2952B70653D4DE54F4DB391EC50B6925
SHA-512:	B187735E0783F299253D9F93E002AEFF131FCCA50FB3E04CF0545B334B051D5ED978108A47C6957B608F5F93ED4CC3D69751FE0F40413719EE1C0440CD49AC76
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dubai) {.. {-9223372036854775808 13272 0 LMT}.. {-1577936472 14400 0 +04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Dushanbe

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	820
Entropy (8bit):	3.969189280047274
Encrypted:	false
SSDEEP:	24:5we3dJvOt81FCuLqecDngO6jPvTpYy5T4TiFGDr:5BvdJqxiF0uGr
MD5:	9ABD0ECB5F3E738F49CDD1F81C9FF1A4
SHA1:	46B68C7BBD1BE9791B00128A5129AA3668435C93
SHA-256:	550DB44595F59D0F151BE4AF70D6FECE20580AB687EF45DE2A0A75FB2515AC80
SHA-512:	67E2B0EF216D509C4B6DD367519E0A733E54A7CA767D5F7960715E8056E61B7B633C7516D568544F55C9277E90412C1443B822C6EED3341C01F1BD9AA9476FA1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Dushanbe) {.. {-9223372036854775808 16512 0 LMT}.. {-1441168512 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 21600 1 +06}.. {684363600 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Famagusta

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7597
Entropy (8bit):	3.7170041442081203
Encrypted:	false
SSDEEP:	96:G3pv/7V6Aj8aZaNlK0UpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:G3v/AaaivBeRF+W35Syrwl9h5j
MD5:	F8E4BA3E260452AE13CF234E60149A62
SHA1:	8DDB08E2FDEEF6539EE0C0038B166908BFED16CD
SHA-256:	8CFE85C48FC22033411432F8B75EE4C097A5D84897698CB1AFD5AB51C47FF5A3
SHA-512:	487177411FB7E9F83AB9AAD84B685322B13A85784D4F90BB9C30F57BFAA6A9298E5C4F36C97444DE1117E51F85A62DC639D08B405460D071C2B29C898553E9A3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Famagusta) {.. {-9223372036854775808 8148 0 LMT}.. {-1518920148 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {622587

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Gaza

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8427
Entropy (8bit):	3.7517631589916043
Encrypted:	false
SSDEEP:	96:NyHSd2XK1GbJFp3gP0nPVl8dcqU/8O8pc1FlvaiSjxHe5PTisXNlDN3uMeVunBjq:NyyIgGbJv3dPAD7c1Flvai+4j/NKJ
MD5:	E539AE663A076DD9F1C6E927289DE5B1
SHA1:	855BCE0790A7259B01181861BCC748FE5F2815EB
SHA-256:	F030E2B3DBCA556C36602FBF234C7DB7D4F222D02CFAB192288E91E6A1BF3C90
SHA-512:	83E87396576A36455DF22EE809D71CBD18CDEC7F574A7AABFF6D5A21A71D2BE865B84105E2D72FD89F3C9AB19B66B6893F82934925E2311A8E6EAA015D6227F9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Gaza) {.. {-9223372036854775808 8272 0 LMT}.. {-2185409872 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-16580

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Harbin

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.86422571961583
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/2WFKwHp4WFKdy:SlSWB9vsM3yMPHAIgO8AN/2wKi4wKU
MD5:	1BCCB3578FADE993EE8B2C11EAC06CD8
SHA1:	CAEAB714E014CD5040C44E4603708B97BC0B03D4
SHA-256:	12811A7944B892E3D1C0B4B09057CC1899F28081B3CD47FFD248BA49BA308AF0
SHA-512:	1D791DC0E8F45359366DF33C2C337688D2E0E972A90F038733B840D28585505AEF542DDBAD014C9EA8C252048A588CD017DD67A84545A81EDB7C17E3B2E65092
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:Asia/Harbin) $TZData(:Asia/Shanghai)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Hebron

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8402
Entropy (8bit):	3.754379249421927
Encrypted:	false
SSDEEP:	96:fXSd2XK1GbJFp3gP0nPVl8dcqUZ8O8pc1FlvaiSjxHe5PTisXNlDN3uMeVunBj5w:fiIgGbJv3dPADPc1Flvai+4j/NKJ
MD5:	02B58C89D64C423A47559B2386FDAD1F
SHA1:	B01C4C83ACB44F454A593A510BCBB5A4068EC835
SHA-256:	2C126BA5F78CF7A13FBDFE00F647BB29E2AC104B89AB51B39281047D9B2E45A7
SHA-512:	BBF564FBBDF90091F4D97F3DCFA0F2AF1CE6EB6B0D24CE4F4133E098F7A637344A78BB27DD8160D8424148ECB46B7BF578959B15F9AA0AEAD5D080DCE7C9C176
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hebron) {.. {-9223372036854775808 8423 0 LMT}.. {-2185410023 7200 0 EEST}.. {-933638400 10800 1 EEST}.. {-923097600 7200 0 EEST}.. {-919036800 10800 1 EEST}.. {-857347200 7200 0 EEST}.. {-844300800 10800 1 EEST}.. {-825811200 7200 0 EEST}.. {-812678400 10800 1 EEST}.. {-794188800 7200 0 EEST}.. {-779846400 10800 1 EEST}.. {-762652800 7200 0 EEST}.. {-748310400 10800 1 EEST}.. {-731116800 7200 0 EEST}.. {-682653600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Ho_Chi_Minh

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.419283016412891
Encrypted:	false
SSDEEP:	12:MB862RLmdHqCv3tYC5sF/p+zHHviViksF/dMUYPsF/RQ9EsV:5debv3td5sFR+znv2vsFlM/PsFVsV
MD5:	5154581E724080F43C9D68B983C5CF77
SHA1:	1BC86A418AA654DA9EF73954DFD01ACF53D796E9
SHA-256:	FE977368691F4FA43D068CD8D989F39D2AEC46D199D7D629B8DD3ECF7423A335
SHA-512:	3708654E022919D5CDC2CA90D8623370CFFF248E3AF10ECCBB6F56BC7E8DD000E6119614C30678D6628BBE6A8CCA00746315108A04632B3F6DD2DE172BBF8956
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ho_Chi_Minh) {.. {-9223372036854775808 25600 0 LMT}.. {-2004073600 25590 0 PLMT}.. {-1851577590 25200 0 +07}.. {-852105600 28800 0 +08}.. {-782643600 32400 0 +09}.. {-767869200 25200 0 +07}.. {-718095600 28800 0 +08}.. {-457776000 25200 0 +07}.. {-315648000 28800 0 +08}.. {171820800 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Hong_Kong

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2226
Entropy (8bit):	4.0055033036300145
Encrypted:	false
SSDEEP:	48:5Ze9l9Pm4yoHtTYJJIX1Zcp6GS0j1SPQpP6gPE8fTZIPNYQGm75st/nQdwi9:DyaoTcwQt6EsQTng
MD5:	26BCBBA28AE34FE3CF7D17EF4C6B69C8
SHA1:	5324DEA8E7965C66650E7B4769EFA1297B508486
SHA-256:	EE9A6997BC1AAD4A8FA95DB312774C3F37FBB895549230C30FC66C02CC170EB6
SHA-512:	54594CD18838B4A8947EBB5BDE2415727CC127CF79AEC98FC0F5D5A32F68EEAF4E079853239DE9F753CE90F18EFD55AE51FC43D64E313666CEA0EF8AC93BF065
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hong_Kong) {.. {-9223372036854775808 27402 0 LMT}.. {-2056690800 28800 0 HKT}.. {-900910800 32400 1 HKST}.. {-891579600 30600 1 HKWT}.. {-884248200 32400 0 JST}.. {-761209200 28800 0 HKT}.. {-747907200 32400 1 HKST}.. {-728541000 28800 0 HKT}.. {-717049800 32400 1 HKST}.. {-697091400 28800 0 HKT}.. {-683785800 32400 1 HKST}.. {-668061000 28800 0 HKT}.. {-654755400 32400 1 HKST}.. {-636611400 28800 0 HKT}.. {-623305800 32400 1 HKST}.. {-605161800 28800 0 HKT}.. {-591856200 32400 1 HKST}.. {-573712200 28800 0 HKT}.. {-559801800 32400 1 HKST}.. {-541657800 28800 0 HKT}.. {-528352200 32400 1 HKST}.. {-510211800 28800 0 HKT}.. {-498112200 32400 1 HKST}.. {-478762200 28800 0 HKT}.. {-466662600 32400 1 HKST}.. {-446707800 28800 0 HKT}.. {-435213000 32400 1 HKST}.. {-415258200 28800 0 HKT}.. {-403158600 32400 1 HKST}.. {-383808600 28800 0 HKT

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Hovd

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	3.7521760184466206
Encrypted:	false
SSDEEP:	24:5x3LecCvgsFFFKOksF8FpsF71FQnsFNFxhsFlF6sFaFasFZFisF8GF5sFKLFAZsZ:5FqKVx8Cq9f/y2L
MD5:	A77140A0D8C2D3E2993E4BA7CADFB4C6
SHA1:	AE3586264A86D42F578D4B0F7A30C9BE6047EAB1
SHA-256:	CA88A45E954A9854C680B399E69E4858BF5E861FABFADC19D62D97B734B25415
SHA-512:	05EA9D903EEC755F799B7C2399ED933245A5AE3A594648FE37AF1CE7699AE499B4ED159F428D91259D80BC9AF5117F2DA055A506AED94E5281C38B7AFF69C6FE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Hovd) {.. {-9223372036854775808 21996 0 LMT}.. {-2032927596 21600 0 +06}.. {252439200 25200 0 +07}.. {417978000 28800 1 +07}.. {433785600 25200 0 +07}.. {449600400 28800 1 +07}.. {465321600 25200 0 +07}.. {481050000 28800 1 +07}.. {496771200 25200 0 +07}.. {512499600 28800 1 +07}.. {528220800 25200 0 +07}.. {543949200 28800 1 +07}.. {559670400 25200 0 +07}.. {575398800 28800 1 +07}.. {591120000 25200 0 +07}.. {606848400 28800 1 +07}.. {622569600 25200 0 +07}.. {638298000 28800 1 +07}.. {654624000 25200 0 +07}.. {670352400 28800 1 +07}.. {686073600 25200 0 +07}.. {701802000 28800 1 +07}.. {717523200 25200 0 +07}.. {733251600 28800 1 +07}.. {748972800 25200 0 +07}.. {764701200 28800 1 +07}.. {780422400 25200 0 +07}.. {796150800 28800 1 +07}.. {811872000 25200 0 +07}.. {828205200 28800 1 +07}.. {843926400 25200 0 +07}.. {859654800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Irkutsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2089
Entropy (8bit):	3.7296034934492694
Encrypted:	false
SSDEEP:	48:5PZy4DdOKStci4KjXoYjoSvfQJWE00dtT43kgiTskNrrBizhzRBqY3M:Py2/svfraBGfgP
MD5:	C9F7AC464970567E5C38CB01ED2297AE
SHA1:	453718BACCAE3FACD761AF22CA5875185478ADDD
SHA-256:	61BAAAD6315FFBDAED6F266880165B06ECCAF72F660B7FB01C8B654F3952D68E
SHA-512:	72044EFAE262CC12974F2DE2AAF06AC4C31BE73071ACD53DDC6B8D8BFC6FBDF937EC03DC881901F730659BDE662FBCFC76C57B2C086DAA97F160530464FBA7C6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Irkutsk) {.. {-9223372036854775808 25025 0 LMT}.. {-2840165825 25025 0 IMT}.. {-1575874625 25200 0 +07}.. {-1247554800 28800 0 +09}.. {354902400 32400 1 +09}.. {370710000 28800 0 +08}.. {386438400 32400 1 +09}.. {402246000 28800 0 +08}.. {417974400 32400 1 +09}.. {433782000 28800 0 +08}.. {449596800 32400 1 +09}.. {465328800 28800 0 +08}.. {481053600 32400 1 +09}.. {496778400 28800 0 +08}.. {512503200 32400 1 +09}.. {528228000 28800 0 +08}.. {543952800 32400 1 +09}.. {559677600 28800 0 +08}.. {575402400 32400 1 +09}.. {591127200 28800 0 +08}.. {606852000 32400 1 +09}.. {622576800 28800 0 +08}.. {638301600 32400 1 +09}.. {654631200 28800 0 +08}.. {670356000 25200 0 +08}.. {670359600 28800 1 +08}.. {686084400 25200 0 +07}.. {695761200 28800 0 +09}.. {701805600 32400 1 +09}.. {717530400 28800 0 +08}.. {733255200 32400 1 +09}.. {748

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Istanbul

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.9013773460609
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/2WFK4HB/8QaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/2wK4HJa
MD5:	8A92C690BE27A69D122BFF51479B7B56
SHA1:	52DB64587A347F34153A51788BDE8C349D966575
SHA-256:	1F77C4BD27574E1D2066885DEF01806A02D3E444424A219A8EC5C114F89665E5
SHA-512:	FEDF57C4862B6792A789F339EB1027EC8A8472B01B7D1D0814C419850B9AC03A7B454FDB04D8BECE166E9A8BCAA58B0B461007A6C824B30B1080991A1DB49CCA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Jakarta

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	370
Entropy (8bit):	4.4733192761103515
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKcrJfDm2OHATJeoHMaSYov/YSZkc5q/MVSSFFWSyvScH+dMVSSFL+:MB862EJLmdHjCEdOc5aMxaSyHHaMxF6P
MD5:	C689A1AA9FFE535AEB3AD3D7EDE55172
SHA1:	0520FC9A4619FB555A79C5DF2AE82422BF2C5EDA
SHA-256:	2F39D9F93761B85C254F458317A7DE2B4184BE9459F2193A85C08662E801269A
SHA-512:	C1034FB2FCFEF201C5362AF21B048B6637A824C5C93D75854CF3807892C772CD4376533E58BFF8D8726F531F43CB231365B8012EBD3C1BECED865D3CD2D6673D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jakarta) {.. {-9223372036854775808 25632 0 LMT}.. {-3231299232 25632 0 BMT}.. {-1451719200 26400 0 +0720}.. {-1172906400 27000 0 +0730}.. {-876641400 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 25200 0 WIB}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Jayapura

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	213
Entropy (8bit):	4.834345288972067
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKcaDm2OHG4YoH1kcfvScHVowkVcr2CV4zvhyov:MB862PmdHNYC6cfHHVop2NVkoov
MD5:	2CB3A13FCC48F8C4457E001FC309918B
SHA1:	83174176815CB93D216B5BC532C120EC8AC433CF
SHA-256:	761C1E80FEBF46D6D6215CEBF211F121974156D9BCE2FB4258C1074C6ED2CE22
SHA-512:	65009020AB9FEC2F8158A4851A78B71127F9B262DDD1472583942E19B7C086304F54BC8DAE5A40BD1448BCAEDA0FDBACCD19400E10FFA0357E324535F9036EF0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jayapura) {.. {-9223372036854775808 33768 0 LMT}.. {-1172913768 32400 0 +09}.. {-799491600 34200 0 +0930}.. {-189423000 32400 0 WIT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Jerusalem

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8135
Entropy (8bit):	3.770028446231146
Encrypted:	false
SSDEEP:	96:GKfnxFAEX/nPVl8diAg9oEhH20AHz7LzdWhYbBJPXuVhKaM76Rmg4DLeEcNptv5C:7ffBvPAzF0AHzPzdD1+XBRF0
MD5:	884227D48C92BA6C519BFE571D4F1037
SHA1:	21F8977816C2B439686A50D353B836A6D132A946
SHA-256:	0BDC2C693134199C2ECD374CC01468813DB29DF47422C706A3EA2BE5ECCA177A
SHA-512:	8A09F1FE11DAD203501A16FE6A2CAEC969FE3553B456B8BD1997E55B3EE430B2BB4B54F7D87C5E99931FD96E7C769CAA618C777EBD23FBD1E1A0F57409422914
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Jerusalem) {.. {-9223372036854775808 8454 0 LMT}.. {-2840149254 8440 0 JMT}.. {-1641003640 7200 0 IST}.. {-933638400 10800 1 IDT}.. {-923097600 7200 0 IST}.. {-919036800 10800 1 IDT}.. {-857347200 7200 0 IST}.. {-844300800 10800 1 IDT}.. {-825811200 7200 0 IST}.. {-812678400 10800 1 IDT}.. {-794188800 7200 0 IST}.. {-779846400 10800 1 IDT}.. {-762652800 7200 0 IST}.. {-748310400 10800 1 IDT}.. {-731116800 7200 0 IST}.. {-681955200 14400 1 IDDT}.. {-673228800 10800 1 IDT}.. {-667958400 7200 0 IST}.. {-652320000 10800 1 IDT}.. {-636422400 7200 0 IST}.. {-622080000 10800 1 IDT}.. {-608947200 7200 0 IST}.. {-591840000 10800 1 IDT}.. {-572486400 7200 0 IST}.. {-558576000 10800 1 IDT}.. {-542851200 7200 0 IST}.. {-527731200 10800 1 IDT}.. {-514425600 7200 0 IST}.. {-490838400 10800 1 IDT}.. {-482976000 7200 0 IST}.. {-459388800 10800 1 I

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Kabul

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.8546989169864085
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKTtNMXGm2OHodFxsYoHvgVHURRNVsRYovFFFkdj/cXHF:SlSWB9eg/2wKTPDm2OHoH+YoHvgVHURA
MD5:	9BD9B21661C235C0794078EC98978D3B
SHA1:	3D854780F49D0E5F5A190DC9367C7406127C5E4D
SHA-256:	A59C95C038F2E945D685D96FA9B859CE82A643A1B7F56EB36B2C809DE91CD4BA
SHA-512:	A76E99CF03DA8897F0A210A98DB79E4CD60070F2BE363D0D0960D9882919F9B49978FA55BB2500F1648ADD4080730CAD85BAFF61D885A9EAD394AC04C850F6BA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kabul) {.. {-9223372036854775808 16608 0 LMT}.. {-2524538208 14400 0 +04}.. {-788932800 16200 0 +0430}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Kamchatka

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	3.788131608921229
Encrypted:	false
SSDEEP:	24:5+SeWI/2kkWk7YFpR2kHmxCcUdBbcHDLV2vpXt25A0UeRr9ydzkMfF6USRWk9UuV:5i/2ZsFLrcZwvJt2F+doTr9Q3G80
MD5:	390F39934F095F89358B73D056D90264
SHA1:	6B57CE5346B50ED88BFBB6BC57F834FB3F564905
SHA-256:	6E0278E389072437BC07A5032CD58E9E5B1B2BDB20918632C422EFA97BC43ABF
SHA-512:	6C54D94E95D73030F2FFCF8D130494CBD79FB1CEB9B59ADE0743C10F02557C3DD59CC6274B262A7E29C2D4C35DDA4B6A9A0398C661F5BD40F3B92181192B9577
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kamchatka) {.. {-9223372036854775808 38076 0 LMT}.. {-1487759676 39600 0 +11}.. {-1247569200 43200 0 +13}.. {354888000 46800 1 +13}.. {370695600 43200 0 +12}.. {386424000 46800 1 +13}.. {402231600 43200 0 +12}.. {417960000 46800 1 +13}.. {433767600 43200 0 +12}.. {449582400 46800 1 +13}.. {465314400 43200 0 +12}.. {481039200 46800 1 +13}.. {496764000 43200 0 +12}.. {512488800 46800 1 +13}.. {528213600 43200 0 +12}.. {543938400 46800 1 +13}.. {559663200 43200 0 +12}.. {575388000 46800 1 +13}.. {591112800 43200 0 +12}.. {606837600 46800 1 +13}.. {622562400 43200 0 +12}.. {638287200 46800 1 +13}.. {654616800 43200 0 +12}.. {670341600 39600 0 +12}.. {670345200 43200 1 +12}.. {686070000 39600 0 +11}.. {695746800 43200 0 +13}.. {701791200 46800 1 +13}.. {717516000 43200 0 +12}.. {733240800 46800 1 +13}.. {748965600 43200 0 +12}.. {764

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Karachi

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	457
Entropy (8bit):	4.396286144160272
Encrypted:	false
SSDEEP:	12:MB862dmdH35Cy6DvjeQXvjKEn6vNEhFc0bkTfb2iWToN1:5de3IjjeQ/jKE6vNNa8
MD5:	DF604BCD42A3C1E6BABD0E4FF5764CA3
SHA1:	984111F3A75EE7D8760AA2B839010545AF8EE359
SHA-256:	4E7F7ACAE8B4018A835328744F680C8054771805BB0BB07678A09737963C090D
SHA-512:	690AC3FC7CA3C66AA70F17E38C6B43FFACAB3F86040C3BA94FBFF80AC8C1AECF8192E503282109DABF3228F8DC73C732F1041C80455B8B26BDB25C4C32FA286A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Karachi) {.. {-9223372036854775808 16092 0 LMT}.. {-1988166492 19800 0 +0530}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 +0530}.. {-576135000 18000 0 +05}.. {38775600 18000 0 PKT}.. {1018119600 21600 1 PKST}.. {1033840800 18000 0 PKT}.. {1212260400 21600 1 PKST}.. {1225476000 18000 0 PKT}.. {1239735600 21600 1 PKST}.. {1257012000 18000 0 PKT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Kashgar

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.967143524972358
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8s4YkyXHAIgNrYOARL/2WFKu3e2WFKjov:SlSWB9vsM3yMGSHAIgvAN/2wKulwKjy
MD5:	259662F35AA09A891C2DDF8FCFECD6F0
SHA1:	DBB3A363A34C33F0B6B0D677E43C2985E2BAF976
SHA-256:	7B2251F0A41CBADF45D69F24604834167B14D8D33B510E635719AB404CABBCE2
SHA-512:	CD7E514555D58985C774535556B66542EFC5FB7CD5891F42FE21B591612CB7EBD4B41E96593E26E9283BA1B01EF3BE0FDFAE871F5EF6ADF2286AF1E479DCB44B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Urumqi)]} {.. LoadTimeZoneFile Asia/Urumqi..}..set TZData(:Asia/Kashgar) $TZData(:Asia/Urumqi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Kathmandu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.896398105471451
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKXIi7hvXMXGm2OHF+VT5oHsQKwMTXvv6Q6zRk8P4VvW/:SlSWB9eg/2wKYghfDm2OH0T5oHxNMzv8
MD5:	7AC6429D2A08372C71C61B4521246FEC
SHA1:	6E50F5AD1018398491453D751F8B717B618EF46E
SHA-256:	F0A0816E62036637F75081CBF17A1E6B8FBC2D86AEC3CD2E234BBBDD6EC9F109
SHA-512:	A5389A318896ABCAFE419262F6B8CA86C917788F1E2AFBC8CB1C074A52870E7A92C9F6F7D79DDE4AB0D267D870D3CCD69B3FC5FD57520352EFE36C583B493FB9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kathmandu) {.. {-9223372036854775808 20476 0 LMT}.. {-1577943676 19800 0 +0530}.. {504901800 20700 0 +0545}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Katmandu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.8363583658476745
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8yIi7V5XHAIgN1AIilvWARL/2WFKSiZ1/2WFKXIi7y:SlSWB9vsM3y7gVJHAIg5QOAN/2wKSg15
MD5:	4CCC96293A33113D9ADC4130DCD19CBA
SHA1:	7BAB4B8DD6BB415A2FC86D9AB36BE2A893C03153
SHA-256:	9ACC9586B6F8B53BFE8B242283A434A9A9633D60559EBFDEE263B4C8915D50CA
SHA-512:	644E1777E01C15A728E30526F131462FCE50476A8FEDA9B99F41D95013BB8833A79437E75AA2025E2FD2E253B9AD40709DEF77E1F0C73DAAE7A9CF886A175A03
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Kathmandu)]} {.. LoadTimeZoneFile Asia/Kathmandu..}..set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Khandyga

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	3.707911838150672
Encrypted:	false
SSDEEP:	48:5No6r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFYkRDhUBAc6l:r5PhtjLiII2JBC6c6l
MD5:	D7B394A9662D60D01781005FE73CC9E8
SHA1:	50B5EBD02596DC45D1F69358C5B69DD3058905FC
SHA-256:	33203D7FB7F3D1F848640ECE0642A2305E1863B4D47413075E2E7E40BD7418E7
SHA-512:	055EBA420F2F6049E803796ACCA263264B9E585E5312A86B8DF7B409C5F1CB1810F3AEDACD66CCF4605E55198947D263C240486C2A4D453D23C89802F0C66BBA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Khandyga) {.. {-9223372036854775808 32533 0 LMT}.. {-1579424533 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {7647

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Kolkata

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	336
Entropy (8bit):	4.614218930153471
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKvhfDm2OHEX3gYoHrXdUvvYbQLpUFdvjSVVFJLNsR/QFckVVFJLLW:MB8623tmdHNYCDWXYbQtUTvjAJBs50vs
MD5:	248F1B5A26455000C936CE8BC02C1A0B
SHA1:	0C3F8CD4E038B113E5238AC52652809B6CA27999
SHA-256:	6D464564ED2EFC9DADA1586D4FC99FE333726D2BE15A00E30C2391F588896463
SHA-512:	AF36B0B3D410305ED504726C87265ACCAF5577A9B5DD7E7DAF135420E356C651287873197431B65B5317B4BA2009274288E4F101AC1274045A8D99E2414AB132
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kolkata) {.. {-9223372036854775808 21208 0 LMT}.. {-3645237208 21200 0 HMT}.. {-3155694800 19270 0 MMT}.. {-2019705670 19800 0 IST}.. {-891581400 23400 1 +0630}.. {-872058600 19800 0 IST}.. {-862637400 23400 1 +0630}.. {-764145000 19800 0 IST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Krasnoyarsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	3.7086418466382605
Encrypted:	false
SSDEEP:	24:5Ote2CoXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEw:5B40yVRB7VfXucydm46I/CTxwh
MD5:	A59F7FFD0C3EBAD47EC5F2B89EBBD9FA
SHA1:	ACB94E28E0CF7C6606086267CEA1F63A3E755F56
SHA-256:	53B8D5E7FB1BD67FECE66A933D9BDBB773F14A8C04D316A2A1B00EC6DBC151DD
SHA-512:	7B3886B9D0A793CCEEDB2B190523922CFEBE5C82A5201C9EFA30CA4C7F63FB75C998CC7E1BD48D5D489F16E36FC0C22BD954CB7D321B3C09B36B60629C4C9F7E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Krasnoyarsk) {.. {-9223372036854775808 22286 0 LMT}.. {-1577513486 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Kuala_Lumpur

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	375
Entropy (8bit):	4.4690470842439005
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wK1NSDm2OHroHvmdXjvWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScy:MB862PGmdHrCvovDTMsF/CFDMx/HHbMj
MD5:	5CFF42C943FFC92D16DACEB2872590A8
SHA1:	AEA8B1583764BE2AF7B055BC6AFAA0E486A2E35F
SHA-256:	25A8328B309B68DA85C7A800086A1E4D3C62B96AD97FEF24FC429A14C50E762B
SHA-512:	27800D0401E8D2028730B9664E9489B6A5182C394C2C05509E195D4471B4ABEFC26C82E9B818E94BD5578109728CD891FFE3C156248706A50D792D12A6CD8C96
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuala_Lumpur) {.. {-9223372036854775808 24406 0 LMT}.. {-2177477206 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Kuching

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	669
Entropy (8bit):	4.074079100812583
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKPLBDm2OHXoH3UTdMVSSFVM5qGeCiKaFzsBRcerUNwGvULhMXeiCs:MB862HL1mdHXC3UBMxJJo9rphTXUzHHF
MD5:	489E706324960E86B6E174D913C72E02
SHA1:	C7D77482C0D41F3426FC269B3B6C0575EF0E8C7E
SHA-256:	6E35E560675B0B5322474900D4EC8326C504788C1F82E533B09785DEEFF092DF
SHA-512:	5CEFD44656C041E59A16481E042EA914E7C003BDE6ADF5F49B57052E91F4F732A91A244BD8BC09EF5DC2640D3210DEE53882717C5C4CBD85CCE44A93B028E9C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Kuching) {.. {-9223372036854775808 26480 0 LMT}.. {-1383463280 27000 0 +0730}.. {-1167636600 28800 0 +08}.. {-1082448000 30000 1 +08}.. {-1074586800 28800 0 +08}.. {-1050825600 30000 1 +08}.. {-1042964400 28800 0 +08}.. {-1019289600 30000 1 +08}.. {-1011428400 28800 0 +08}.. {-987753600 30000 1 +08}.. {-979892400 28800 0 +08}.. {-956217600 30000 1 +08}.. {-948356400 28800 0 +08}.. {-924595200 30000 1 +08}.. {-916734000 28800 0 +08}.. {-893059200 30000 1 +08}.. {-885198000 28800 0 +08}.. {-879667200 32400 0 +09}.. {-767005200 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Kuwait

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.877362838821003
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8t14XHAIgNsM13oOARL/2WFKdQWFK81Fn:SlSWB9vsM3yN14HAIgaM1YOAN/2wKdQ6
MD5:	EA1DB4B80CC74CBA024B9BF3734B31F2
SHA1:	D8131C093BCA3B378BEC606CFEB56A40CB4E246F
SHA-256:	8E0C60A9AA64FB8602EDC35311F7436B04853970A21C1F6C871494A09AAD5787
SHA-512:	3B57C9CCC16AA4FE71D275D5EC6A7BC1838841023EE4408158362A7E13E7F1B345F7D95006BC8D2FC270158864E286A1A9364C792F679D5803BD82148399C199
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Riyadh)]} {.. LoadTimeZoneFile Asia/Riyadh..}..set TZData(:Asia/Kuwait) $TZData(:Asia/Riyadh)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Macao

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.781739054385376
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8PWXHAIgNz+NOARL/2WFKf+WFKkvn:SlSWB9vsM3yOHAIg1AN/2wKGwKmn
MD5:	55DAE27AEAA74FE822338C20B6CDFF68
SHA1:	F00EB827DC29EB2063B3A0EDBC39856637C55F33
SHA-256:	4308D741C83B263C7C9FB8EC692A7B7B502135E407B265B12EA7EF92523455C0
SHA-512:	398EE6015C58BDBBEAB49B74833B938FD84DE1AC6D3B8D095CE772ECA980D9E93F4EBFFFFCEAE7F91E287C8CE4F94B1A078D8E1460C352B7C2018F99915838FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Macau)]} {.. LoadTimeZoneFile Asia/Macau..}..set TZData(:Asia/Macao) $TZData(:Asia/Macau)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Macau

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	3.9638741177777868
Encrypted:	false
SSDEEP:	24:5ReCX8Iv3nhPHCvzncCHg9PHjZzH+0HDHN1aHhHNaezHBjHeHsH65H18HDH983lY:5d8u3hfCTcaOrh6qn151Wf3Bogp+nlC
MD5:	B184E7403CB7168607D2C9E158F86A3B
SHA1:	48B003B8F822BE979FBCB08CBDBFFC617BCF99DB
SHA-256:	FBCB92CECB1CB0BC284ADC30D70C5F57B3AFC992136A0D898ABC64490BB700FB
SHA-512:	D8C5C67CAEB7C670B7BD1DACC1203C4DEE4DDB16A780F502C4440997CFCFF869E86842EF87C2CD0E0B942941C02A6BC3BDAB7CEAD78B026B68F4A031173400C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Macau) {.. {-9223372036854775808 27250 0 LMT}.. {-2056692850 28800 0 CST}.. {-884509200 32400 0 +09}.. {-873280800 36000 1 +09}.. {-855918000 32400 0 +09}.. {-841744800 36000 1 +09}.. {-828529200 32400 0 +10}.. {-765363600 28800 0 CT}.. {-747046800 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716461200 32400 1 CDT}.. {-697021200 28800 0 CST}.. {-683715600 32400 1 CDT}.. {-667990800 28800 0 CST}.. {-654771600 32400 1 CDT}.. {-636627600 28800 0 CST}.. {-623322000 32400 1 CDT}.. {-605178000 28800 0 CST}.. {-591872400 32400 1 CDT}.. {-573642000 28800 0 CST}.. {-559818000 32400 1 CDT}.. {-541674000 28800 0 CST}.. {-528368400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-498128400 32400 1 CDT}.. {-478774800 28800 0 CST}.. {-466678800 32400 1 CDT}.. {-446720400 28800 0 CST}.. {-435229200 32400 1 CDT}.. {-415258200 28800 0 CST}.. {-403158600

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Magadan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	3.7643610103361134
Encrypted:	false
SSDEEP:	24:5he9dbbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKx/y:5wv+0j6lua2Gg/3gO8UoOZU2Wc/pKo
MD5:	F62A89F441C9C17EB99F64223C815651
SHA1:	408C38A79E056FF9B03D0DA85114DC015CB66938
SHA-256:	0C6EEEB7975A95C2B0678D137E6A735238D244A37FA11078050051511DE499FE
SHA-512:	55DC72546BDC26450D5318E9D2819E32A91C27D06A7AF5432BD50F8722C69984BBAA8599055A824D2935D919F0C0AA357687DD9B47F49F213EEE21AF7458FE17
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Magadan) {.. {-9223372036854775808 36192 0 LMT}.. {-1441188192 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Makassar

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	243
Entropy (8bit):	4.737440985553183
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wK5XDm2OHUVoHxYQTLQTvj1kc3gEpHkH8vScHr0:MB862hTmdHsCLTI6cQe7HHA
MD5:	9116C0B70AB33EC49F933EAE0238FD4B
SHA1:	BA390E8FBEAF5EA6E861AFC5A51CD4DF0B422461
SHA-256:	30D8AB00E32ECE51442C0310E650D89D6989E0809600EE334CB10C506D84BF9D
SHA-512:	499E60E8CBDA72226BCB4E241020E62B6F88E7D3E4329D260A6536EF87C02D7D61FD1BECC47D4FF308B4EB5D3E7FFBE2EC1C96FE2DEDC09DD1D973421C5FFE1E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Makassar) {.. {-9223372036854775808 28656 0 LMT}.. {-1577951856 28656 0 MMT}.. {-1172908656 28800 0 +08}.. {-880272000 32400 0 +09}.. {-766054800 28800 0 WITA}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Manila

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	421
Entropy (8bit):	4.48495488773916
Encrypted:	false
SSDEEP:	12:MB862GjmdHnCTZBCvEo6AwoucQzy4orjAbomAtoNv:5GjeCVwvB6AduXzylHAMmAa9
MD5:	0FBF0ED252638DF31826C33EB3FFBFE2
SHA1:	3496E4A5251A9BDF3AA4368297140780B6DBF66D
SHA-256:	070D61A0E39643A700ABA89A8A4BE5733BA456958966098405E11ECDFA854D76
SHA-512:	2A40E14964B357809E596DF88D8C4141ED78664BACA0A7724A7CA837EF427DC2B07C48D9DBE5787FAB0015673F5BDE002223D489334C5B91B74EEC5507A14B78
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Manila) {.. {-9223372036854775808 -57360 0 LMT}.. {-3944621040 29040 0 LMT}.. {-2229321840 28800 0 PST}.. {-1046678400 32400 1 PDT}.. {-1038733200 28800 0 PST}.. {-873273600 32400 0 JST}.. {-794221200 28800 0 PST}.. {-496224000 32400 1 PDT}.. {-489315600 28800 0 PST}.. {259344000 32400 1 PDT}.. {275151600 28800 0 PST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Muscat

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.805992552335358
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8DeXHAIgN6S7ARL/2WFKvE+H+WFKQ3n:SlSWB9vsM3yj+HAIgMS7AN/2wKLewKQ3
MD5:	8AEB5C3E81069F884A370714E8013F1F
SHA1:	4E3DD4A84627E75E84726C0CBA72CA6801280C2B
SHA-256:	011B7DE1C9F7EC241B224BC864D8AE66ACB433FBC8AD939E4DBEB12BE6390243
SHA-512:	50B1DE2615AE9B4781505DC709F9D07F6221D4E6D7B61D7BDA682377EAD9807F47FF0E933B79823D0DFD9F3647A82CFC28FB41FBB2226ED1D08B76F86FEB45DC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Dubai)]} {.. LoadTimeZoneFile Asia/Dubai..}..set TZData(:Asia/Muscat) $TZData(:Asia/Dubai)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Nicosia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7625
Entropy (8bit):	3.7113086720696398
Encrypted:	false
SSDEEP:	96:R3pv/7V6Aj8aZaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0l:R3v/AauivBeRF+W35Syrwl9h5j
MD5:	2ADD0DFC1F133E4D044727234251A3DC
SHA1:	0D1502986258349E384017BA6CB8FA0AC424638C
SHA-256:	3C3E4844C70D361893EF022D6C3C8E38B243E91D40C5A726C924355476816F25
SHA-512:	70CDD53E7E44EDABF653A4F92EECBF5BB20A31DA95D65209D1CADE7DD9FC68946B8EC8829C28AE00BE5F42AAB545B9282CBBCFC5834437D6A94A179BF4FE0141
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Nicosia) {.. {-9223372036854775808 8008 0 LMT}.. {-1518920008 7200 0 EET}.. {166572000 10800 1 EEST}.. {182293200 7200 0 EET}.. {200959200 10800 1 EEST}.. {213829200 7200 0 EET}.. {228866400 10800 1 EEST}.. {243982800 7200 0 EET}.. {260316000 10800 1 EEST}.. {276123600 7200 0 EET}.. {291765600 10800 1 EEST}.. {307486800 7200 0 EET}.. {323820000 10800 1 EEST}.. {338936400 7200 0 EET}.. {354664800 10800 1 EEST}.. {370386000 7200 0 EET}.. {386114400 10800 1 EEST}.. {401835600 7200 0 EET}.. {417564000 10800 1 EEST}.. {433285200 7200 0 EET}.. {449013600 10800 1 EEST}.. {465339600 7200 0 EET}.. {481068000 10800 1 EEST}.. {496789200 7200 0 EET}.. {512517600 10800 1 EEST}.. {528238800 7200 0 EET}.. {543967200 10800 1 EEST}.. {559688400 7200 0 EET}.. {575416800 10800 1 EEST}.. {591138000 7200 0 EET}.. {606866400 10800 1 EEST}.. {62258760

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Novokuznetsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2063
Entropy (8bit):	3.718004112421892
Encrypted:	false
SSDEEP:	24:526enddzXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFf:5l40yVRB7VfXucydm46I/CTxwf
MD5:	513B6A2AF76DAED9002C037BEC99862F
SHA1:	82D1C47BDF46B8B901C35BACACE8595C093BF5F2
SHA-256:	96A445D47D834C28480D1E2036ECA4962B35AFA494C219065D4879F71C1830DB
SHA-512:	2FE5AF4FA9D6AAB4FBD8E354789B82D39FA1B52394D3A0ABFBC6A30A531E0B7429A3D9AC7835A2843A6E9859E0255565F151FDFC87004ACB4EBD1AAD40BDA8A4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novokuznetsk) {.. {-9223372036854775808 20928 0 LMT}.. {-1441259328 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Novosibirsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2121
Entropy (8bit):	3.714792994893581
Encrypted:	false
SSDEEP:	24:52sve20ruXJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnF:5Hc40yVRB7VfXu0TKmtTTDOWQ
MD5:	AC8C8D768503C8334A9FBAEF4C3A9CAB
SHA1:	CA10BB99E2D7AB329229759BD4801068A3AEB6D5
SHA-256:	EF799077291F6B3B19E0AEC88F224BB592FAAD09D30740F2376D3D20F2169639
SHA-512:	34049B1AC4254F999C3E5AD8CB31ABF88AC2D972E20E19927F33CC59935354F92125A0342A413E64227E8AE29DDFC2FFE5F67AE538C89D8EBAD7FCA889321DFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Novosibirsk) {.. {-9223372036854775808 19900 0 LMT}.. {-1579476700 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {738090000 25200 0 +07}.. {7

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Omsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2055
Entropy (8bit):	3.6912374223526396
Encrypted:	false
SSDEEP:	24:5abexPvO1FMnFP1FCnFHnFKqenFdDnFQgOnFxjPnFITnFonFJynFAT4TBThSv0FP:5asvjdqxph01NSvPETKmtTTDO0
MD5:	3E06B20B0B62AA09FA03082FAEE4FD62
SHA1:	8886EC80528ECA13D3364138BFFE92F881768169
SHA-256:	2605CD1E26E4AB48BCB4399BB5B17BAD115A47F87BA3DD54B55BB50C3FE82606
SHA-512:	04C1B6A898D12C8EA1B0B2F6665C870434061C63CC8F7A067BFC708E9828BA2E60104B82E2025E42D51DA2F485890C4D34EC0341EF466A7942649BE64F5EEE17
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Omsk) {.. {-9223372036854775808 17610 0 LMT}.. {-1582088010 18000 0 +05}.. {-1247547600 21600 0 +07}.. {354909600 25200 1 +07}.. {370717200 21600 0 +06}.. {386445600 25200 1 +07}.. {402253200 21600 0 +06}.. {417981600 25200 1 +07}.. {433789200 21600 0 +06}.. {449604000 25200 1 +07}.. {465336000 21600 0 +06}.. {481060800 25200 1 +07}.. {496785600 21600 0 +06}.. {512510400 25200 1 +07}.. {528235200 21600 0 +06}.. {543960000 25200 1 +07}.. {559684800 21600 0 +06}.. {575409600 25200 1 +07}.. {591134400 21600 0 +06}.. {606859200 25200 1 +07}.. {622584000 21600 0 +06}.. {638308800 25200 1 +07}.. {654638400 21600 0 +06}.. {670363200 18000 0 +06}.. {670366800 21600 1 +06}.. {686091600 18000 0 +05}.. {695768400 21600 0 +07}.. {701812800 25200 1 +07}.. {717537600 21600 0 +06}.. {733262400 25200 1 +07}.. {748987200 21600 0 +06}.. {76471200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Oral

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	3.708603813141953
Encrypted:	false
SSDEEP:	48:53PvalvNhQQvmRKqv0fvzQIovWdvEGvDaDv7w9hYwr:JHaBNKs6b03zB0WJEuDa77w9hYA
MD5:	A3BD0C15642AE4F001F98F8E060E8374
SHA1:	366F3C7FD4000AC23B79AB0FF4429371ED323B81
SHA-256:	933BBCD7AE0BF59A5B4A6E0EF74C237FEEDC42E6A3AEB2158131AA70FBA6FE47
SHA-512:	16D8692D3EA96D3594E6220A6989BBFBB926A66EEBEB240C4DC68BE75C69C5206659D9D341D92AE6128928FD38A5F45B445621CBBBA4E4BA8C34C3AC52BF3C08
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Oral) {.. {-9223372036854775808 12324 0 LMT}.. {-1441164324 10800 0 +03}.. {-1247540400 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {701816400 14400 0 +04}.. {701820000 18000 1 +04}.. {717544800 14400 0 +04}.. {733269600 18000 1 +04}.. {74899440

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Phnom_Penh

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.958543249401788
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKeHKLNM0WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKTNg
MD5:	EBF01E229CC41EB8B27650A3D668EDC1
SHA1:	33E1B252C1B45EAE326FCF8CC7C80C78A46F7E8D
SHA-256:	DCEE88876D00396918F43DECA421B6C9B02F84B5866A2CE16E641B814B390A9F
SHA-512:	80840600F37A256B8FD9933760FBAE7C13DE1E24EFD970E47BE8DEC731DFABF6D6FB76999BEEC775FF8C8B8719E94788ED7EEB04376A34C827ACB443F720F7E3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Phnom_Penh) $TZData(:Asia/Bangkok)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Pontianak

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	369
Entropy (8bit):	4.492596995768464
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKT5PDm2OHUeoH99xV/1kc5k/MVSSFFCLkvScH+dMVSSFL1CnF4mMz:MB862L5bmdHFCRV/6c5kMxGLkHHaMxFn
MD5:	9ADB1A9E41A143A06116E24EA0A53D90
SHA1:	6E50B549E1A705C0090BD5EDE26F7DED78CDF71A
SHA-256:	AC8370AEDF5FE3FE1E80710CE117DEE23815BE377D418E4B4F3259A1930E8DBF
SHA-512:	92790B20B960AC518AB2E18F902C6E0BA887F268909F5571CAC1068F5E719CCF6943AE6902DA1B683E170658B5E7BE06C6A187C1C0A652DD052D5BD0B2A7B84D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pontianak) {.. {-9223372036854775808 26240 0 LMT}.. {-1946186240 26240 0 PMT}.. {-1172906240 27000 0 +0730}.. {-881220600 32400 0 +09}.. {-766054800 27000 0 +0730}.. {-683883000 28800 0 +08}.. {-620812800 27000 0 +0730}.. {-189415800 28800 0 WITA}.. {567964800 25200 0 WIB}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Pyongyang

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.709411633376997
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wK8cE4SDm2OHnNoH9Aw8vmVuT0vjLtcjviov:MB8620cExmdHnNCGv2Ezv
MD5:	727BBC1A1662B500F616F544A484F213
SHA1:	93C1D902D9D4AA4197C7D16C61FB784AC01D0DE5
SHA-256:	29BA17F756F5C0BBA30FEBF44E620504D04921C832BD1CB56E1B60EF288B57DF
SHA-512:	C3C91E2F180109FF33E6491722F679A1B8DCE8CD31DE006D7FF2CBE270C008E927507C953641D28EE77D139BBEA54DEA1B7DBD6C30B208DDAB1B58756C32AC02
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Pyongyang) {.. {-9223372036854775808 30180 0 LMT}.. {-1948782180 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-768646800 32400 0 KST}.. {1439564400 30600 0 KST}.. {1525446000 32400 0 KST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Qatar

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.851251407399968
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKK3ovXMXGm2OHPFV4YoHsQKb3VvVsRYovFFF3FRVGsWr:SlSWB9eg/2wKK3yXDm2OHoYoHxcvSNFS
MD5:	CBA9635133F88AD3B27E23B95430C27C
SHA1:	5E41232EC03BBC71B522F58CB2D05E6BFFFF1A75
SHA-256:	18CCA69F933795CE3F7DB31506EFC063E6CE1DFDCAB32AA387C398456D7F7E1F
SHA-512:	D7C43F1F9ADA54C914ADB3CB2C9063EB7044089CFC7755ACFD08828CDEBA3C116AE2BE916ABE5D561E63699B921BC52636DD0BBC2C4304F813616D320D7DDAAF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qatar) {.. {-9223372036854775808 12368 0 LMT}.. {-1577935568 14400 0 +04}.. {76190400 10800 0 +03}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Qostanay

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1668
Entropy (8bit):	3.7299735983334195
Encrypted:	false
SSDEEP:	48:5DwvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWyvNSvTqvIQvyovklvqQA:BMaBNKs6b03zB0WJEuDa7sFZiKWaN6TE
MD5:	F5DBE4E72FA5AB0019CC98C8E21EC86E
SHA1:	27ECB901AA07C18EA7F38235E8EFE0B1635FEFBC
SHA-256:	4191629B874C988291E8FD13E675A3ED685D677F6541313975FC4610E47F1DCD
SHA-512:	D5EFD4EFFFFE2E41909AEB7B67BD1FA6FAF4B8E9AC645518D5B33BD1B3C5084F59D47D4ED052E0D4B9F9989BDDBA3AECB3D1E67F5237914D24C01F9C95242396
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qostanay) {.. {-9223372036854775808 15268 0 LMT}.. {-1441167268 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {686095200 14400 0 +04}.. {695772000 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {7489

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Qyzylorda

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	3.734572151642808
Encrypted:	false
SSDEEP:	48:5NvalvNhQQvmRKqv0fvzQIovWdvEGvDaDvs5vZlovKWgvNSvTqvIQvyovklvqQX0:TaBNKs6b03zB0WJEuDa7sFZiKWcN6Tir
MD5:	026EC6E479EC006C4398288362254680
SHA1:	24AD03DD21DA394B3423D27211955BFD694F8E73
SHA-256:	CD6B067AA3EF6935B4E89CA36E6A03FCB97F1E0EE61A7B5D46C06BF4DE140774
SHA-512:	023AC55E118F13A31CE996C7BA155C90D47DEB6C223EEB3C0EE7B702871FF0CCA13CDF61D65FDDABE41B888CD7A74274AA5730059CC5688F8ED4DDBF8FE4ECA4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Qyzylorda) {.. {-9223372036854775808 15712 0 LMT}.. {-1441167712 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 14400 0 +04}.. {670370400 18000 1 +04}.. {701812800 18000 0 +05}.. {701816400 21600 1 +05}.. {717541200 18000 0 +05}.. {733266000 21600 1 +05}.. {748990800 18000 0 +05}.. {764

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Rangoon

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.812955128020714
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8nv3vXHAIgNnDA6RL/2WFK02KQMFfh4WFKsyn:SlSWB9vsM3yHvPHAIg15N/2wK0GEJ4wy
MD5:	BD3F294F1EDDD21467E980C9F5A0E7DE
SHA1:	11A3FC3E4489C18BDF9BFFB4C44615559D9DD99D
SHA-256:	E4D2C38D8E7377A528291A88129CDAC40CA4D40A5F1CD8ADB98228527556906E
SHA-512:	FA5FD600627793EABB83C1066BE246A47BCCE1FC57830596B9C0CDE8901B949AF178ABDE876C3B73CC3751312E8A4C03C390888B0B5A9669F511344143F83073
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Yangon)]} {.. LoadTimeZoneFile Asia/Yangon..}..set TZData(:Asia/Rangoon) $TZData(:Asia/Yangon)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Riyadh

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.973311159904374
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFK814PMXGm2OHFukeoHqUi9VssWYcv:SlSWB9eg/2wK81GDm2OHF7eoHvi9V1Wr
MD5:	AD3236CFF141732831732357AB181EE3
SHA1:	EAF51A63898A2048EA5FBE9BA4C001EEE37FFDB2
SHA-256:	411E31D09FFA48E44169C42661AE2F7FC142460BCAA216837D8C4740983CA7BD
SHA-512:	6CA2D89C02568580786BE98A863453ADCF4D21CAC52E5B44C4F7A05E76D29AEB3E28E353D6FB758BB553DBC8F35389462B388F61E94C68F5DB50A3E8C429336D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Riyadh) {.. {-9223372036854775808 11212 0 LMT}.. {-719636812 10800 0 +03}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Saigon

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.946090704619887
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8I65eV5XHAIgN2h6560ARL/2WFKwJ6h4WFK365ey:SlSWB9vsM3yJAVJHAIgA4k0AN/2wKl4i
MD5:	0766480A295525EE5D65F1ED32094858
SHA1:	7A2D68E1009DDD809A4A700931456C617DCD343A
SHA-256:	C695981A0DF691C3F4509999FBC52858ADC75024CCCBDEFBE1094FED17E809E4
SHA-512:	A21536FB61A64E953E8D6414FF0AEF1BC7E68A33C5DCF7090517A91FC449B96A93A4FBDF2C00682540D1193FDB29603349F5BDB455FD90045FDBCA61247A9860
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ho_Chi_Minh)]} {.. LoadTimeZoneFile Asia/Ho_Chi_Minh..}..set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Sakhalin

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2117
Entropy (8bit):	3.7276904131666577
Encrypted:	false
SSDEEP:	48:5q+3Vv+0j6lua2Gg/3gO8UoflcXRDhUBAc+:YxIa2GOT8tiXBC6c+
MD5:	295D51B8FBBE890C97637687B8F32322
SHA1:	7BB72B0EC783898DDF625D275E3BBB964D1693FB
SHA-256:	D7D0EA5CEF908442AB0D777A4B097BED18540CD5280FF63F33DD989E27E72908
SHA-512:	9B3E3BA01EAE38A00B0EE8A8FB17191CB4ED2EE9E46AE06403BA8C1193804764C86599840DC03E0C6A631456E1BE2BC560BDF6CF0450068EF78A6E494041326C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Sakhalin) {.. {-9223372036854775808 34248 0 LMT}.. {-2031039048 32400 0 +09}.. {-768560400 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {76469

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Samarkand

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	879
Entropy (8bit):	3.9460497720710506
Encrypted:	false
SSDEEP:	24:5t8eZd7QvalvNhQQvmRKqvzQfv7PQIovWxrvEGvDWdDvs5v/RlovKT10Sv6r:5MvalvNhQQvmRKqv0fvzQIovWdvEGvDO
MD5:	10A758996B0DF756E520541BEA9B7D75
SHA1:	137E5FD4E00CFA4B3939EF11868862B7F93D87CD
SHA-256:	35E4B905723891281D9A6A0A1FD3760A3A48136E1419C686BE31ACE83BF7AA9D
SHA-512:	7E32661731EAB2ED8C387533ACCB4853F5B6225BAC11E93247E7B06D7AA856E6A665F63718BFE395CFD00F80A4C16789D7097FFA8DAD88B1D707BF9C155C1D4C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Samarkand) {.. {-9223372036854775808 16073 0 LMT}.. {-1441168073 14400 0 +04}.. {-1247544000 18000 0 +05}.. {354913200 21600 1 +06}.. {370720800 21600 0 +06}.. {386445600 18000 0 +05}.. {386449200 21600 1 +05}.. {402256800 18000 0 +05}.. {417985200 21600 1 +05}.. {433792800 18000 0 +05}.. {449607600 21600 1 +05}.. {465339600 18000 0 +05}.. {481064400 21600 1 +05}.. {496789200 18000 0 +05}.. {512514000 21600 1 +05}.. {528238800 18000 0 +05}.. {543963600 21600 1 +05}.. {559688400 18000 0 +05}.. {575413200 21600 1 +05}.. {591138000 18000 0 +05}.. {606862800 21600 1 +05}.. {622587600 18000 0 +05}.. {638312400 21600 1 +05}.. {654642000 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Seoul

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	985
Entropy (8bit):	4.121802167517286
Encrypted:	false
SSDEEP:	24:5AemgvHzF+zg2c+z3NGmJhIUfqII8yHg/zoD:5F/nfWUBISHg/G
MD5:	A1DE6975DEA70D7241B5B3C43E1EA3AA
SHA1:	35EE563A2BCA77C761F7E878997763EA8D258040
SHA-256:	C4F82C94650572FE4D03BC1FE54CED8F4BF55DFBEE855D52DE3EA6378240AF93
SHA-512:	1639B0609115DBEA6A381986A732A5CA1523952AEF84843B4D714D5B2FF40B16C4166D8D60D31D4FC2C2BA34DED1F6DB39474336195603562265BDBF71687696
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Seoul) {.. {-9223372036854775808 30472 0 LMT}.. {-1948782472 30600 0 KST}.. {-1830414600 32400 0 JST}.. {-767350800 32400 0 KST}.. {-681210000 36000 1 KDT}.. {-672228000 32400 0 KST}.. {-654771600 36000 1 KDT}.. {-640864800 32400 0 KST}.. {-623408400 36000 1 KDT}.. {-609415200 32400 0 KST}.. {-588848400 36000 1 KDT}.. {-577965600 32400 0 KST}.. {-498128400 30600 0 KST}.. {-462702600 34200 1 KDT}.. {-451733400 30600 0 KST}.. {-429784200 34200 1 KDT}.. {-418296600 30600 0 KST}.. {-399544200 34200 1 KDT}.. {-387451800 30600 0 KST}.. {-368094600 34200 1 KDT}.. {-356002200 30600 0 KST}.. {-336645000 34200 1 KDT}.. {-324552600 30600 0 KST}.. {-305195400 34200 1 KDT}.. {-293103000 30600 0 KST}.. {-264933000 32400 0 KST}.. {547578000 36000 1 KDT}.. {560883600 32400 0 KST}.. {579027600 36000 1 KDT}.. {592333200 32400 0 KST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Shanghai

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	981
Entropy (8bit):	4.16042656890735
Encrypted:	false
SSDEEP:	24:5Te3vvZJzHjwH6kHp7FH32AzHjZBHNHlQHuHxmHUjH6zHj2HBHeC:5ovZZO7lLpT24
MD5:	A266AA43A84FD5E4890BC77AA4E240D0
SHA1:	CD88C5D451CD7D3F50C9B36FDD47C84D20377441
SHA-256:	3AABB42D9EFE95D906B7F34640E7815919A1A20979EBB6EC1527FCAA3B09B22A
SHA-512:	13AE48F58C9AF24002F0FE4F28BF96B10EE0ED293E0DE9D29BCEBAAE102B2EA818F42CA4069544A254C95444A48604EC57E6AB2BEBDA4B5E72C82B49E61AD0A0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Shanghai) {.. {-9223372036854775808 29143 0 LMT}.. {-2177481943 28800 0 CST}.. {-1600675200 32400 1 CDT}.. {-1585904400 28800 0 CST}.. {-933667200 32400 1 CDT}.. {-922093200 28800 0 CST}.. {-908870400 32400 1 CDT}.. {-888829200 28800 0 CST}.. {-881049600 32400 1 CDT}.. {-767869200 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-650016000 28800 0 CST}.. {515527200 32400 1 CDT}.. {527014800 28800 0 CST}.. {545162400 32400 1 CDT}.. {558464400 28800 0 CST}.. {577216800 32400 1 CDT}.. {589914000 28800 0 CST}.. {608666400 32400 1 CDT}.. {621968400 28800 0 CST}.. {640116000 32400 1 CDT}.. {653418000 28800 0 CST}.. {671565600 32400 1 CDT}.. {684867600 28800 0 CST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Singapore

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.436676898144829
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKfbSDm2OHxdoHvm5vWOb/MVSYyF/3MesF5XJSx0dMVSSFF8kvScHS:MB862nbGmdHDCvsvDTMsF/CFDMx/HHbe
MD5:	C3D13D921E4C6E475910E5080B761C32
SHA1:	8C5AE73C4098D03908E5D567FD7C4D827601D718
SHA-256:	05C76B58A4E356FD358E24FBC71FAE98DCB18C441C8D8CBB13A18D4F6E406062
SHA-512:	3A620597469D31577ECAAA098C95C244F0C288ABACE9E8964D8641154C1893967EFBD7211A41751D0D4CC1B0B9A2286F11738EFB7D01F110A4826BBE1844A2EA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Singapore) {.. {-9223372036854775808 24925 0 LMT}.. {-2177477725 24925 0 SMT}.. {-2038200925 25200 0 +07}.. {-1167634800 26400 1 +0720}.. {-1073028000 26400 0 +0720}.. {-894180000 27000 0 +0730}.. {-879665400 32400 0 +09}.. {-767005200 27000 0 +0730}.. {378664200 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Srednekolymsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	3.7913177223006698
Encrypted:	false
SSDEEP:	24:5HJeidmbv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxwy:5HSv+0j6lua2Gg/3gO8UoOZU2Wc/pKf
MD5:	B4FA38E884A85F6BD47C8BB02BB0500C
SHA1:	1DD135B79CC0D81C048D7B2C6BE0CF71171DD19E
SHA-256:	705D6D8360C2DCD51E909E39E1910FE876145220D151031612DA36B247207395
SHA-512:	2D32AAAF1BCC865B5F2810BFE0FB82BE98140BB5F2ECA1DA7FD148A3074DA127B81242F17B8BA9C9E259B61CBB123FD1513CCE6A85C8D7679ADFC0D689B552BB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Srednekolymsk) {.. {-9223372036854775808 36892 0 LMT}.. {-1441188892 36000 0 +10}.. {-1247565600 39600 0 +12}.. {354891600 43200 1 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Taipei

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	4.062084847879695
Encrypted:	false
SSDEEP:	24:5X2eIvZPzGzHjZBHNHlQHKn3HnHNd9HiHkHBHaHLHMtyH9Qm+zHFOzHZ32HZvHiR:5Xi1ypBvt1mwO3Kq46T
MD5:	AECA800C8F2A679D0B19E5BB90AFD858
SHA1:	2C7DCEB709F9A4312C511971FE1E6A9DC1FBD0E8
SHA-256:	389C9D3EE2970665D0D8C5CB61B8B790C5FBDDC0DF0BF2B9753046F5953A477F
SHA-512:	C2D6BB4FEB5848D0704647D26F94C0BD8CD7E834AA2187EC9C877E80157E9CC225BBA3BECEE0148894C8639105D292AB50EE95830992BF357C632ACF001E020F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Taipei) {.. {-9223372036854775808 29160 0 LMT}.. {-2335248360 28800 0 CST}.. {-1017820800 32400 0 JST}.. {-766224000 28800 0 CST}.. {-745833600 32400 1 CDT}.. {-733827600 28800 0 CST}.. {-716889600 32400 1 CDT}.. {-699613200 28800 0 CST}.. {-683884800 32400 1 CDT}.. {-670669200 28800 0 CST}.. {-652348800 32400 1 CDT}.. {-639133200 28800 0 CST}.. {-620812800 32400 1 CDT}.. {-607597200 28800 0 CST}.. {-589276800 32400 1 CDT}.. {-576061200 28800 0 CST}.. {-562924800 32400 1 CDT}.. {-541760400 28800 0 CST}.. {-528710400 32400 1 CDT}.. {-510224400 28800 0 CST}.. {-497174400 32400 1 CDT}.. {-478688400 28800 0 CST}.. {-465638400 32400 1 CDT}.. {-449830800 28800 0 CST}.. {-434016000 32400 1 CDT}.. {-418208400 28800 0 CST}.. {-402480000 32400 1 CDT}.. {-386672400 28800 0 CST}.. {-370944000 32400 1 CDT}.. {-355136400 28800 0 CST}.. {-3394080

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Tashkent

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	878
Entropy (8bit):	3.9280321712564845
Encrypted:	false
SSDEEP:	24:5geQqdNRvOt81FCuLqecDngO6jPvTpYy5T4TXvKT10Sv6r:5+EvdJqxiF0rvK50Sv6r
MD5:	DB59DB8E401E12917B7367D5604D3DE6
SHA1:	7CC7C5C1DB551BD381B833C81746201D36BC59A9
SHA-256:	4445F3F892C7267A6867009CC1A3F0B0548D0240408375A9D15360B28993C2A9
SHA-512:	2C7AE63C408A9F06F973AAC16845E1DBE92D15A421BBBE420914F21155AD5E57CD058D7E4427E43185E023D2FF475EBF9D74003ECEF004FF4E5F9D5681ADFB80
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tashkent) {.. {-9223372036854775808 16631 0 LMT}.. {-1441168631 18000 0 +05}.. {-1247547600 21600 0 +06}.. {354909600 25200 1 +06}.. {370717200 21600 0 +06}.. {386445600 25200 1 +06}.. {402253200 21600 0 +06}.. {417981600 25200 1 +06}.. {433789200 21600 0 +06}.. {449604000 25200 1 +06}.. {465336000 21600 0 +06}.. {481060800 25200 1 +06}.. {496785600 21600 0 +06}.. {512510400 25200 1 +06}.. {528235200 21600 0 +06}.. {543960000 25200 1 +06}.. {559684800 21600 0 +06}.. {575409600 25200 1 +06}.. {591134400 21600 0 +06}.. {606859200 25200 1 +06}.. {622584000 21600 0 +06}.. {638308800 25200 1 +06}.. {654638400 21600 0 +06}.. {670363200 18000 0 +05}.. {670366800 21600 1 +05}.. {686091600 18000 0 +05}.. {694206000 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Tbilisi

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	3.6815162494646034
Encrypted:	false
SSDEEP:	24:5yBeqvIdZlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPqUsx9Ul4N:5MmsUf8mFpNWFnytO6VnYK
MD5:	C376C9ED66F6CC011E063D3E8E0DCED1
SHA1:	13C6345F8CB0EC79FE7C78B156C5737BCB66E49E
SHA-256:	B637BB0E49144C717E99E93540CB2C4D3695D63B91FE42547F2F0AA006498693
SHA-512:	FD60192CBEDC91C5D6B3B5E6F19DEDCAE14DCF48DCAE6D4865A8F0BBDC01CBF8DAAE92C4C46C353AF5B3EEE36CCC87B23F193DDF221132F5404C42507B708364
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tbilisi) {.. {-9223372036854775808 10751 0 LMT}.. {-2840151551 10751 0 TBMT}.. {-1441162751 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {694213200 10800 0 +03}.. {701816400 14400 1 +03}.. {717537600 10800 0 +03}.. {733266000 14400 1 +03}.. {748

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Tehran

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7250
Entropy (8bit):	3.5278500339429972
Encrypted:	false
SSDEEP:	96:z73zxgC3kvOR0xV1oLp9ZUj8nZjcJ5NIOFVp7ufbIL74f6IQTExJQtcAL:vryO2H1oLp9aQZyDmIVEPW
MD5:	359B270670A5FF61BBCE3D07F1BAA5AB
SHA1:	5B6D01C931D31D92299EE4455F76E69EB0C25A96
SHA-256:	A78655218A749F4ABCA436BE818E84D3277220FF3E69BE20A786AADF8AC744F9
SHA-512:	DFB0C7452AF6124A3742042CD97E7B9C0A84A4E338E00AF6DD66C971BC4D1324D3947A3A8601778F026E50367D942C10513FA1D73742E7006E91BF35E90260BF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tehran) {.. {-9223372036854775808 12344 0 LMT}.. {-1704165944 12344 0 TMT}.. {-757394744 12600 0 +0330}.. {247177800 14400 0 +04}.. {259272000 18000 1 +04}.. {277758000 14400 0 +04}.. {283982400 12600 0 +0330}.. {290809800 16200 1 +0330}.. {306531000 12600 0 +0330}.. {322432200 16200 1 +0330}.. {338499000 12600 0 +0330}.. {673216200 16200 1 +0330}.. {685481400 12600 0 +0330}.. {701209800 16200 1 +0330}.. {717103800 12600 0 +0330}.. {732745800 16200 1 +0330}.. {748639800 12600 0 +0330}.. {764281800 16200 1 +0330}.. {780175800 12600 0 +0330}.. {795817800 16200 1 +0330}.. {811711800 12600 0 +0330}.. {827353800 16200 1 +0330}.. {843247800 12600 0 +0330}.. {858976200 16200 1 +0330}.. {874870200 12600 0 +0330}.. {890512200 16200 1 +0330}.. {906406200 12600 0 +0330}.. {922048200 16200 1 +0330}.. {937942200 12600 0 +0330}.. {953584200 16200 1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Tel_Aviv

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.876713308636272
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/2WFK+TT52WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/2wKsswKR
MD5:	40B15013485EE2138A3DCB915F9121E7
SHA1:	3ADBE38686C7CA1FDE3DDD12BE908F39BFD1E228
SHA-256:	07537A30E6236D9E334DAFD5C4D352D25FDEF95D6DC7496F5D93EFAB74D9EBB1
SHA-512:	DA3B7B44B3BEF07CA8AA5253BF684A838181D8A15D7CCF0447A6B5F5BAE28D155CF65BCFB6286EB36C0B9F4FDD1FE862A3297ADB6FC33532B9F766334283D725
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Thimbu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.906503135441824
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8kNZ4WXHAIgNqFNKARL/2WFK9Z752WFKvNZovn:SlSWB9vsM3ykZ42HAIgc3KAN/2wKf126
MD5:	081862B6FB33389BEC9B0E6B500AA342
SHA1:	AF9467BB87C4C28921DF62A87B81223052F9FF4A
SHA-256:	37459C17B59639DF62B3F3943751902CE6AAF1F11B7630069DB45052EBEFB5B9
SHA-512:	CAF6F1C928528C4471229A2EF2944623545626532986628E6CE38884535286A0B38BA88C1A295E8B11322475D6BFAC61BF89786A76330C1A0C729339A3532BAF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Thimphu)]} {.. LoadTimeZoneFile Asia/Thimphu..}..set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Thimphu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.887493603495978
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKvNZJMXGm2OHEQUTFnoHqVaJKuc/v6Q61V9gmZVFSTVV:SlSWB9eg/2wKVZJDm2OHEfnoHDKuc/SC
MD5:	F239452984CCA9F23E97A880652C39E6
SHA1:	52D25282D03B79960F152D21E7492EE26DAEBBAA
SHA-256:	B797C74E3840298C3CD8149FC8AA4BCE839EFE79E7C3310986FF23C965607929
SHA-512:	1044BEDAE04FCA7BD62937AFCE70F6C447583A90DD1596C3029A64A8251E3F73C106F4D940548DD38E895D67FEFDCD196B257E11437DEB399085EE80C345AA50
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Thimphu) {.. {-9223372036854775808 21516 0 LMT}.. {-706341516 19800 0 +0530}.. {560025000 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Tokyo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	388
Entropy (8bit):	4.470556147950505
Encrypted:	false
SSDEEP:	12:MB862ymdHOx5CvAoK3zoiIxtoFDIe+zT0agbov:5yeOCvARzzCOVa/gby
MD5:	3CCC15B63A882DB1B7459A51CD1C8165
SHA1:	77A3EFE6E4EE524B9EC6F51593DD7521FD7B8DAD
SHA-256:	3DA522FA88541A375D53F30A0B62DC4A305FA0315FEE534B7998C9E0A239450A
SHA-512:	15238E96DABAB5D2B9FFD25B3F50417ED32205FA69239D6F6B28DA97A378D669FD409164964D0DD2A5B1D795C8F60E8D4EB15924046348C3D6010646A536E07C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tokyo) {.. {-9223372036854775808 33539 0 LMT}.. {-2587712400 32400 0 JST}.. {-683802000 36000 1 JDT}.. {-672310800 32400 0 JST}.. {-654771600 36000 1 JDT}.. {-640861200 32400 0 JST}.. {-620298000 36000 1 JDT}.. {-609411600 32400 0 JST}.. {-588848400 36000 1 JDT}.. {-577962000 32400 0 JST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Tomsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2116
Entropy (8bit):	3.695316005718174
Encrypted:	false
SSDEEP:	24:5CeLz/XJfsFN/3sFrOksF/sF7IyksF7FRZsFLsFTsFcsFk73sFK/XCFKTipnFEno:5H040yVRB7VfXucydm4IqtTTDOS
MD5:	E95DE93CBCE72C5E02D7ECFE94C96308
SHA1:	59A49EBFE544D97545BADFEFE716BB5659C64C20
SHA-256:	6B64A01D0F0B5EC7A1410C3BD6883BA7CC133E9F073D40E8BFECE037E3A3FA24
SHA-512:	9E33DC9C1C6D60F3226263C484AF46A14AAB31F838516A0D69BA08F8F416EF10D09697E8D7ABAC1CE1F5BCE8AB0C2635D99FBE70C89ECC268DED0DCE89E67466
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Tomsk) {.. {-9223372036854775808 20391 0 LMT}.. {-1578807591 21600 0 +06}.. {-1247551200 25200 0 +08}.. {354906000 28800 1 +08}.. {370713600 25200 0 +07}.. {386442000 28800 1 +08}.. {402249600 25200 0 +07}.. {417978000 28800 1 +08}.. {433785600 25200 0 +07}.. {449600400 28800 1 +08}.. {465332400 25200 0 +07}.. {481057200 28800 1 +08}.. {496782000 25200 0 +07}.. {512506800 28800 1 +08}.. {528231600 25200 0 +07}.. {543956400 28800 1 +08}.. {559681200 25200 0 +07}.. {575406000 28800 1 +08}.. {591130800 25200 0 +07}.. {606855600 28800 1 +08}.. {622580400 25200 0 +07}.. {638305200 28800 1 +08}.. {654634800 25200 0 +07}.. {670359600 21600 0 +07}.. {670363200 25200 1 +07}.. {686088000 21600 0 +06}.. {695764800 25200 0 +08}.. {701809200 28800 1 +08}.. {717534000 25200 0 +07}.. {733258800 28800 1 +08}.. {748983600 25200 0 +07}.. {7647084

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Ujung_Pandang

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.897140749162557
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8pYFfXHAIgNzGRRL/2WFKPQOrFJ4WFKov:SlSWB9vsM3yWFPHAIg0RN/2wKPQOrFJD
MD5:	F6AE33D706C36FDD8A21F44AD59F5607
SHA1:	94D6EC7A437249AEBE2FA4AF8AFB029A620368C0
SHA-256:	732751845ACEDBFFD3C6170F4B94CB20B25BFDCFCC5EEA19F4BE439F5C5B573A
SHA-512:	2314AB2B154887842211C9A570BC1323D9B4375FF60C96296835DB001E8A277CA62D40B8562BC34EDDF281D96D5325640B79F7907558C6E0319C7D2A76BE239C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Makassar)]} {.. LoadTimeZoneFile Asia/Makassar..}..set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Ulaanbaatar

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	3.7728141273024374
Encrypted:	false
SSDEEP:	24:5IerIvusF7cCGK6zoCjZte3kzMjsBw0oZzlL98oysHqGzJvqE+ksabzdX+YjL:5VujmUCei46oljFC67
MD5:	A4647294401D2B54ABAA8E509BF05A6F
SHA1:	BF804CC38996D7715E3BA9BAD715D7ADBED781B9
SHA-256:	A56A26981163A717CF388A423CFE7A2BAD1BE8652BE2E338670CBC0C0A70E5E9
SHA-512:	B43157FABDE016FA6636CAB7B06CC1DEA53526B42FB46BB41DC4B7E48188D191C325BEF0D170B125E885F321C4316746A8D478D798828E2DC4A51C71DA4A610C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ulaanbaatar) {.. {-9223372036854775808 25652 0 LMT}.. {-2032931252 25200 0 +07}.. {252435600 28800 0 +08}.. {417974400 32400 1 +08}.. {433782000 28800 0 +08}.. {449596800 32400 1 +08}.. {465318000 28800 0 +08}.. {481046400 32400 1 +08}.. {496767600 28800 0 +08}.. {512496000 32400 1 +08}.. {528217200 28800 0 +08}.. {543945600 32400 1 +08}.. {559666800 28800 0 +08}.. {575395200 32400 1 +08}.. {591116400 28800 0 +08}.. {606844800 32400 1 +08}.. {622566000 28800 0 +08}.. {638294400 32400 1 +08}.. {654620400 28800 0 +08}.. {670348800 32400 1 +08}.. {686070000 28800 0 +08}.. {701798400 32400 1 +08}.. {717519600 28800 0 +08}.. {733248000 32400 1 +08}.. {748969200 28800 0 +08}.. {764697600 32400 1 +08}.. {780418800 28800 0 +08}.. {796147200 32400 1 +08}.. {811868400 28800 0 +08}.. {828201600 32400 1 +08}.. {843922800 28800 0 +08}.. {859

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Ulan_Bator

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.728285544456033
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8TcXkXHAIgNrfcXORL/2WFKhrMEBQWFKucXB:SlSWB9vsM3yXHAIgTN/2wKhrMEewKX
MD5:	D2EAEA6182FB332CAA707B523F6C8A9D
SHA1:	3BFC654E2B3BCF902AF41AEEC46772C84FFF3890
SHA-256:	D17FDAF17B3DAC3A1310E2332F61585598185E64CED799ABD68249EB5B698591
SHA-512:	E16BEE28BFE3AFFFE6F0025C09D0D65001F38D5045AAB1B554E4D3A66A88273F985B7BAA11F8D26E76E5ABC9F559E3E4B794CC939AAD5FF012A5A47924D08CB3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Ulaanbaatar)]} {.. LoadTimeZoneFile Asia/Ulaanbaatar..}..set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Urumqi

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	149
Entropy (8bit):	5.006390440264841
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2WFKjhfMXGm2OHEVPoHsWA0GVFSTVVn:SlSWB9eg/2wKjJDm2OHEVPoH3A0CUX
MD5:	D6245CAAEC9BA2579F4CEFFF196A9369
SHA1:	4D182953F2CEEFF3583265F977B14F40C1A2FB43
SHA-256:	C445B8030DEDDDED0AFF5CC692CC323B63BE8C14BBD42DC3FDE90AD4F9D14785
SHA-512:	A32C477B6FAA79247907D1C4E2DF400B05AF4B529277C4CE12B33097872311E3F579115DC8CBA93DAC936928FD574414F3473A9CB7C8E85AB57CCA57489B60F8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Urumqi) {.. {-9223372036854775808 21020 0 LMT}.. {-1325483420 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Ust-Nera

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	3.773734429231407
Encrypted:	false
SSDEEP:	24:5petrlfgLv+OC+jsuwltZQONEa2Ggf3augO8UoxLyHdX/CX6bW4Bv/7NKxKG:5Ysv+0j6lua2Gg/3gO8UoOZU2Wc/pKF
MD5:	5ADD78E4AFCBA913D078A8790861A2DE
SHA1:	BB63A762D5D76C0FD3CB9AB2BCDE95718E1C99EB
SHA-256:	9D639C0FC69B3BEEBC96969092F9590EB48E7946E901B225BF245E165973B9A8
SHA-512:	7C2418FD1F96F101B83E2ABDF2551405C6E429DBBF30A2FA7CD2477E2CE1CEEBB790C51B28AEFF043BA7A7A914CEF3C812668058D69225B9FE9475C56508453D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Ust-Nera) {.. {-9223372036854775808 34374 0 LMT}.. {-1579426374 28800 0 +08}.. {354898800 43200 0 +12}.. {370699200 39600 0 +11}.. {386427600 43200 1 +12}.. {402235200 39600 0 +11}.. {417963600 43200 1 +12}.. {433771200 39600 0 +11}.. {449586000 43200 1 +12}.. {465318000 39600 0 +11}.. {481042800 43200 1 +12}.. {496767600 39600 0 +11}.. {512492400 43200 1 +12}.. {528217200 39600 0 +11}.. {543942000 43200 1 +12}.. {559666800 39600 0 +11}.. {575391600 43200 1 +12}.. {591116400 39600 0 +11}.. {606841200 43200 1 +12}.. {622566000 39600 0 +11}.. {638290800 43200 1 +12}.. {654620400 39600 0 +11}.. {670345200 36000 0 +11}.. {670348800 39600 1 +11}.. {686073600 36000 0 +10}.. {695750400 39600 0 +12}.. {701794800 43200 1 +12}.. {717519600 39600 0 +11}.. {733244400 43200 1 +12}.. {748969200 39600 0 +11}.. {764694000 43200 1 +12}.. {780418

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Vientiane

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.858039387006872
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8VLYO5YFfXHAIgN8ELYOJARL/2WFKgTjEHp4WFKELt:SlSWB9vsM3y1LePHAIgKELtAN/2wKgsX
MD5:	D23A09C84A5368FBB47174BC0A460D14
SHA1:	045A72FEA79C75E5F0029BD110E33A022C57DFAB
SHA-256:	18F5E4FE8247F676278AC5F1912AC401DC48DF5B756D22E76FF1CFA702F88DA7
SHA-512:	404EABC2FC162E18C678CED063249C7FF4C28653880EA1903CE846FD191CD1C5B61E0610736F250B79BBAC768B1AFD6B9A8824D56D74591A95D7301B47D48387
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Bangkok)]} {.. LoadTimeZoneFile Asia/Bangkok..}..set TZData(:Asia/Vientiane) $TZData(:Asia/Bangkok)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Vladivostok

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	3.7094518963173035
Encrypted:	false
SSDEEP:	24:56beOUYQ7FyDy3le3i96VwAmnuBNuTw6vl9O8nfipRkwhUZDAcD:56cYQBIy343dVNUIukElcXRDhUBAcD
MD5:	5C0C094B088D0212182E7B944197D4FE
SHA1:	CF43A511FE9CD295207DF350704462E09D4D5278
SHA-256:	2558C96E25359C72F168DAC6FB3C16C54F8FD7D0724EEB1671156D4A1F42AC6C
SHA-512:	5D659EBDC8C2B06C964B083ECC78B4370A4658590D83F020CD23910C44E2D8DAFE69F61E8EB569E1905E89F38CD03ABE6B92F6CE36CF0B1EE0732A7645AFA65D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Vladivostok) {.. {-9223372036854775808 31651 0 LMT}.. {-1487321251 32400 0 +09}.. {-1247562000 36000 0 +11}.. {354895200 39600 1 +11}.. {370702800 36000 0 +10}.. {386431200 39600 1 +11}.. {402238800 36000 0 +10}.. {417967200 39600 1 +11}.. {433774800 36000 0 +10}.. {449589600 39600 1 +11}.. {465321600 36000 0 +10}.. {481046400 39600 1 +11}.. {496771200 36000 0 +10}.. {512496000 39600 1 +11}.. {528220800 36000 0 +10}.. {543945600 39600 1 +11}.. {559670400 36000 0 +10}.. {575395200 39600 1 +11}.. {591120000 36000 0 +10}.. {606844800 39600 1 +11}.. {622569600 36000 0 +10}.. {638294400 39600 1 +11}.. {654624000 36000 0 +10}.. {670348800 32400 0 +10}.. {670352400 36000 1 +10}.. {686077200 32400 0 +09}.. {695754000 36000 0 +11}.. {701798400 39600 1 +11}.. {717523200 36000 0 +10}.. {733248000 39600 1 +11}.. {748972800 36000 0 +10}.. {7

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Yakutsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	3.7081033128260934
Encrypted:	false
SSDEEP:	48:5h+r1gIgWH/lt0irzEzCSCItWiIrW+rDQk9CVhyFY7rRWjYuhUmgr2j:K5PhtjLiII2ZFlgm
MD5:	E43E5F0EA7C4575525BAB130984DCDCC
SHA1:	2D715749469FEA51A8E25D1F4F8DC4FF9178817D
SHA-256:	3BEF13638C46F16435D326C675907E61BB68C8173153CED3359E983BE0E413E5
SHA-512:	27954FEC865031BC363CFDE94E97B3B19836A6F777646EA4AAB12ECCAEE6D60A0C690711EA192B917AC717F94A01D1EF64BAE97DF968069CC12415971B070498
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yakutsk) {.. {-9223372036854775808 31138 0 LMT}.. {-1579423138 28800 0 +08}.. {-1247558400 32400 0 +10}.. {354898800 36000 1 +10}.. {370706400 32400 0 +09}.. {386434800 36000 1 +10}.. {402242400 32400 0 +09}.. {417970800 36000 1 +10}.. {433778400 32400 0 +09}.. {449593200 36000 1 +10}.. {465325200 32400 0 +09}.. {481050000 36000 1 +10}.. {496774800 32400 0 +09}.. {512499600 36000 1 +10}.. {528224400 32400 0 +09}.. {543949200 36000 1 +10}.. {559674000 32400 0 +09}.. {575398800 36000 1 +10}.. {591123600 32400 0 +09}.. {606848400 36000 1 +10}.. {622573200 32400 0 +09}.. {638298000 36000 1 +10}.. {654627600 32400 0 +09}.. {670352400 28800 0 +09}.. {670356000 32400 1 +09}.. {686080800 28800 0 +08}.. {695757600 32400 0 +10}.. {701802000 36000 1 +10}.. {717526800 32400 0 +09}.. {733251600 36000 1 +10}.. {748976400 32400 0 +09}.. {76470

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Yangon

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.692243303623333
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2wKs5XDm2OHGVQoHvZN6FCDx+UIFDVkvScHbY/s5UIAy:MB862KTmdHGuCvZNNkkHH3Sy
MD5:	D45766D30074719C9A88ACE8BB53204B
SHA1:	69B333DFCCCCEB66DD0F7DC28B272BB10769B6B0
SHA-256:	2526557810747E78E713AE09BC305621A80FAEECF8D441632E7825738D4C79CB
SHA-512:	5255DEED72D7D13862A4D6BED7E0458C099D2EF5A1B41536CAA7C0E65A61DE8B8D1AD62AD44559F970B6613ADFB3862778D1CC99B9A05CB5BBCA7F0202B5A5B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yangon) {.. {-9223372036854775808 23087 0 LMT}.. {-2840163887 23087 0 RMT}.. {-1577946287 23400 0 +0630}.. {-873268200 32400 0 +09}.. {-778410000 23400 0 +0630}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Yekaterinburg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2095
Entropy (8bit):	3.704641905144701
Encrypted:	false
SSDEEP:	48:5ievNhYvm1qv7vXIovPvSvlDvtvuovKKvKcNvHvAvivBvqvvEyv8vlvEv+v4v+v+:/Nupj40H6l75FKCKcZP8qdyEaoBAWkW+
MD5:	D4DABA407BB8A10E4961D1DE5D9781D1
SHA1:	6933DE65336331BD90E2BEC6AEA0609B16DAEDC9
SHA-256:	2C78699EFC60758B8F8D0D1DEEDFDED5E65C65EBF3082B23E60BDEA8BF8FBCFE
SHA-512:	459E2187FAA66414F5CE934C335F563DFD2FA5316B86A54D1A29123A0460AFD65B7CE46629BD6A070A14CB6873A28A2F2803DE5FF4F29EA610712EB07FAD303F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yekaterinburg) {.. {-9223372036854775808 14553 0 LMT}.. {-1688270553 13505 0 PMT}.. {-1592610305 14400 0 +04}.. {-1247544000 18000 0 +06}.. {354913200 21600 1 +06}.. {370720800 18000 0 +05}.. {386449200 21600 1 +06}.. {402256800 18000 0 +05}.. {417985200 21600 1 +06}.. {433792800 18000 0 +05}.. {449607600 21600 1 +06}.. {465339600 18000 0 +05}.. {481064400 21600 1 +06}.. {496789200 18000 0 +05}.. {512514000 21600 1 +06}.. {528238800 18000 0 +05}.. {543963600 21600 1 +06}.. {559688400 18000 0 +05}.. {575413200 21600 1 +06}.. {591138000 18000 0 +05}.. {606862800 21600 1 +06}.. {622587600 18000 0 +05}.. {638312400 21600 1 +06}.. {654642000 18000 0 +05}.. {670366800 14400 0 +05}.. {670370400 18000 1 +05}.. {686095200 14400 0 +04}.. {695772000 18000 0 +06}.. {701816400 21600 1 +06}.. {717541200 18000 0 +05}.. {733266000 21600 1 +06}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Asia\Yerevan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2029
Entropy (8bit):	3.6487650030366106
Encrypted:	false
SSDEEP:	24:5O4GeuadYlykbocXcwJUE5iu8JmFebARoc9lVNk7/9bq8dq16b3C9UPBUUUl2ue/:5xKdsUf8mFpNWFnyLCPYmPJSi3sh4
MD5:	2CFA7C55D0731D24679CA5D5DC716381
SHA1:	2BB66783D75C71E76409365757980FBC15F53231
SHA-256:	20871FA6AA959DDFB73D846271B4A568627B564CFC08A11BDD84B98C2F2019A3
SHA-512:	CAB10A48859B2C0B2CC7C56E0AA530AE7E506A4986BADC5ED974D124BD46DB328B50C423F83FCFD52D31962A249EEFC10351798B86D51EDA500F412C8D42E6BC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Asia/Yerevan) {.. {-9223372036854775808 10680 0 LMT}.. {-1441162680 10800 0 +03}.. {-405140400 14400 0 +04}.. {354916800 18000 1 +04}.. {370724400 14400 0 +04}.. {386452800 18000 1 +04}.. {402260400 14400 0 +04}.. {417988800 18000 1 +04}.. {433796400 14400 0 +04}.. {449611200 18000 1 +04}.. {465343200 14400 0 +04}.. {481068000 18000 1 +04}.. {496792800 14400 0 +04}.. {512517600 18000 1 +04}.. {528242400 14400 0 +04}.. {543967200 18000 1 +04}.. {559692000 14400 0 +04}.. {575416800 18000 1 +04}.. {591141600 14400 0 +04}.. {606866400 18000 1 +04}.. {622591200 14400 0 +04}.. {638316000 18000 1 +04}.. {654645600 14400 0 +04}.. {670370400 10800 0 +03}.. {670374000 14400 1 +03}.. {686098800 10800 0 +03}.. {701823600 14400 1 +03}.. {717548400 10800 0 +03}.. {733273200 14400 1 +03}.. {748998000 10800 0 +03}.. {764722800 14400 1 +03}.. {780447

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Azores

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9879
Entropy (8bit):	3.557602151081988
Encrypted:	false
SSDEEP:	192:K35nZPOUYySoluItljncxelTMwtrayE6x5sETNek/CyNzybxYKmX6SXL/XbEcygI:K940pb6cL/b3Ldr9Q7TMq+ML
MD5:	E7F2A3EE0362E9ED3ECBAD24168AD098
SHA1:	98832274F6D9B641B809123D1272A1C04EEAA177
SHA-256:	6B3609BE4E93D21A2AB492594EDD387931E2C787E8471C9F2D3A677F34002D8F
SHA-512:	C48A76F8251AE455C759CB98802E40B3BEF716FD8E7441B6DE0242942C913367E3572B7C871082E97CA9BE67EC7DC37F8D01C438965217AC0EC36AD508DCE0D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Azores) {.. {-9223372036854775808 -6160 0 LMT}.. {-2713904240 -6872 0 HMT}.. {-1830376800 -7200 0 -02}.. {-1689548400 -3600 1 -01}.. {-1677794400 -7200 0 -02}.. {-1667430000 -3600 1 -01}.. {-1647730800 -7200 0 -02}.. {-1635807600 -3600 1 -01}.. {-1616194800 -7200 0 -02}.. {-1604358000 -3600 1 -01}.. {-1584658800 -7200 0 -02}.. {-1572735600 -3600 1 -01}.. {-1553036400 -7200 0 -02}.. {-1541199600 -3600 1 -01}.. {-1521500400 -7200 0 -02}.. {-1442444400 -3600 1 -01}.. {-1426806000 -7200 0 -02}.. {-1379286000 -3600 1 -01}.. {-1364770800 -7200 0 -02}.. {-1348441200 -3600 1 -01}.. {-1333321200 -7200 0 -02}.. {-1316386800 -3600 1 -01}.. {-1301266800 -7200 0 -02}.. {-1284332400 -3600 1 -01}.. {-1269817200 -7200 0 -02}.. {-1221433200 -3600 1 -01}.. {-1206918000 -7200 0 -02}.. {-1191193200 -3600 1 -01}.. {-1175468400 -7200 0 -02}.. {-1127689

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Bermuda

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8784
Entropy (8bit):	3.833553120942514
Encrypted:	false
SSDEEP:	192:ZRBHksL3zq6bCvyjvspNWMPm4bPJWXtRbALtuFW4ng2CEBJuQaeEy9P19OBYEi/+:ft0CC
MD5:	B04E22B9B42722013941169B5D04DEA2
SHA1:	32B96A7D9504D5022A6C4E2D310E95B5F062947F
SHA-256:	099C3BEFBA3B4C00AE19BC53D475A52B32FAC9B36EC823C8EAEFC7D00F78F388
SHA-512:	8B93BCA1E923B7A43F2EB0889216E8FF991D13CB8D25BD300310ED7CD8537DBD858E8F422C9B52AE2F52F7C1CB450EF0B7C5C1B3AE547C9C1E18E2A851569DD5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Bermuda) {.. {-9223372036854775808 -15558 0 LMT}.. {-2524506042 -15558 0 BMT}.. {-1664307642 -11958 1 BMT}.. {-1648932042 -15558 0 BMT}.. {-1632080442 -11958 1 BMT}.. {-1618692042 -15558 0 BST}.. {-1262281242 -14400 0 AT}.. {-882727200 -10800 1 ADT}.. {-858538800 -14400 0 AST}.. {-845229600 -10800 1 ADT}.. {-825879600 -14400 0 AST}.. {-814384800 -10800 1 ADT}.. {-793825200 -14400 0 AST}.. {-782935200 -10800 1 ADT}.. {-762375600 -14400 0 AST}.. {-713988000 -10800 1 ADT}.. {-703710000 -14400 0 AST}.. {-681933600 -10800 1 ADT}.. {-672865200 -14400 0 AST}.. {-650484000 -10800 1 ADT}.. {-641415600 -14400 0 AST}.. {-618429600 -10800 1 ADT}.. {-609966000 -14400 0 AST}.. {-586980000 -10800 1 ADT}.. {-578516400 -14400 0 AST}.. {-555530400 -10800 1 ADT}.. {-546462000 -14400 0 AST}.. {-429127200 -10800 1 ADT}.. {-415825200 -14400 0 AST}.. {1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Canary

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6856
Entropy (8bit):	3.8064107143060752
Encrypted:	false
SSDEEP:	96:KXVuHfXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:KXVQbkIaFF1w0us4qE3+sSGjT
MD5:	8ABD279386C50705C074EEE18BF5AE59
SHA1:	C392231DBE744F5942DA4BFAC8AD0ABEBAEA0BF3
SHA-256:	2026944DCDEBC52F64405E35119F4CF97EA9AA1E769498730880B03F29A2B885
SHA-512:	3095759D01AC7EEA25E427CA38E8A0395BEFA7250E7A0C1327BF9D61F07F4570CDF7313FBE6695973EB0DD66D201C6C63591CC0DA8A1E0029926DC7056F4C95B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Canary) {.. {-9223372036854775808 -3696 0 LMT}.. {-1509663504 -3600 0 -01}.. {-733874400 0 0 WET}.. {323827200 3600 1 WEST}.. {338950800 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Cape_Verde

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.637993677747699
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2RQ7RfDm2OHDoH1JlvQV/FFrR3FcykVvQV/FFf+nmwV:MB86267RLmdHDC1w/FH3FcyL/FomwV
MD5:	1581C6470850E0C9DB204975488B1AF8
SHA1:	6933ED13F18AD785CEDF0837F86EFAC671297A85
SHA-256:	2EA59ACDB5BBDD3C6ABCEEA456838A5CA57371A3D2BB93604B37F998ED8B9D4D
SHA-512:	9FFFA013D82CEFF6F447521C19270ECDD71152F23670164423E6013FEC46253C62D2CB79B42630BD786BD113F27369E746CA981DD17E789F7571F473B47247C1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Cape_Verde) {.. {-9223372036854775808 -5644 0 LMT}.. {-1830376800 -7200 0 -02}.. {-862610400 -3600 1 -01}.. {-764118000 -7200 0 -02}.. {186120000 -3600 0 -01}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Faeroe

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.709193799640151
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqLG4E23vXHAIgvMG4EeRRL/2RQqG4EZrB/4RQqG4E1n:SlSWB9vsM3yCPHAIgvoRN/2RQ1rB/4Ri
MD5:	601EB889A87F9CAD6F1DF4D1AB009FAE
SHA1:	EB43C253A48755442A67A2408D7E3295549F831C
SHA-256:	64FB8CAD17CD36666C7027AAD01344FEF659B13699EEF1942365842F8ED2170E
SHA-512:	9CFC4A446ED6A3BEF6C26AE57324F10A970EE2ADD6933130447FAD6A3DB538841F2490DD461AF5776FACD9BD2CDC4A83247DFA6B34802AE844DDC6D4C37B28EA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Atlantic/Faroe)]} {.. LoadTimeZoneFile Atlantic/Faroe..}..set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Faroe

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6796
Entropy (8bit):	3.804838552487436
Encrypted:	false
SSDEEP:	96:96ufXCiZoFtFPIaFF1w0urfva946ZGsE3f2Sf+aCNmSv+kznl4klEp8OT:/bkIaFF1w0us4qE3+sSGjT
MD5:	F97CC7EB9C52D00177BFF4715832FCD5
SHA1:	CD9DCBB5E6ADD6EA91C8F142957EC229FC7F6DA3
SHA-256:	795F438E7F01342D5F25ECCDD09FCE65C03C5D2D561B9B5191301D57EC16B850
SHA-512:	9586289FEB6C597160011A47432F0AC40000483FA2E579BD89046EFD33E98DDAD652B792FD80CEDEB4CD87B6439A7B473F25F1B7375BC75353CBAF9F77E1084E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Faroe) {.. {-9223372036854775808 -1624 0 LMT}.. {-1955748776 0 0 WET}.. {347155200 0 0 WET}.. {354675600 3600 1 WEST}.. {370400400 0 0 WET}.. {386125200 3600 1 WEST}.. {401850000 0 0 WET}.. {417574800 3600 1 WEST}.. {433299600 0 0 WET}.. {449024400 3600 1 WEST}.. {465354000 0 0 WET}.. {481078800 3600 1 WEST}.. {496803600 0 0 WET}.. {512528400 3600 1 WEST}.. {528253200 0 0 WET}.. {543978000 3600 1 WEST}.. {559702800 0 0 WET}.. {575427600 3600 1 WEST}.. {591152400 0 0 WET}.. {606877200 3600 1 WEST}.. {622602000 0 0 WET}.. {638326800 3600 1 WEST}.. {654656400 0 0 WET}.. {670381200 3600 1 WEST}.. {686106000 0 0 WET}.. {701830800 3600 1 WEST}.. {717555600 0 0 WET}.. {733280400 3600 1 WEST}.. {749005200 0 0 WET}.. {764730000 3600 1 WEST}.. {780454800 0 0 WET}.. {796179600 3600 1 WEST}.. {811904400 0 0 WET}.. {828234000 3600

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Jan_Mayen

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.975859213900122
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVyWJooeyXHAIgoqxWJz5RL/2RQqG0EHEcAg/h8Qas:SlSWB9vsM3ymSDSHAIgoXN/2RQaK8Avn
MD5:	6EB1E51CDB90E841DC151004E98E80CF
SHA1:	CDB1FFF4FDBC7837E10E3725F09626345A82716E
SHA-256:	9152D10450CEBCE4AAEA3F3C8A50E4077A881E0B06B193A5886F06A453803112
SHA-512:	252648AA76AC0F08ED9BA3CB82E930101B1D2CE37EA979670671909CA8E2C7D838C35A449B0C7C2EF7BBF08C746475EC83403651CFB203E2F56C395CE2640933
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Oslo)]} {.. LoadTimeZoneFile Europe/Oslo..}..set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Oslo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Madeira

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9709
Entropy (8bit):	3.80455694200614
Encrypted:	false
SSDEEP:	192:hZUiLbMsf/ss0qKd+aKyUXtOZHY1SCOcesoQivoKbFVCdm1rXWNXyCXTOuUbkIaq:hZZDQX1rWJysukysLE3+sSGjT
MD5:	AC6647F9B53B5958214EC3F3B78A4D85
SHA1:	7355622AF99296F069F73899D5C70941C207F676
SHA-256:	B2A0D0DDC26806A05B2BE806CA3F938DB12A3FA40110B8B21FD3F04EFED3A531
SHA-512:	07569CA4D5DC6D57D91D6FDC370671A7546B73BA653D094E1B501D33570F7700727AD7FF2A083BC79E9EDE807C47E7A5604BEF5803F290B2F277C51DEF10FA6B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Madeira) {.. {-9223372036854775808 -4056 0 LMT}.. {-2713906344 -4056 0 FMT}.. {-1830380400 -3600 0 -01}.. {-1689552000 0 1 +00}.. {-1677798000 -3600 0 -01}.. {-1667433600 0 1 +00}.. {-1647734400 -3600 0 -01}.. {-1635811200 0 1 +00}.. {-1616198400 -3600 0 -01}.. {-1604361600 0 1 +00}.. {-1584662400 -3600 0 -01}.. {-1572739200 0 1 +00}.. {-1553040000 -3600 0 -01}.. {-1541203200 0 1 +00}.. {-1521504000 -3600 0 -01}.. {-1442448000 0 1 +00}.. {-1426809600 -3600 0 -01}.. {-1379289600 0 1 +00}.. {-1364774400 -3600 0 -01}.. {-1348444800 0 1 +00}.. {-1333324800 -3600 0 -01}.. {-1316390400 0 1 +00}.. {-1301270400 -3600 0 -01}.. {-1284336000 0 1 +00}.. {-1269820800 -3600 0 -01}.. {-1221436800 0 1 +00}.. {-1206921600 -3600 0 -01}.. {-1191196800 0 1 +00}.. {-1175472000 -3600 0 -01}.. {-1127692800 0 1 +00}.. {-1111968000 -3600 0 -01}.. {-

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Reykjavik

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	3.716074665066009
Encrypted:	false
SSDEEP:	48:5Fhytu1phYdTclBoLB+Q1utqZu97fKnt91ItLjxkRq2fE4/JQjJuj4csf5J1R8yO:jhytu1phYdTclBoLB+Q1utqZuZfKt91x
MD5:	FE3467015B8B226CB9D8077CB1ABF81B
SHA1:	665083E753C6860755D669F30DF55333F2740127
SHA-256:	E77B9D50AF6C2550CA0517B4A6DE64A8A159AD0C77F1294C4212B6E20221B099
SHA-512:	661CA9C1DEDB9CE459215C48AE1409787B39EA025DA897FE8DA5532966FEC28BF86DF4B2794F7DDACFC01064CB9A11737592018C9B5C05045934D237FB1C428B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Reykjavik) {.. {-9223372036854775808 -5280 0 LMT}.. {-1956609120 -3600 0 -01}.. {-1668211200 0 1 -01}.. {-1647212400 -3600 0 -01}.. {-1636675200 0 1 -01}.. {-1613430000 -3600 0 -01}.. {-1605139200 0 1 -01}.. {-1581894000 -3600 0 -01}.. {-1539561600 0 1 -01}.. {-1531350000 -3600 0 -01}.. {-968025600 0 1 -01}.. {-952293600 -3600 0 -01}.. {-942008400 0 1 -01}.. {-920239200 -3600 0 -01}.. {-909957600 0 1 -01}.. {-888789600 -3600 0 -01}.. {-877903200 0 1 -01}.. {-857944800 -3600 0 -01}.. {-846453600 0 1 -01}.. {-826495200 -3600 0 -01}.. {-815004000 0 1 -01}.. {-795045600 -3600 0 -01}.. {-783554400 0 1 -01}.. {-762991200 -3600 0 -01}.. {-752104800 0 1 -01}.. {-731541600 -3600 0 -01}.. {-717631200 0 1 -01}.. {-700092000 -3600 0 -01}.. {-686181600 0 1 -01}.. {-668642400 -3600 0 -01}.. {-654732000 0 1 -01}.. {-636588000 -3600 0 -01}.

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\South_Georgia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.011466665416709
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2RQqGtlN62/EiMXGm2OHXT14YoHvhFvdQVIyV:SlSWB9eg/2RQrlo2MiDm2OHXqYoHvTFS
MD5:	3B310BB8C90CA716DC1AC5A697ACA9CD
SHA1:	CD583F49478DCDAD91EF78539502C6FC62945C1E
SHA-256:	51BFABCB3388107753A3C1A8CF31118E6627132BAA09B9878D9E7CEDBEBB4886
SHA-512:	F593B7A1FAF0EA6B42D5EE86C20C9A8F5CD7ACD9B30EF7755E45ECAFEA8752C32E4CF4BEDF531F494E59D9F0C49CCC6FCA077292E20794AA265DFC0A56DFE579
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/South_Georgia) {.. {-9223372036854775808 -8768 0 LMT}.. {-2524512832 -7200 0 -02}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\St_Helena

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.880390141563645
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2RQqGt4r+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2RQr4rV
MD5:	2C73A963F515376A46762CE153AAF5C5
SHA1:	996C3C93DFAD89EA80AC5DFA1DFBD7CECD9ED28D
SHA-256:	1C9CA8966FC8BD0BE70F4A187E17E56FB99139BC88C392E82BA2E23E23111C54
SHA-512:	35A9ADC047DB058D71C21FC4ECB57CD14B0D9BA4416506763D1800D72CE6C9E81636F332AAD3533616F05C86F90A60416BD4065C5F832A51AA3DC186218BDCAE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Atlantic/St_Helena) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Atlantic\Stanley

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2256
Entropy (8bit):	3.662522763865322
Encrypted:	false
SSDEEP:	48:506KSBSdSs2SbSwGSyPU3lSsS5SGScSo/SkSuShSceS3SBSc7XSiSgSwSd/SJkS6:JKU+Ew0FU1TuhrR//tOIoOjXZfDWSkPR
MD5:	77C7ECE4FCBE150069B611C75E8DAA0E
SHA1:	22F4E5F15BCA92D8456B70BB36230F2605CA5E1C
SHA-256:	F0E99EF01F140CD5AAFE16803A657922207E6F7F6AF10B0AE795790916C302C4
SHA-512:	6FB57E8499A587292AFAFA9BD003721572393D5268CAF956230DA76983A112B27D6731BE561A22CCEF84935F43AC988B667C2DC404C157EA8D0E7830FC1A2AB8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Atlantic/Stanley) {.. {-9223372036854775808 -13884 0 LMT}.. {-2524507716 -13884 0 SMT}.. {-1824235716 -14400 0 -04}.. {-1018209600 -10800 1 -04}.. {-1003093200 -14400 0 -04}.. {-986760000 -10800 1 -04}.. {-971643600 -14400 0 -04}.. {-954705600 -10800 1 -04}.. {-939589200 -14400 0 -04}.. {-923256000 -10800 1 -04}.. {-908139600 -14400 0 -04}.. {-891806400 -10800 1 -04}.. {-876690000 -14400 0 -04}.. {-860356800 -10800 1 -04}.. {420606000 -7200 0 -03}.. {433303200 -7200 1 -03}.. {452052000 -10800 0 -03}.. {464151600 -7200 1 -03}.. {483501600 -10800 0 -03}.. {495597600 -14400 0 -04}.. {495604800 -10800 1 -04}.. {514350000 -14400 0 -04}.. {527054400 -10800 1 -04}.. {545799600 -14400 0 -04}.. {558504000 -10800 1 -04}.. {577249200 -14400 0 -04}.. {589953600 -10800 1 -04}.. {608698800 -14400 0 -04}.. {621403200 -10800 1 -04}.. {640753200 -14400 0 -

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\ACT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.862270414049974
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjpMFBx/h4QWCCj1:SlSWB9vsM3yI9kHAIgmON/2DCeMFB/4d
MD5:	2EF41863430897F45E0CBB51E6A44069
SHA1:	8E9561060E9509FAF235E5E033FC9C2918E438DB
SHA-256:	DF7CBDDCBB2F5926A07D19A35739E5B8DCD9733C037F7D1FF95753C28D574674
SHA-512:	9D3A37D64DCCCA28093C30FAB595690D021FACEC15F351A77CA33A779D645D305A2FA031869F0DE3B0404C498C2C321D3D02E4DC592D3C632F6700F5DCB54900
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/ACT) $TZData(:Australia/Sydney)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Adelaide

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8372
Entropy (8bit):	3.894755849491153
Encrypted:	false
SSDEEP:	96:j8SY62BXovlCyRL8pJXa4NyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:j8X3Xzgl3PaN8asiQ/Uv9UnvtCaRs
MD5:	94E1A0C4326D09AF103107E64625CC6C
SHA1:	C026565F020EB158309549D98313632BAA79205F
SHA-256:	5C43D3152982BCFD5B9F51D0E909CF3A558BED1C270FEFFE030531D38D6F91B7
SHA-512:	CA08A8BC0EB740D59650FE0A9E56D9E169348AD0994F2BFFD6CCFBF9CC42E82F892FB719E80C4E2084B5702E9725C651359EE3066BD71BB19397EA83B6A68430
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Adelaide) {.. {-9223372036854775808 33260 0 LMT}.. {-2364110060 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1 ACDT}.. {320776200 34200 0 ACST}

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Brisbane

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	674
Entropy (8bit):	4.32071371733564
Encrypted:	false
SSDEEP:	12:MB862ELmdHLOYCvSi0xT0ryRIvUr0obZv:5ELe6dvSi6L
MD5:	900B39F1D4AB93A445F37B6C0A8DE3D9
SHA1:	DE82800779DCB8094C395B5024BD01FFA3C3BB8C
SHA-256:	0D3C39EDAB34A8DB31A658A1549772F7D69EB57565E40AA87B707953A2D854A4
SHA-512:	8D115D1D14FE6FF21A4AE77E3AAC075E6A877214E568956B9A4FD2E75A46E458CAA5AE26B483F128B4C62960D73BD7543BC32F22B760059423B3D9ABCBA24B6A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Brisbane) {.. {-9223372036854775808 36728 0 LMT}.. {-2366791928 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Broken_Hill

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8437
Entropy (8bit):	3.902306256303896
Encrypted:	false
SSDEEP:	96:QZSSY62BXovldRL8q75aANyPaNw0leasxMQ/UvuQPxBFNsLQ2nDs020DdDncIsea:QZSX3X2QfPaN8asiQ/Uv9UnvtCaRs
MD5:	1553DAAB804A6C9BB15D711554980D3B
SHA1:	5E3161B1FBB4C246DCB5E11ABD94095121CE38ED
SHA-256:	734F295BD0B558BDF6178DE62151B8913699D08AB2B1D101C55B8DEBC410074C
SHA-512:	06B21886070E39E390ECBD18841B7FDBFCA2C7C8573495D2BAA2B92EB113CD1C73C18D73C49DE3C49572CBCBCBED2FAD3248BC651BEB825A1E089B1DEDEFCBFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Broken_Hill) {.. {-9223372036854775808 33948 0 LMT}.. {-2364110748 36000 0 AEST}.. {-2314951200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}.. {31501800 34200 0 ACST}.. {57688200 37800 1 ACDT}.. {67969800 34200 0 ACST}.. {89137800 37800 1 ACDT}.. {100024200 34200 0 ACST}.. {120587400 37800 1 ACDT}.. {131473800 34200 0 ACST}.. {152037000 37800 1 ACDT}.. {162923400 34200 0 ACST}.. {183486600 37800 1 ACDT}.. {194977800 34200 0 ACST}.. {215541000 37800 1 ACDT}.. {226427400 34200 0 ACST}.. {246990600 37800 1 ACDT}.. {257877000 34200 0 ACST}.. {278440200 37800 1 ACDT}.. {289326600 34200 0 ACST}.. {309889800 37800 1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Canberra

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.851279484907769
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjnSV1+QWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DCcq+DCyB
MD5:	8944D3DF8FBECC03A8FB18C3B2DA3B53
SHA1:	6B17B38D6560592CA49840C47DB9BDA7E79F9F76
SHA-256:	5FE3CED97293FE0573D5ECE0CEF59CE5DDB4C57BC568AE7199E77B01D3ADE17C
SHA-512:	907D8BB7EA840E0B3AC683884F2F709A2C06D67CE9258BE46400A0DA63581A9B1403A44FA43E1059BE8F5C7E06F9FA05C176309AD6295317BF14F0E9FA5741E4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/Canberra) $TZData(:Australia/Sydney)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Currie

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.79231670095588
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DCkx+4DCVDy:MByMjUQVv8At2s4Ky
MD5:	0C1DFC0877CE8EB08007B7C2B7AF2D87
SHA1:	02F835BE2DA4FCA79DC2A6959BB4EB6ACC8DF708
SHA-256:	1DD4EC4ED4F854E2EF6162B2F28C89208710F8EC5AABB95FFA9425D3FBBCAB13
SHA-512:	358347045915B7D10940DB15E49528D0C636BEC1BE70129847D0B9D034F9E96E847394D88358E87D98A9E581605A3C2AB917B85FDE1296F290B4194BB7E3FA46
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Currie) $TZData(:Australia/Hobart)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Darwin

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	437
Entropy (8bit):	4.508468081487136
Encrypted:	false
SSDEEP:	12:MB862pmdHPCvZUjMWpXgda/gd026Xgdvgd+v:5peKvZqMSX+4+56X+v+Q
MD5:	A81864B2C0BD7BF81F4FA21F17800059
SHA1:	518AC9E040A17083ED3962F4FBB47D1D83764FF7
SHA-256:	AC004FD4B3C536406991EC13EBB3E64E0EC0C7B264BC18C0700C8FA545868155
SHA-512:	3C24F4C2CC3072B3E820FCC1C68A747DCCBB9481FE743C1555783CC932DCBA44FE4851A732D24EABF62E845474D4E1278F120A04DB7549A18C7C49C31FB8D425
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Darwin) {.. {-9223372036854775808 31400 0 LMT}.. {-2364108200 32400 0 ACST}.. {-2230189200 34200 0 ACST}.. {-1672558200 37800 1 ACDT}.. {-1665387000 34200 0 ACST}.. {-883639800 37800 1 ACDT}.. {-876123000 34200 0 ACST}.. {-860398200 37800 1 ACDT}.. {-844673400 34200 0 ACST}.. {-828343800 37800 1 ACDT}.. {-813223800 34200 0 ACST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Eucla

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	759
Entropy (8bit):	4.110997549215461
Encrypted:	false
SSDEEP:	12:MB862EmdHvOYCvV2mV22wF2nUV2CF2+V2pCwF21UF2biV2cHVKF25V2VF2cV2tFq:5Eemdvg2wQCKZ4j5c0LVmtH1iknohwQT
MD5:	1BC8DBD2E24606EFA49F933034FC0EEF
SHA1:	A511695A1B87A689C6BFF65257C11D3962FDDA3D
SHA-256:	79D0C770A304360DB33F3D1EF7B3935F1E4E8125893E0DCE683AC35A51302CFB
SHA-512:	A839D390D70F22FC833322029B732F3AE68FF48793B07005041BD12322DD6E5D5E5FF31787AA004A507A57F8FC245133891F266C4EF19D49F085E6B412E5B04C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Eucla) {.. {-9223372036854775808 30928 0 LMT}.. {-2337928528 31500 0 +0945}.. {-1672555500 35100 1 +0945}.. {-1665384300 31500 0 +0945}.. {-883637100 35100 1 +0945}.. {-876120300 31500 0 +0945}.. {-860395500 35100 1 +0945}.. {-844670700 31500 0 +0945}.. {-836473500 35100 0 +0945}.. {152039700 35100 1 +0945}.. {162926100 31500 0 +0945}.. {436295700 35100 1 +0945}.. {447182100 31500 0 +0945}.. {690311700 35100 1 +0945}.. {699383700 31500 0 +0945}.. {1165079700 35100 1 +0945}.. {1174756500 31500 0 +0945}.. {1193505300 35100 1 +0945}.. {1206810900 31500 0 +0945}.. {1224954900 35100 1 +0945}.. {1238260500 31500 0 +0945}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Hobart

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8734
Entropy (8bit):	3.8515786470328823
Encrypted:	false
SSDEEP:	96:aOqigkx6WsYyS39nQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:aOq05hnQiAmcOM6e0pj
MD5:	5E04BF8E1DEBFCC4130FDD1BBD67B2DF
SHA1:	796AADCE7BB2FAF5E6FC916C941A4E3DCAFACC9E
SHA-256:	D813F6A97BEFC22CA4F24C59EB755D269B9C68A449CC7CF0D2C61F911860EBE7
SHA-512:	3A69CF1D1F57D6BD39E5F4DAF76BBB06A749D42BEB29452A0A5BDAA68F5DACC0DF176EDDA7A083F5B5B84FC651926C09D46CAAD2F6C4F1595AB9CCA1A958D653
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Hobart) {.. {-9223372036854775808 35356 0 LMT}.. {-2345795356 36000 0 AEST}.. {-1680508800 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-1646640000 39600 1 AEDT}.. {-1635753600 36000 0 AEST}.. {-1615190400 39600 1 AEDT}.. {-1604304000 36000 0 AEST}.. {-1583920800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {-94730400 36000 0 AEST}.. {-71136000 39600 1 AEDT}.. {-55411200 36000 0 AEST}.. {-37267200 39600 1 AEDT}.. {-25776000 36000 0 AEST}.. {-5817600 39600 1 AEDT}.. {5673600 36000 0 AEST}.. {25632000 39600 1 AEDT}.. {37728000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AES

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\LHI

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.912882643701746
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIoGEoPHAIgjGg6N/2DCkx/2DCPGUv:MByMjeXV6t2a8v
MD5:	425DC7B1E31F4AA41DAD74E3C9AE3562
SHA1:	D92A3269F7BF5EC00F082C64CEF6E20C43017180
SHA-256:	4D84E4040FBC529C9E0366BB74D0CFADEEEEDA0DFCC6C2C9204DED6C6455CAC3
SHA-512:	F3031F16C0D00D9F8A38CD378F599EB3E63F4FF85F120DB38E3013E93F08E6F512D969F164BBC88CD625910FB3E086F3352E5B8FFC1373C3CC98F363FB3FD3F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Lord_Howe)]} {.. LoadTimeZoneFile Australia/Lord_Howe..}..set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Lindeman

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.249672335529665
Encrypted:	false
SSDEEP:	12:MB862gtmdHVCvCi0xT0ryRIvUr0obbty/ywtUj3yv:5gteMvCi6Xlt8
MD5:	504A422280E0459A2126E7CB02F527E6
SHA1:	EF61B98EFB1E44EE59020E99A69EA67D6B8ACFC2
SHA-256:	01B278309353849CC2FDF62A30E2FF483833D5713CF5E329252738BE6F2C0A84
SHA-512:	BFDAAD56D817CD3AAB17DFD0A33EFDD422645BC542ABE269C0F8520E33796DF4F19EAB2E40BFC6C4AF93EF654239B8F2E285639B4662040D865B9C340A23CFAD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lindeman) {.. {-9223372036854775808 35756 0 LMT}.. {-2366790956 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {625593600 39600 1 AEDT}.. {636480000 36000 0 AEST}.. {657043200 39600 1 AEDT}.. {667929600 36000 0 AEST}.. {688492800 39600 1 AEDT}.. {699379200 36000 0 AEST}.. {709912800 36000 0 AEST}.. {719942400 39600 1 AEDT}.. {731433600 36000 0 AEST}.. {751996800 39600 1 AEDT}.. {762883200 36000 0 AEST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Lord_Howe

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7764
Entropy (8bit):	3.5615258807990537
Encrypted:	false
SSDEEP:	96:pmz39IyKxb/JbcD9gKniAF23QbNS1fEGXALNbbT2JFJ/FaKaTQ9ZJhRVK:p+cpVKniAF2AbkFKL
MD5:	10F983F4683CDE13A1228AC0B04D8513
SHA1:	45378BA5949BE53D698108F50FECFF50C9E3D296
SHA-256:	76D1F1ED67B8F8D6903789C2FDDF79590A83677972D416F5F3C9687614EC6238
SHA-512:	D60D802EF215A33750E4F859657BA12A67084B1E9FCF1B4A7CEEE7B9D816BC2C6670775D93C88EC8380CDD7790AD574133D6F90F0828F848313C26583B2F196A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Lord_Howe) {.. {-9223372036854775808 38180 0 LMT}.. {-2364114980 36000 0 AEST}.. {352216800 37800 0 +1030}.. {372785400 41400 1 +1030}.. {384273000 37800 0 +1030}.. {404839800 41400 1 +1030}.. {415722600 37800 0 +1030}.. {436289400 41400 1 +1030}.. {447172200 37800 0 +1030}.. {467739000 41400 1 +1030}.. {478621800 37800 0 +1030}.. {488984400 37800 0 +1030}.. {499188600 39600 1 +1030}.. {511282800 37800 0 +1030}.. {530033400 39600 1 +1030}.. {542732400 37800 0 +1030}.. {562087800 39600 1 +1030}.. {574786800 37800 0 +1030}.. {594142200 39600 1 +1030}.. {606236400 37800 0 +1030}.. {625591800 39600 1 +1030}.. {636476400 37800 0 +1030}.. {657041400 39600 1 +1030}.. {667926000 37800 0 +1030}.. {688491000 39600 1 +1030}.. {699375600 37800 0 +1030}.. {719940600 39600 1 +1030}.. {731430000 37800 0 +1030}.. {751995000 39600 1 +1030}.. {762

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Melbourne

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8341
Entropy (8bit):	3.8532171550973526
Encrypted:	false
SSDEEP:	96:Yyigkp2EUyn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:Yy3VnQiAmcOM6e0pj
MD5:	40D06B80A4A0DB415270EFD9698B97BF
SHA1:	1999F0E8C7EBAA11BD21D64D9E07FA911F13C64C
SHA-256:	F21B9EA51C0D41BAD0420FE0601E5A4B491FB895856F4BDDF6541D704469D92F
SHA-512:	E47D597CC85D177CF2804C44C216EB4C5B74472457F15F697704311A847BF8A051DCAFD26FA61DD689555F35640151E26F25D5DC5319EFEFEA62AD86657A4A95
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Melbourne) {.. {-9223372036854775808 34792 0 LMT}.. {-2364111592 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}.

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\NSW

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.893713405897538
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjLkXHAIgoXjLyFvHRL/2QWCCjREeQWCCjLBn:SlSWB9vsM3yI9kHAIgmON/2DC5eDCyB
MD5:	80B7CDD1EA5A5308CE84C038180005F2
SHA1:	B7CA15B58ADA8CA3EB74B7971073022D57D8EE70
SHA-256:	73D7C9E207E61ACF8DF7242BDCD84488189033E22A84873A953B65DE02FA1B0B
SHA-512:	F627F5FF335600AC9158D6A0D3694AB7E70180177449C17B5605BBF7B1B7F8FB447A9C207F4E1BCB627074DB47B8A66F5D78E03C6DB8FA17F8BDD6AABB331665
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Sydney)]} {.. LoadTimeZoneFile Australia/Sydney..}..set TZData(:Australia/NSW) $TZData(:Australia/Sydney)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\North

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.830368875485429
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjbvvXHAIgoXjbBvRL/2QWCCjsrQWCCjbi:SlSWB9vsM3yIFHAIg2N/2DCZrDCl
MD5:	14CB7EA1C028F457345EBEB8ADDC9237
SHA1:	208BF676F56533BA271D1B98363A766DF17CF6F2
SHA-256:	A983C9CAD7E542CAED43B083E68CD2B782959A4B54015F374C29250D3ACF9B8D
SHA-512:	099F65E5FA705FD7257CF7B8E103905EE313C6D082844F69CCD3F318E3E7F4098B29F952FA0AA28655E1FE290A0FB2E809911088315889DE7CAAF0E04698C2FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Darwin)]} {.. LoadTimeZoneFile Australia/Darwin..}..set TZData(:Australia/North) $TZData(:Australia/Darwin)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Perth

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	739
Entropy (8bit):	4.31793586514766
Encrypted:	false
SSDEEP:	12:MB8623mdHCBdCvmlXz6zezzOz4iaLYvzkzi4zm5fVcBhg8mfev:53eCB0v4+e3Oz4iaLYbkzi4zxhfqw
MD5:	01B1A88867472AD60B8F5C0E1648E3ED
SHA1:	9975EA750458E8061DD8A83585675CB7E4910CA6
SHA-256:	FC1B54CA261074E47A8A486FEAC12DD04D46166D1D2B44163BD8791BEC32D275
SHA-512:	20BDFBCD1A5038C81552EBD955F3921DE3447A1F30E64935937768B2B98735AE53049601DCDD2D519646C78E6D03289EB465CFF4F2DADEA7D89A329504C6C475
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Perth) {.. {-9223372036854775808 27804 0 LMT}.. {-2337925404 28800 0 AWST}.. {-1672552800 32400 1 AWDT}.. {-1665381600 28800 0 AWST}.. {-883634400 32400 1 AWDT}.. {-876117600 28800 0 AWST}.. {-860392800 32400 1 AWDT}.. {-844668000 28800 0 AWST}.. {-836470800 32400 0 AWST}.. {152042400 32400 1 AWDT}.. {162928800 28800 0 AWST}.. {436298400 32400 1 AWDT}.. {447184800 28800 0 AWST}.. {690314400 32400 1 AWDT}.. {699386400 28800 0 AWST}.. {1165082400 32400 1 AWDT}.. {1174759200 28800 0 AWST}.. {1193508000 32400 1 AWDT}.. {1206813600 28800 0 AWST}.. {1224957600 32400 1 AWDT}.. {1238263200 28800 0 AWST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Queensland

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.803539644461131
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIaWhSHAIgPWAvN/2DCoRWJvFBx+DC7WN:MByMjL9t2rOvFel
MD5:	401B6B2E30EF17BE20212645287EB94B
SHA1:	67D15A45C61122CE680B829FE0FA3A1C501A8C8F
SHA-256:	DDA669B9BFB3E08FC23CE67030148B9E4740824ADD8DE02580D6AFD31CE05BAB
SHA-512:	F4348F8F4FF261C47854725AEE4E14E7E334B3C31496E5C46B0E0041551CB6861380E684E8888AFE9DA7E8E97236AC322B9CE2738EF245E9D46C9681665F83A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Brisbane)]} {.. LoadTimeZoneFile Australia/Brisbane..}..set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\South

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.752918480727309
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIDRpGSHAIgSRrN/2DCa7QDCuRpyn:MByMjdpQYrt23QHpy
MD5:	D226A0718185854DFE549E00856AA8D5
SHA1:	94EE96FAE259D90C2FDF169DD95BD82B3171FFAE
SHA-256:	D9DCFDC377901EC0C0FEB9CEA743C2C1425273F69A1BAA7BF3B74FEC5885B267
SHA-512:	7EE29A7235CAAEF4889246B7A2241CA9A0D5D2B2E1D56B20141247C93B8736F17280F0D46004AC4588E137D1E76F661C779C906BBFC2B5F8FA73C19F7657F952
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Adelaide)]} {.. LoadTimeZoneFile Australia/Adelaide..}..set TZData(:Australia/South) $TZData(:Australia/Adelaide)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Sydney

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.847525715050911
Encrypted:	false
SSDEEP:	96:AZJigk42/yn8/dnQiAmcO38EJ8i/V9cYgCqMEjKeIZ3wQb25Ly04:AZJuVnQiAmcOM6e0pj
MD5:	C0F1776E011C4C86B7709A592E7CA1EB
SHA1:	1CA528D529BF4995E145D6E0D87A8752A3577E7F
SHA-256:	FC453486325ADE1D31F14087B76D4936F3A6D551ABD1DB6FCAC129BDB043951C
SHA-512:	F872182962C2615A35F012ECAB30C88F07C6BEF0261207AD52706DB22D8CDD0DA65723CD801FDA7C548C5EB0ECFC39DD66CC17503BAA3BBB77BFA35D20650E4F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Australia/Sydney) {.. {-9223372036854775808 36292 0 LMT}.. {-2364113092 36000 0 AEST}.. {-1672560000 39600 1 AEDT}.. {-1665388800 36000 0 AEST}.. {-883641600 39600 1 AEDT}.. {-876124800 36000 0 AEST}.. {-860400000 39600 1 AEDT}.. {-844675200 36000 0 AEST}.. {-828345600 39600 1 AEDT}.. {-813225600 36000 0 AEST}.. {31500000 36000 0 AEST}.. {57686400 39600 1 AEDT}.. {67968000 36000 0 AEST}.. {89136000 39600 1 AEDT}.. {100022400 36000 0 AEST}.. {120585600 39600 1 AEDT}.. {131472000 36000 0 AEST}.. {152035200 39600 1 AEDT}.. {162921600 36000 0 AEST}.. {183484800 39600 1 AEDT}.. {194976000 36000 0 AEST}.. {215539200 39600 1 AEDT}.. {226425600 36000 0 AEST}.. {246988800 39600 1 AEDT}.. {257875200 36000 0 AEST}.. {278438400 39600 1 AEDT}.. {289324800 36000 0 AEST}.. {309888000 39600 1 AEDT}.. {320774400 36000 0 AEST}.. {341337600 39600 1 AEDT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Tasmania

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.777331394201868
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yI4DVJHAIgxnvVWAN/2DC3neDCVDy:MByMjUQVv8At2+eKy
MD5:	9C58D9EFBB03472BBDA76CE2FFAD4BB4
SHA1:	30959E3681B64AE26F7FA3957887896C26AF7F19
SHA-256:	C94FA7A7640CD00963EE8FF1A3D9DCDA2075408739D998EDBF7CFC998DB764FD
SHA-512:	2D6B778217726691F2CB4A4995A8B1AB08DDB7FE4570A3FD04EF54F718F455EF3CBD4EEF1A1BCC99A2088C82A6E89DB455BAF1327CECD6BF608837E50F14A6C1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Hobart)]} {.. LoadTimeZoneFile Australia/Hobart..}..set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Victoria

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.818875198673406
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIvFfkSHAIgoFNNvN/2DCzyQDCMF4:MByMj9fKaNNvt2xQz4
MD5:	0B144A2E47C81354BC510BC741DE5150
SHA1:	A7396F1741F02C6C208FD1286362E4E0720198B8
SHA-256:	DBEF9C5BDD290FEC5FA740D697143332D3CA1FC373CF1DF736F1883AC9BA3298
SHA-512:	562B029591F9ADB8C324BA56E849B2B524E91B26D3DB441510194882A8E1E63E6948D041874A00A0A76F29925A1CEAC53DD2AE5D7F23123B6FE919346CBFD8CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Melbourne)]} {.. LoadTimeZoneFile Australia/Melbourne..}..set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\West

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.831654343064909
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq/xJjXFeyXHAIgoXjrWARL/2QWCCjH0QWCCjQ:SlSWB9vsM3yInHAIgOWAN/2DC00DCt
MD5:	5F5916CB038876BE27AA5E2AD74EE085
SHA1:	18AC21B638188B542455BA3DA91F958DF1724E68
SHA-256:	75ABB7F20C4A0B618138AA190AF33CEAF2A6D2C707DA6C1314E4BFF2F9904F58
SHA-512:	ADFD83E292AC1BB5E19255A9B2DA0E3BB9323A5F9B92D458DE34C291D7F9B6CFBBF62AA3351FB320E54F34305DD485ADC72134D21AFA6A27B2B8B7D93DCA2113
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Perth)]} {.. LoadTimeZoneFile Australia/Perth..}..set TZData(:Australia/West) $TZData(:Australia/Perth)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Australia\Yancowinna

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.918079927018121
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yIcKlHAIgJK3N/2DCkuM0DC9KM:MByMjcKeJK3t2kVSKM
MD5:	BEDEA56FCE4B2F0A3F3E9319856A5560
SHA1:	9FD0FE998A003C6B4CCCD00A977153347DE07F55
SHA-256:	55A9264D0414644A1BE342106AE86086A6659596DC9322A74FC4D1DDB41F7C60
SHA-512:	7C438B72262B99EDEEB31AC95E0135BB722A3B0B049278B6DE67DB5FB501837FB9C03785233B538E83F4B56104F6EA3B3DA0F7C2275E0F78F232161840AA4C63
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Australia/Broken_Hill)]} {.. LoadTimeZoneFile Australia/Broken_Hill..}..set TZData(:Australia/Yancowinna) $TZData(:Australia/Broken_Hill)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Brazil\Acre

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.888429541699473
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7thteSHAIgpth9RN/xWh490th4:MByMYdIp7tQ490I
MD5:	A8A7A10DA4321819ED71F891480770F8
SHA1:	930674EF7711542D7F471A59C1870D4576E027FD
SHA-256:	2F594239A434052D36053A2B3EAB134EADBAD06EB6737E67CF72166DAB157537
SHA-512:	C6AD1869A713DDE0E4DE53F7894E5CE0B7AEFDDD7C5C3D83BB5B92FB7D8E20B373A6694045053E1AE8EA98A7B7D0C052EF2C21310E47DC650A7A399A5F73D586
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Rio_Branco)]} {.. LoadTimeZoneFile America/Rio_Branco..}..set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Brazil\DeNoronha

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.875339623736144
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0wKy4oeyXHAIg20wKARL/1bIAJl0IAcGEwKyovn:SlSWB9vsM3y7/rDSHAIgp/AN/xIAE90j
MD5:	E0D0EFBEC37E27532B49FF6DD9893DA0
SHA1:	9C00993A885AF448E48201A46E17629A7A602FC6
SHA-256:	A676562A90FF8587A775F6F0E3BE05D870456A56D25B5330816BF9043C8D475B
SHA-512:	AB0E6907F9C0002CA5C050A0069AF013B14BADA08CA4553C96B302C078DF7629D5D7EDE4A19A53DEC6E7B9E6D9857F14EC7A1DB9BC11F2EEC9FFBAC70E129EEE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Noronha)]} {.. LoadTimeZoneFile America/Noronha..}..set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Brazil\East

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.948480276987682
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0tQJXveyXHAIg20tQJE6RL/1bJHIAcGEtQJXy:SlSWB9vsM3y7tIGSHAIgpt36N/xR90tF
MD5:	FCCB5F44903E1B988A058E5BBF5E163B
SHA1:	E1CC03DD4A804C7305D8B0C12D8451D08AE262EA
SHA-256:	961FB3AB99A63B1E9704B737EAB2D588B5A39D253A213E175CC678BEDFFD498D
SHA-512:	F31C80E4AD6EBE6CB8A3382E0052DC47601D073E8F81375D50241105675AA3AB45433FFD0534524D9992ABE1086C6671D85FF7C72B0D6766EB9984426F608B77
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Sao_Paulo)]} {.. LoadTimeZoneFile America/Sao_Paulo..}..set TZData(:Brazil/East) $TZData(:America/Sao_Paulo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Brazil\West

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.902113962502196
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0znQZF3vXHAIg20znQv5RL/1bbAWVIAcGEznQe:SlSWB9vsM3y7zn+PHAIgpznSN/xn90zN
MD5:	9F4B43F4F27D0B7EAC0C5401A1A794B4
SHA1:	2A8543B994E93E54BD50EAA78463905E6A8EBE74
SHA-256:	0500C9A248C8CE9030EA30D0AF9DD95DC465480BAF60646C0B7C511FA23C6D1F
SHA-512:	0ADAF708ACFBD80F4704951EEBC24AD144FD5856997A429279E804F3A7F7F9A8FED41DCEE85BFB1ECDBF1E05137E87E7430186474BCF5DE42067FFC74746F048
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Manaus)]} {.. LoadTimeZoneFile America/Manaus..}..set TZData(:Brazil/West) $TZData(:America/Manaus)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\CET

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7736
Entropy (8bit):	3.7984816540097843
Encrypted:	false
SSDEEP:	96:09+xKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt7:9Ss41sFpM5vwA6Efv03TBZLl
MD5:	6DB983AD72FB2A88FC557BE5E873336F
SHA1:	C64E988010087ED559A990B3D95078949C9B4D72
SHA-256:	E2AEA7CFD428A43D9DB938BCC476623ADC1250BD8057013A7FFF5F89D7FF8EFC
SHA-512:	C0A646F80FB2FD42D9146A4FD36CF5A7F62016684F8D5AF80453EC190F4AEA65EDADC5BCF071AE746ABFB43B29C27B2743F2152B6986D41BFDE1617CA774A7C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:CET) {.. {-9223372036854775808 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766623600 3600 0 CET}.. {228877200 7200 1 CEST}.. {243997200 3600 0 CET}.. {260326800 7200 1 CEST}.. {276051600 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\CST6CDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	3.8095769056779916
Encrypted:	false
SSDEEP:	96:e3HgahLi8hbZlNA604qSScBgN+4ctDzIVQ/c/3hNxTh:eQaUqtfA604qSBgI7DBch
MD5:	A6F88C55E8613A27DE3E6C25B0672910
SHA1:	3B593CC17BF153A6209FC5AACE7B88DA9603BD44
SHA-256:	73A9841F233AA657AFB6CED8A86A37D55FE5582DD996B9B28975D218BCCC078F
SHA-512:	526A922B1594A2800B03F363F7BFEC29203D4A4F2B49C5F2618469F59176CE4F8AFBA0616B226AC39D308DB05DE7147714D9B6CDBB2EA7373A041A4D47F50E2E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:CST6CDT) {.. {-9223372036854775808 -21600 0 CST}.. {-1633276800 -18000 1 CDT}.. {-1615136400 -21600 0 CST}.. {-1601827200 -18000 1 CDT}.. {-1583686800 -21600 0 CST}.. {-880214400 -18000 1 CWT}.. {-769395600 -18000 1 CPT}.. {-765392400 -21600 0 CST}.. {-84384000 -18000 1 CDT}.. {-68662800 -21600 0 CST}.. {-52934400 -18000 1 CDT}.. {-37213200 -21600 0 CST}.. {-21484800 -18000 1 CDT}.. {-5763600 -21600 0 CST}.. {9964800 -18000 1 CDT}.. {25686000 -21600 0 CST}.. {41414400 -18000 1 CDT}.. {57740400 -21600 0 CST}.. {73468800 -18000 1 CDT}.. {89190000 -21600 0 CST}.. {104918400 -18000 1 CDT}.. {120639600 -21600 0 CST}.. {126691200 -18000 1 CDT}.. {152089200 -21600 0 CST}.. {162374400 -18000 1 CDT}.. {183538800 -21600 0 CST}.. {199267200 -18000 1 CDT}.. {215593200 -21600 0 CST}.. {230716800 -18000 1 CDT}.. {247042800 -21600 0 CST}.. {262771200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\Atlantic

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.804821796604604
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/0nalGe2IAcGE2NEOyn:SlSWB9vsM3y7UEOXHAIgpUEqA6N/0af9
MD5:	33A04963E70EBF29339204348E0DF874
SHA1:	456C0DB88ECE4D180EEE5AE5AEF5FBEB6E977D00
SHA-256:	6DC6354D761CBE7820C9186568CAB87AD48CA925507F6A740357195B60E16D87
SHA-512:	DF8F46827760BD7EC922C6837E0B6649B4FBD220B79E6F1B67FE3DD8CB3D2D035ECDAF4CF6CE5BDE6DC79C6F7B6EE2B9787AF08A97845CD0D647720A2E78D7EF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:Canada/Atlantic) $TZData(:America/Halifax)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\Central

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.863241040396457
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0po/vXHAIg20puFvHRL/0nPQox/h4IAcGEpoyn:SlSWB9vsM3y7pYHAIgppuRN/0d490pl
MD5:	97E50CE9FBA3F1A6DFCF333F9E6D592C
SHA1:	EE472C411079E788DBF32FAC9C5B7EE121960DC2
SHA-256:	DB32E83949D62478D229E9FB57BB1624D21B3A9CCEE4CD55335F8262C01D820A
SHA-512:	D547E3DC03848A677BE67F7CF4124E067F76EE09BB724A5B10F028BEA72C1526B17678A035B2C53F69498E9ECAACD3C5445D42B7FE58DF706DD2C5F2ADA05A73
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Winnipeg)]} {.. LoadTimeZoneFile America/Winnipeg..}..set TZData(:Canada/Central) $TZData(:America/Winnipeg)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\East-Saskatchewan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.90775999333305
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7hzi2HAIgphznN/0L5d490hzyv:MByMYhiXphntyQ90hyv
MD5:	E4114CC94C5C1DDF98535BF2B25BF109
SHA1:	212BE0FEF7039C0CDB8AF509927F4C03D8F72D22
SHA-256:	27CCEB515F9B2AB2D441F7C1533064AD13C89A6A009C3F2F14842B217075E231
SHA-512:	06C946DC79190F1C0FAF7F1F41BBEE4EE2A40910913896DE5AA94BC848DAB60F4F40A999CA4218FE1AA499854CCDD9379C937A9DEF273B2C7A352D8CAB8A5FE2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/East-Saskatchewan) $TZData(:America/Regina)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\Eastern

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.758562813220951
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0qMKLRXnXHAIg20qMKLRE6RL/0nbHboxp4IAcGEqM:SlSWB9vsM3y7RQtHAIgpRQPN/0Dboxpp
MD5:	4365BEFA3D50EEE20843EF97A095E512
SHA1:	7756049B4CD6459742686925E9516E64A9727306
SHA-256:	22844994AE893F3236A091B050E932E84A5218EC0D01F72595E17CCC471FA564
SHA-512:	CB265E79DF926026BEBF7158590369ABE5353C759540F509ABBA2A7ADBE59A705BC2AB936F400614BE610EDB761DE9A2B1E179A0A8B0A87E595392362C2516AA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Toronto)]} {.. LoadTimeZoneFile America/Toronto..}..set TZData(:Canada/Eastern) $TZData(:America/Toronto)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\Mountain

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.8181126338833655
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx07nKL50vXHAIg207nKLyRRL/0nNYLo/4IAcGE7nK1:SlSWB9vsM3y77G2HAIgp7bN/0W8/4908
MD5:	FA0D0024AD72CCE4EC7229FA897FB1B7
SHA1:	4373A07F2674FE974189CC801987652AA97F0204
SHA-256:	D7A203E60FF19DCDEAAD14121720DE51DA73392D25B40FFA301C1935CDF89517
SHA-512:	82EF7F429604A69734B04D298B4C9C9AC3BE57B9DD8C4CECF59C7AB3470BDFBA0505886C4E6AA3864F5EC7FBB4C69C54CF153A6417376828234833013C29A0C1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Edmonton)]} {.. LoadTimeZoneFile America/Edmonton..}..set TZData(:Canada/Mountain) $TZData(:America/Edmonton)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\Newfoundland

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.998628928230972
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7tgYJHAIgptVN/0xdBx+90twv:MByMYnKpTt590g
MD5:	A2DCCB8BFC65DD4E7C3BB7F10DCEFF11
SHA1:	6FD2F4FAE06C5D4D3F189A167A98AA76497569DD
SHA-256:	87F42F45FD7D059CA47650D445420DE8320F3A7C1CBC7671FBFA8A8881274433
SHA-512:	F42E32C5BD785BA914E5054784BF67DDF951460A708290D1899621CEEDC63475B584FC052A86A3B6D45BF3C651D42427FB6F9CE2A2A33764DFFF731053BECC16
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/St_Johns)]} {.. LoadTimeZoneFile America/St_Johns..}..set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\Pacific

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.887587766811186
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7ZLgXPHAIgpZLgFN/0N290ZLgK:MByMY13p1stx901/
MD5:	68900CE38FE0E40578323BBD3D75184E
SHA1:	9D5EAB5CBCD495DD46974207FBE354A81DD2070F
SHA-256:	5C4FD46054B190A6D4B92585B4DAE4E3A8233EE2996D14472835DDD264911DC6
SHA-512:	3EF53F0FCD8D88A1B977886BDFAA03D7B84EF021AC6BEDF7C571BFBF2242BFC3F3EB6A6B6A9C2F6852AF412A96DFBC30F3BB25A6619CBCD8736F3DF5B64DE1BF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Vancouver)]} {.. LoadTimeZoneFile America/Vancouver..}..set TZData(:Canada/Pacific) $TZData(:America/Vancouver)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\Saskatchewan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.887593462838566
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/0nogS64IAcGEsAzEB:SlSWB9vsM3y7hzi2HAIgphznN/0Hd499
MD5:	A4237BDCAF68B0EFECA97178F3DEE724
SHA1:	A9CBC02B5545A63A0C9B38C8FA7FA2DE6D483188
SHA-256:	46BA00AE3A07A4DC83D6CB517D87C9CBBA491B3421FE9AD6C74CAC5695EB73F7
SHA-512:	832BF256BE8CB2DD205DDE50017448D5830B46FF4DCA77BDB852067EE0C9DF9977014F2A3E3DD6944336158D8EA377CFBBE519EE5B56FB26EB64325B45476B9D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:Canada/Saskatchewan) $TZData(:America/Regina)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Canada\Yukon

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.889486451014262
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7peR2fkSHAIgppeR2rN/0CF/490peR24:MByMYkGk7pkOtBQ90kB
MD5:	490D99BD5465CBF5A8FE28F33180B8A6
SHA1:	4783295C31A804BE98145270ED28956A0783E655
SHA-256:	A1B1AF37DC89C6BA663E4E967A18409AE4E0FA9EF1B908D0461368DA31001C09
SHA-512:	9F6B4F204A21B69E1DFCB766C0671D3736414C73269DCEDCDB4FC3DBA869BBA1511DF6B5061F8964F0AF9C3816133D04E5DFB8A6AD07CA06E7712787A8FECC5A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Whitehorse)]} {.. LoadTimeZoneFile America/Whitehorse..}..set TZData(:Canada/Yukon) $TZData(:America/Whitehorse)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Chile\Continental

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.812019117774239
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7tfEJkHAIgptfEJo5N/0rHM490tfEJB:MByMYE9pEOt4X90EB
MD5:	6EF54792279C249B16877100682F1806
SHA1:	A62629EA055207D917740E3AEF4F0B005EA49CC4
SHA-256:	5B40167DD0C0B5C293861070C4AC249F78DDF8BAD798DD0165E3AE894C9B9570
SHA-512:	3CF93003C3EA2B4386660F0C87074F9AE2BAC4EE72D88451DCB1EA8B79502D2187B1608B6D5CE8D7EDC00AED99CF9DB7B006EB6ED2A2B5009F2C0E757D282D74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Santiago)]} {.. LoadTimeZoneFile America/Santiago..}..set TZData(:Chile/Continental) $TZData(:America/Santiago)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Chile\EasterIsland

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.808907056781067
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG7ZAJWXHAIgObT7ZAiFvRL/0bxOdBx/nUDH7ZAZv:SlSWB9vsM3ycJAUHAIgObJAiRN/04dBn
MD5:	2EC4FDD1EFBAF1D9F9DBAC8B1B5EDD09
SHA1:	FECED8EBC7B666628B7B45C9694FCB3A0B20A42A
SHA-256:	1E2DA1862E0E0F131B7C6EB12FAC5F920852C61C162993A30BC843A464A5AAD4
SHA-512:	74D61141505BAF1ABAD61FB91941C63C169EFE3C85829FEBB4D29A72EA54D1A07EC84E2E9B48E963E65CBF7663245459FAD288D620B1BEFFE682A2D1C243794D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Easter)]} {.. LoadTimeZoneFile Pacific/Easter..}..set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Cuba

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.857134440822812
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx02TEMVFfXHAIg202TEyRRL/0lIAcGE2TEMy:SlSWB9vsM3y76EkHAIgp6EyRN/0l9068
MD5:	3FB16EA4A9B0529220133C4A7B05215B
SHA1:	BD56B6E76A92A5925140CB5CC3D940E1DE90993F
SHA-256:	6F4F2D7F5BCA4E5183460C0153D2B98F5239A99F149DE6638B311C73CEDB1329
SHA-512:	690EC1BCE7FA979BD55725B8ED6DF042BB331CAD332827B2C64B31F107539934AA5A30268B1F03D52697528E68A1BA72E4D56B5199A68B1ED897B75FAFB33A8A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Havana)]} {.. LoadTimeZoneFile America/Havana..}..set TZData(:Cuba) $TZData(:America/Havana)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\EET

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7440
Entropy (8bit):	3.695300167191082
Encrypted:	false
SSDEEP:	96:CgDIMcVbf+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlt:KlfyDjivBeRF+W35Syrwl9h5j
MD5:	34339D40AC889DCB5A09D10F123175AD
SHA1:	57E1F70FA8999106FA3874A9CE1E75A7ACBC81E9
SHA-256:	64E284F9F7A36CC0A352809141D76E73A99344A9F30CFFEA254CBB9D2C589ADA
SHA-512:	2DCF16D9D7593FC3E5844E18FD689AADA157866490CFD37A38A47F747DDA189822055F6DD470CA2D77040D2C5A2527512880C22ED8EC16D9424EDF3DC228AFED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:EET) {.. {-9223372036854775808 7200 0 EET}.. {228877200 10800 1 EEST}.. {243997200 7200 0 EET}.. {260326800 10800 1 EEST}.. {276051600 7200 0 EET}.. {291776400 10800 1 EEST}.. {307501200 7200 0 EET}.. {323830800 10800 1 EEST}.. {338950800 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 E

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\EST

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.924838898127838
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yLbNMXGm2OHLVva0v:SlSWB9eg/ylDm2OHLVi0v
MD5:	B221E7141FFC9DEA317F64F81C7BB4E0
SHA1:	B13BBDE790B169D8B9075275523F319D5173E2C7
SHA-256:	6344BE02529C1CC5F7B5FE14B7E9BBCED4DDE68A24B824601EEBCAE207ABFDF2
SHA-512:	FFFA733476D6C7DCF49C0B88C9F5E381DE2B69BAEDF6C7B1D91C6F45CE2D36E06D40F25B6BB65D4B5D650471BB52CD2EC3F68703DAB4BD5414F8D3F831D92BD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:EST) {.. {-9223372036854775808 -18000 0 EST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\EST5EDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	3.8091719283634853
Encrypted:	false
SSDEEP:	96:R+kNoStCt/cL1BRP0HY2iU7KKdFL6Aa2K4gSLf8e:RXoSItON0HY2iUmUFLqU
MD5:	4578FE48781599B55F4BCF5560019789
SHA1:	4EAA7134621DFDEBFD1405F5CC58227FA7E80C3A
SHA-256:	0BE6161403BC5A96BFAB174F2C3FCBA8A677D4349699B408E9872B9DD0FE15CE
SHA-512:	9ACC2EF396F635D22E3DF6B785831AD74B510049F1BE85F996467A5BBC0DF49A28B2FC3E4CA0CA9DC8FC2C29EA50D909F0B153265B107445D3052E81D9A4D50A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:EST5EDT) {.. {-9223372036854775808 -18000 0 EST}.. {-1633280400 -14400 1 EDT}.. {-1615140000 -18000 0 EST}.. {-1601830800 -14400 1 EDT}.. {-1583690400 -18000 0 EST}.. {-880218000 -14400 1 EWT}.. {-769395600 -14400 1 EPT}.. {-765396000 -18000 0 EST}.. {-84387600 -14400 1 EDT}.. {-68666400 -18000 0 EST}.. {-52938000 -14400 1 EDT}.. {-37216800 -18000 0 EST}.. {-21488400 -14400 1 EDT}.. {-5767200 -18000 0 EST}.. {9961200 -14400 1 EDT}.. {25682400 -18000 0 EST}.. {41410800 -14400 1 EDT}.. {57736800 -18000 0 EST}.. {73465200 -14400 1 EDT}.. {89186400 -18000 0 EST}.. {104914800 -14400 1 EDT}.. {120636000 -18000 0 EST}.. {126687600 -14400 1 EDT}.. {152085600 -18000 0 EST}.. {162370800 -14400 1 EDT}.. {183535200 -18000 0 EST}.. {199263600 -14400 1 EDT}.. {215589600 -18000 0 EST}.. {230713200 -14400 1 EDT}.. {247039200 -18000 0 EST}.. {262767600

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Egypt

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.862365884559795
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsPHV5XHAIgNGE7TRRL/yCh0DcPHy:SlSWB9vsM3y7fHAIgNTRN/yg0DH
MD5:	ACD69F34396296BA553243267D06CEE0
SHA1:	9575FFE5E7833B9532F17AC5413EA9DB23F07ECA
SHA-256:	936B6484469351DEF8FAFE8EC180862729F5E43BDE4E53E2E9636E221B54C3C2
SHA-512:	149D23FF35747127E9A2F4056D09472E8E689970BC795D5411C5BF621D949ADDEBDA68674D375A248A63106ABDFF6C54A8AFE5385C45BE2916CAED0C30F7C4A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Cairo)]} {.. LoadTimeZoneFile Africa/Cairo..}..set TZData(:Egypt) $TZData(:Africa/Cairo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Eire

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.901791318009318
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV5QH+o3vXHAIgoq6QHFRRL/yMQs/h8QanQHuv:SlSWB9vsM3ymnQeoPHAIgonQzN/yM/hm
MD5:	E9C2C97EB65526F1D4BE1AD7385336FA
SHA1:	09E4000CE320F779E2DFCA2FFD6B9258FFBA6CE4
SHA-256:	B78A833337EFEC8B5F64622F1BFDA21FCB79CF290E9CF32A54B206EB20C6FDE9
SHA-512:	EAEC097B58BF466CC7D6C0C6297628AF910CC308AC822565FD6CDABF96CD4EC57D4CC724FE782B6C1B606DFF9424013F6A890A871339577F7CB68BBB3C425E65
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Dublin)]} {.. LoadTimeZoneFile Europe/Dublin..}..set TZData(:Eire) $TZData(:Europe/Dublin)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.928744204623185
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDMbNMXGm2OHvDwy:SlSWB9eg/yRQJDm2OHsy
MD5:	9C08898081382F52CE681B592B8E2C8D
SHA1:	165944424740B1FA9B4B3B8E622198ABD0BDA0F8
SHA-256:	66B0DF8888883BFF44B18728B48CDF24AAED0BB745D601F3422C4F2D4063E0AC
SHA-512:	86EA639F999169F2FBA2457BE5042463A1938031268CCA71FDD03CCBC6194932937BA58B49FBED461E055E9AA668FF6EBF391AA7EC603C0A425416DF2E6CC84D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT) {.. {-9223372036854775808 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+0

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.910789466104329
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDOm7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRSw8RQy
MD5:	333F2BFA92742A49BB88F11C7CD896A9
SHA1:	BB5BEC010C36427AEEBDDA2FB72083E22A3F5073
SHA-256:	64466EA3759301E88C29AD1A833CDCBBC495EB4A5A3AC45E7B2987FECD6702BD
SHA-512:	E2270F4B57C5F1C849726259B886E8644DCF497FA0D034AD48885146BEDC70DC8899900DA9AC01F2609A2DA881E10F9042CCBF75A3F5DA7344D7E92F1B070806
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT+0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+1

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.980500771169276
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOveyXMXGm2OH1VOwVn:SlSWB9eg/yRSvPDm2OH1VOwV
MD5:	A7C3FD06D1E06F125813C9687C42067C
SHA1:	515622C0B63E977AFBFC78AD8466053C4A4A71A6
SHA-256:	3BE1EC71D2CC88FA9A3DB7DC0476475F33FE5BCBE6BC35C0F083859766466C32
SHA-512:	548DA608CFCA5B8539652F94CA2040D624602D2DF64B2C8CCDB8B219B9B384E01386CDF95F3BF77409DF0584FA12A3B73D56D13107D98BEB4C2555F458B3F374
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+1) {.. {-9223372036854775808 -3600 0 -01}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+10

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.965033464829338
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOPFNMXGm2OH1VYU7vV:SlSWB9eg/yRSPXDm2OH1VYW9
MD5:	FF71149E56D4CB553D0ED949B5F4C122
SHA1:	3459B47E0EEC80D7A29512CA4F3F236C89E86573
SHA-256:	E61E826E6FBC2396EF152640698098F4477D4FFDFE5F791F62250C3EC5865304
SHA-512:	43B0CC8BD7F1EFC80C3F14F115D651EADD5743B17B854C2FB7AC25995138D3DF8792915C2952B80F35784A7115F8FB335ACE171479B24C668190AC175523DB21
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+10) {.. {-9223372036854775808 -36000 0 -10}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+11

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	118
Entropy (8bit):	5.002239901486653
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOeJMXGm2OHaBByVn:SlSWB9eg/yRSsDm2OHa7yV
MD5:	08AABA917A8D6B3BB3D0DD1637F5ABFC
SHA1:	D1D704F0250D4CBD450922A02D021E0000FBF5CF
SHA-256:	143528946275DDC8B894218D3F1BE56C950F740828CEC13166C3D7E8E1B6BB7E
SHA-512:	F37AE54864A613C830308CB94AB7CEA9534A86A53B52B4A2C28CEEFE6F5BC0518143AAFD77A6DA5EC55D392F5BD34FCD4B5BE51794B1A386ED783B9BA89C10C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+11) {.. {-9223372036854775808 -39600 0 -11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+12

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.97889339723103
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDONdNMXGm2OH3FNyUFFv:SlSWB9eg/yRSNDm2OH3XyMv
MD5:	7374B66D6E883D7581E9561C3815EB92
SHA1:	235E96A7420DF6733F3CA368D4A2D57766656043
SHA-256:	A93EAFAC2C1089C608C8536127D0E8B53D8C7CFD13AE7DD69339E12A89F803C6
SHA-512:	9BA59B17F20D65DFF1A5A2D557B535F69B04C172AECB15F88CA3484D74CC7D53894985C08653CF13D868BCBD5E7E5041E0CB2F457B5B603F3851198E552E33A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+12) {.. {-9223372036854775808 -43200 0 -12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+2

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.922268982357521
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOcF3vFNMXGm2OHnFQVIyV:SlSWB9eg/yRS0fXDm2OHnFQVb
MD5:	FDDC663E40F8FFFE27959E94625725DF
SHA1:	EE3FBC1F6C8BBCF1BDC9E5DB4D2EA1A57E2E9BB3
SHA-256:	AD5833153446960BDE0653A22AE2111BF80CFD61C3010993CE87B81D40C75C72
SHA-512:	A1B2A153834FEAD7DC27C0918E1B1CB905671F82850C1CAAEBD89F5535703FB259F02F699EA7F82F3044E37668EE93DFA4D4EB862CD437AFF0DABA84867B1963
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+2) {.. {-9223372036854775808 -7200 0 -02}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+3

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.949132511023475
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOFfMXGm2OHBFVGAvFv:SlSWB9eg/yRSlDm2OHBFAKV
MD5:	5C6F16F2CFD46030688066F9BFBE675D
SHA1:	1DB5F36584822EB92E75B9AC9F440FD671BD90AE
SHA-256:	C7BEE4C71905EDDB40BAF42C0CD0DC70BB9F298EAAB8B9367D484B8431DD084A
SHA-512:	FFB2C4CD8EA7DE165C3D989454898FF2023D1A1E3B2B34EC23B1B71EFA7BF2538488DA0069E59F1152B8933D2263B762D2D7C56ADBED826C33FC0BA6672E34DB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+3) {.. {-9223372036854775808 -10800 0 -03}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+4

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.971627677226461
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOqJMXGm2OHBvGQy:SlSWB9eg/yRSQDm2OHBON
MD5:	E35244C1A6084C7BC1D79E437677C55C
SHA1:	898619DA4B8B9AC72E69C7BD30DEA2ADEF9440FE
SHA-256:	26D1EF512CC5797FC63BA2B83C7D6271025F4D4F5C904D9FA8E97F053393D9A7
SHA-512:	0687758558C4C5FF7802F3A57212694A1515761A8337D4B75FFE81434D2AD8A221B005DEC36BF013F2FC3DE1E46DFBED36352811EB7C5A5AE3A167A2E314F57C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+4) {.. {-9223372036854775808 -14400 0 -04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+5

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.956438091983076
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOJNMXGm2OHLVvyV6Aov:SlSWB9eg/yRSDDm2OHLVKVg
MD5:	7C560A0F3C42E399AC1247CB6C516DC6
SHA1:	C314B09D4E369C69C23A8DC1FB066FD0CFDC7211
SHA-256:	054910BDDFC44D9B806BBD3008C30547FA57ECD3C043418C406A725158144688
SHA-512:	FCE8431B759BD5359847734FD98D9D91394916235B2AF587FC927D5F3196FB283E241A6A9200EA852F9265ECEF81402FF6ACD0FA3A4AAEF6DF9DB1B056B3A9EF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+5) {.. {-9223372036854775808 -18000 0 -05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+6

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.974743300958087
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOAkSMXGm2OHvTmULyn:SlSWB9eg/yRSbSDm2OHviX
MD5:	EEB1A3E0FD3339E332587D19C116D4EF
SHA1:	5DBF046031CD354B1EF88E46D3FED74706D21AC6
SHA-256:	D53BB247E0E429A6243AB9A9BDCAE1EE1CF5F271D79748A843631906AB63A988
SHA-512:	07BDF9056DC335C773684E634B1D389FBD139464D4597DE862B7EAC096676A093934682BF911F4E68F299789931218C0E431F0CC6BEBD7275B5FC8015EDD0942
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+6) {.. {-9223372036854775808 -21600 0 -06}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+7

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.930134062078826
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDONeyFNMXGm2OHrXVYVny:SlSWB9eg/yRSNPDm2OHriVy
MD5:	F92B31548D6BF8CCFA326C0CA6E205A0
SHA1:	3FFC6C214EDBCBE9C2509306CE73B429113E1C8A
SHA-256:	6BA5779E35D581B409F53B14B6E28ECC16F536FFEDD45DDBC8DAE4B8C28F66E7
SHA-512:	317872E986099D02AF083397AE936854043D54CEBF45A70672F02DDC9E2F3B27BC3FA80902F9675131C51A09BBD3C2BD1CD437330935CEA113C643769E0DF20C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+7) {.. {-9223372036854775808 -25200 0 -07}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+8

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.915798027862021
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDOOF3vXMXGm2OHmFvGpn:SlSWB9eg/yRSqfXDm2OHaOp
MD5:	B31B15E6006F8DF0D7627D6C90FF39AF
SHA1:	7C4137BE11DA84771DF6DC5EBC32D5E5E87E060F
SHA-256:	CA87559B154B165E83482AEE3D753BA8E38ABCA347A005E8504C566433CF4CB3
SHA-512:	220F7E7379EABBC8ACD7ADBB7A4AC8E93E4B268F8F1C0965B7E6A09735EE86E293EF1C492990331EEB4176B8301A91EC20579756B962AE45C858A96C09349CCD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+8) {.. {-9223372036854775808 -28800 0 -08}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT+9

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.95764928386407
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDO3fMXGm2OHNms:SlSWB9eg/yRSPDm2OHNms
MD5:	5B10173EB7119F1219250763504A3526
SHA1:	A845021437C4638079040EF27AEF163C865FF8F8
SHA-256:	A0987A1D078B0993FB3B07208E3F4538A2319DCDDDEB2FAEA32FC463DEAFB8DB
SHA-512:	D213285D0A723B7771263122AFA269C2ABD0325A97D32C3870341255C06597DD6851C22860CFF42BF54E3FF5A36FC88C306F3BF1C69E7BD7FD7F69FE7601ED1A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT+9) {.. {-9223372036854775808 -32400 0 -09}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-0

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.898210849752128
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDIyHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRUyJ8RQy
MD5:	5AFB7F12BA056619252D48904523DFA9
SHA1:	CD6E6681C8302BF38095975DF556BD14959FDAC8
SHA-256:	EFF27B3DEE9306641FF344801E06BB33FF768CDCCFE2409FA8AF752FF6D39F66
SHA-512:	2869BB347F42667A3D174816466B15916FC61FCB5A6A1BE1DD750C5C1751602FEE0FE5A27651B7A19C9F6764872DD0F00D3D5AA16CA1A743DBA09646D25A4EB2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT-0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-1

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.979902281541545
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDI/fMXGm2OHMKUrn:SlSWB9eg/yRUXDm2OHtUr
MD5:	4000096844091488200125FC8F50E2F5
SHA1:	9FFEAE66405CFB254180C7DBE185288791DFEE5F
SHA-256:	B4BF883FBE9246EF4079179A746B1F9E59F2C77D4F598794B60732D198DC6044
SHA-512:	25C69E04018C2978A2E5748F0D3C61157453D998C16FA4B3C257A6515B87F5FD2B754893B47604BBC60AB60B60BA162BF2D1463E616E72CB8713C736F1B4D428
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-1) {.. {-9223372036854775808 3600 0 +01}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-10

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.964101313797091
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDINFeyFNMXGm2OHMUUMy:SlSWB9eg/yRUN5XDm2OHXFy
MD5:	AE6601FACF6BE1E68083F8D353901181
SHA1:	8B3BFA307D2A94BADD3A1A5E42545D6F7C620BCE
SHA-256:	EF3046D7789CAE069B5473D053F3EF0157248F8A359A1282EE02BA613A75FC94
SHA-512:	1859E6A2CB94EFEE7CD5C17803AA4F2DEEBE4DCF43D3B1EA737DF00BA86ECEC79D296D75E69D5829DECB48380B6B650724104FFA7959FD18FE032DF7D002A88B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-10) {.. {-9223372036854775808 36000 0 +10}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-11

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	5.00162575418652
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIVSMXGm2OHlVVtyn:SlSWB9eg/yRUVSDm2OHlVLy
MD5:	D864BA451C9E441BF47D233626C57B99
SHA1:	6C38E6F8BA292575C496124572D187F97C9F8E73
SHA-256:	CCDEADBD18BE81E59A669A460A14AFCBFF733C3A5D164FC2B6B93DEAF009B78A
SHA-512:	5C16BD1189F3FE6789CB3630C841FD168EC87D0498EE6FCC4C8D635F8CF4BCAF0558B44F859C37E418F6BC5A7F6693D6EF1DD218A1DB6DA2D54FF55916685119
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-11) {.. {-9223372036854775808 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-12

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.978079707159482
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIjbNMXGm2OHwvv0UIoAov:SlSWB9eg/yRUjJDm2OHwvv0YAov
MD5:	C3E7748C7CB9D8A7F7FA5170D5098983
SHA1:	54F5374A32173BEC6EDA430745DCD18749ABC233
SHA-256:	23B61B18C653E25F7245B0BB6E04AD347E038585B145962FD1EEACE26F118D54
SHA-512:	4783A7CD4C94CCC67C1C71F9C5D9CD99A3918EA4792D8CE2443ACE8F034B9023EBC02405B5DEAB919AA35FD1FD29D8980774316AC96D32ECDEBEFA15BBE6878D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-12) {.. {-9223372036854775808 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-13

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.994320173226919
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIaMXGm2OH1dNv7Dy:SlSWB9eg/yRUaDm2OHty
MD5:	224AAAA8A31C283F50149A090E3970D5
SHA1:	E7E4876EC2474FEFD82D4B174CA8E3A3427062F5
SHA-256:	A9F1AD5A7CB5ED43C5E6E8A7A9B887329890ABB75B9FC9483B8543A367457EBE
SHA-512:	6EE0C6F519AAB2DAA3F7D802F0F838BA9F6BF1D56530000D3C9EA4FDA81DCB9832A3285E36208F29EEB23C27EC5BFD3438DC272929A7531268B7C0626A65D6A5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-13) {.. {-9223372036854775808 46800 0 +13}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-14

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.9895752453470585
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIxhfMXGm2OH0FVtXvFv:SlSWB9eg/yRUxJDm2OH8jNv
MD5:	8ADF71739DCADE63433B7BF8321EAC77
SHA1:	AA6BDE83FF0D8BCFDE0426160250F2D17D3AF81D
SHA-256:	A37A7160027BD38356764C4D1AA5B9B17F8D5DC3CFB81EF2ED399E44C41734CE
SHA-512:	AEE3929DE269ADB5265A54841F041E41595359C101539F6309A4E737E3F5DF0BC91560781C7118975398C29A084113682C78F66E07E2E4AC5EAC8DFC33C4F0ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-14) {.. {-9223372036854775808 50400 0 +14}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-2

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.921164129348819
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDInWNMXGm2OH/VXF9:SlSWB9eg/yRUnSDm2OH/Vb
MD5:	CABB864F4E76B90928F5C54CD9334DEB
SHA1:	4818D47F83F16B9F7612D1E979B2440C170ECDB9
SHA-256:	7211BF8329B2388563ED8FA8C5140099A171B8A303A9473E9A6F3AF0C5D239CB
SHA-512:	1FDCB05D675F1D28CB52B9F5EAC7EC52FDF2CE7E7411740A6F8FB5E9D443ED636CE268E3AF9E08605CC3E13A49B2D86FF4EA6A85F518D5C79E263BA94263361D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-2) {.. {-9223372036854775808 7200 0 +02}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-3

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.948161547682094
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIYyXMXGm2OHkNsWYcv:SlSWB9eg/yRUlDm2OHkKWYe
MD5:	4AE5F29A13A86E4A7064E9200668E43B
SHA1:	2460BD1BB0FF3A3C774A5C7CC3DA10235DA06B0D
SHA-256:	BFC86D65B0B94725DCE4C88EDC4300141ABBCA4B6CDECF037C437DF49F0C1D6A
SHA-512:	190DC38B4A20F964C967866507086317D85D979DFCFA415D1569C485C6476024922BC6E7103273C41889D9D7B22E97933F286FCF4D341248077C1BA777D0EE3B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-3) {.. {-9223372036854775808 10800 0 +03}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-4

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.970850637731657
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIQXMXGm2OHkVsRYovV:SlSWB9eg/yRUQXDm2OHkSN
MD5:	BBAF760E27C02D176A675AC3CF2D1E6D
SHA1:	E524FAA7D424A1C1545D1D8EC00169125A68E8E5
SHA-256:	02E2EEAF88EE179EF63DD29ACC7384A4B46DE1E3A151C1F3A5DD31BBB5A05AEE
SHA-512:	6AC7CC0E52E7793C7F2D3DDA9551709DEAE654C1182EAD7108D04F1BAAAB7E1C473B6E8A3A126B0E421D8A246294A03B2EE9E070330924502DF2869CC61C37F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-4) {.. {-9223372036854775808 14400 0 +04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-5

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.955530107787899
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDI7tNMXGm2OHM0VQVFv:SlSWB9eg/yRU7PDm2OHnVQVV
MD5:	17F64A5969D3755211E60C0A9F83974F
SHA1:	FEFA84725EFAE6405F43797296C342B974F2D272
SHA-256:	3A2C75DCA11D1167126F0D44A8682420FAF75B0B82B3DCFC35A9F028A9A759E8
SHA-512:	77DBCD8284A470E4869976E2E8A5EDE28104283F120C863785A6B2E64CF87E06243196817C0055A9B32D6FFFE94A25772F67D58BF8E885F7EC06C34FABE38766
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-5) {.. {-9223372036854775808 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-6

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.973993120288556
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIg3fMXGm2OHETNSTVVn:SlSWB9eg/yRUgPDm2OHETMX
MD5:	51CAF7956E133C8A9788AE0B8C6145AB
SHA1:	47F8B49DF9ED477BD95F908693A483AE4FDE881F
SHA-256:	D22C87321373EC0EFB0F312925476CD0747323EF303E17621A871BF814C8ABB1
SHA-512:	EC4B4BE74C1BA64DEC8EF11DAAA338C52BD67D55E8A2352FBC6C83FA142F8DBE424CC1110E9A9D9A891E1E858D1FFA6D1E3B997D41BBB374556FA1F9A708559E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-6) {.. {-9223372036854775808 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-7

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.928999319005163
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIpdNMXGm2OHAXUVSYovV:SlSWB9eg/yRURDm2OHAXUVSYyV
MD5:	56D88B54CA33B43E2E7D3EA6AD3A4D6E
SHA1:	9351E0C001C5D83325281AF54363D76D65548B7D
SHA-256:	70CB3A766A2E84148B68613D68687D263D3592ED4B6E672797FB20801ECA8231
SHA-512:	32B58AD16F64590903C7AB49BA4890DAF6F1F3D33187A7654D3DA88A1C0047483EAA58B2498D824A30116E235FCC8F8FB3FADD57F86396240E5D92B2CA337027
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-7) {.. {-9223372036854775808 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-8

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.9145396982864895
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIlSMXGm2OHN/VsdYLyn:SlSWB9eg/yRUlSDm2OHUp
MD5:	E462AD5E0C046EA6769EDB4B2C80F4D4
SHA1:	6DDB94485648622875E0927BA1E8CFE67CEC1382
SHA-256:	80C85D59416CEC91DB3DAC5FDD2FD7B91D6FC74A37BBBEF6FF58F6F6816E8FC9
SHA-512:	42734FD2DA8BD6E0BC271FF1375A31DEB72EED85AB5EA6E1E0F81EE4E3E7E74380FFC98FAC30409684F736DB580AAAF4F62DB4757AA35C10383584F6144EF363
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-8) {.. {-9223372036854775808 28800 0 +08}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT-9

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.956751740978211
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRDIeyXMXGm2OHENScFAy:SlSWB9eg/yRUPDm2OHsScr
MD5:	98F70EC1B1AC7D38CB8D01705FB0CA56
SHA1:	EDAFA132E48935ACEB8E72D3FF463E4FC857C1A9
SHA-256:	57395BB968AFA5A041EADA4B684B82F0379A9333F9522D69F069A79FDEA2B8D7
SHA-512:	97B8D7603D6B54C075B005B905B2A7A28B8BEA67894F055663C44D2BF730BB937AC8EF5B2DF182BDD2D9EFFDBD135DF9467C813AEE39AA6B34256908A12DC011
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/GMT-9) {.. {-9223372036854775808 32400 0 +09}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\GMT0

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.886484135647838
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRDVMFHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRC1p8RQy
MD5:	F879FB24EA976394B8F4FAF1A9BF268C
SHA1:	903714237EBD395A27EAF00B3DAAA89131267EE5
SHA-256:	AB742F93BE44BD68AB8FE84505FA28120F1808765D9BAED32A3490AF7C83D35B
SHA-512:	F5EE4C331E37036516F2A1BF12F2E088B2E2C7F6475127BF4E7B4937F864550D64D570BC855B6058D4311755E8696EC42095A36AEF13BB29E62192EE0AFB6EAF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/GMT0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\Greenwich

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.911342539638601
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/yRp+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/yRp6BURQy
MD5:	CDD2DE9CF0FECFEA0CDD32DAC32DCDE2
SHA1:	311CD4C6E819E18BAAACC382F81359BC208E2F73
SHA-256:	F89167B6117838D9679C0397496B6D96D3A7BEAEF0BD99406ABACDBDB658FBCC
SHA-512:	1AF061D07D2F579A089905B6B259AABD7C58F4FA0CD379EE54206164F0DCAEA5C720FB1F5E76F5782F8613E62D8F83BD55F1848D5D7A73D4A5C9F7BC6B9F5DB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Etc/Greenwich) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\UCT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.838936002050477
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRKh8RFB:SlSWB9vsM3yzTHAIgm6N/yR68RX
MD5:	0587EB7D1B1C684A4A0F90D3CB0959C8
SHA1:	3F2840AE512774494D9A0B6357C52CCB7DBA5265
SHA-256:	0856D14DBBC53D46460BCD530BD070E9E8966D1C96BA01BA556E215A98C09CD4
SHA-512:	DE38EF28893853219AC24AE4A522307ADAA1502F6D0C129219FAD9D75CFCE03A505C3E0758CFF2D2D4F7101414A5F7E4FC1C1B119B667E6A9C89B60DDA641E86
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/UCT) $TZData(:Etc/UTC)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\UTC

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.903699772785336
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/yRF3yFNMXGm2OHvL:SlSWB9eg/yR9SDm2OHj
MD5:	3D3F94B6AC5FA232E509356C703D9177
SHA1:	502B8EE9D4A1EA75A91272181AC87B9B6ECE1F84
SHA-256:	4D74D9EC2397B1708FEF47806294B0BCA26679F3A63149AE24E4E0C641976970
SHA-512:	205A761A01C577F602236CB5C9938C834B7F3F9F681B94036B0A86101119893EF87D206D0C3F7737075ED833D4E35E374ACAE6605163E9C37B705D99BEBC928C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Etc/UTC) {.. {-9223372036854775808 0 0 UTC}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\Universal

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.874807282103623
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRYzXDJMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/yRY7VMr8RX
MD5:	65E28EFF342B625E79175793FD38F9FD
SHA1:	08B11474822E670DEAB8F0EA168BAED7D5E3DBE1
SHA-256:	A2B62C5914DE169A68A018A5B47C1253DBCA10A251862D17B0781ECFD19B6192
SHA-512:	79641D0E05F81BFB80034937D34E74B7483A790F33C1F9A0FA92C6A7913AC8C03036CFDEFB43850B84EFB3DD3C4A39022DC8F22E5B5DE6353586A546E03A5789
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Universal) $TZData(:Etc/UTC)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Etc\Zulu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.874356623237119
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/yRaQEBURFB:SlSWB9vsM3yzTHAIgm6N/yRYaRX
MD5:	EDABCAC858EC9632D5D8DCCFB28F4D6E
SHA1:	E5BEF1367A97A1900749CE6B1E01CF32F582BDD9
SHA-256:	BBD6E93206FF3B7017AFBE63905B4C932C422B582F3CE2A79A7B885D390EE555
SHA-512:	3A22364D423F2F970123561408018A2B72F43C4978836D3B6DF7517217445605838DCB8DDBDA204FD01C49A4A7D5ADAD4CA8BDA7C3B412D54750BAEAA589B683
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Etc/Zulu) $TZData(:Etc/UTC)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Amsterdam

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9102
Entropy (8bit):	3.899679308991091
Encrypted:	false
SSDEEP:	96:UvV6eHuZ+y+2KDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:SVJUSs41sFpM5vwA6Efv03TBZLl
MD5:	262A99D2D471F855C2A3C96CACB0C431
SHA1:	2CAC8BFAD1A626A189413203ADA2E2B753A6DA69
SHA-256:	5808F77CAB37ED4F52F0A02FF0B75EA194F8799A2165695CA3650579CAD498D9
SHA-512:	6DC3BD4177292C07390CD0EC2F672FB6846CEEFA1A2C57B2C8E84CE43C90486544350DA998A5E36CA7A02C46859B4183D829B26013E01071014C6E2849D6573C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Amsterdam) {.. {-9223372036854775808 1172 0 LMT}.. {-4260212372 1172 0 AMT}.. {-1693700372 4772 1 NST}.. {-1680484772 1172 0 AMT}.. {-1663453172 4772 1 NST}.. {-1650147572 1172 0 AMT}.. {-1633213172 4772 1 NST}.. {-1617488372 1172 0 AMT}.. {-1601158772 4772 1 NST}.. {-1586038772 1172 0 AMT}.. {-1569709172 4772 1 NST}.. {-1554589172 1172 0 AMT}.. {-1538259572 4772 1 NST}.. {-1523139572 1172 0 AMT}.. {-1507501172 4772 1 NST}.. {-1490566772 1172 0 AMT}.. {-1470176372 4772 1 NST}.. {-1459117172 1172 0 AMT}.. {-1443997172 4772 1 NST}.. {-1427667572 1172 0 AMT}.. {-1406672372 4772 1 NST}.. {-1396217972 1172 0 AMT}.. {-1376950772 4772 1 NST}.. {-1364768372 1172 0 AMT}.. {-1345414772 4772 1 NST}.. {-1333318772 1172 0 AMT}.. {-1313792372 4772 1 NST}.. {-1301264372 1172 0 AMT}.. {-1282256372 4772 1 NST}.. {-1269814772 1172 0 AMT}.. {-12507

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Andorra

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6927
Entropy (8bit):	3.8182041031531897
Encrypted:	false
SSDEEP:	96:CA34elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:CI41sFpM5vwA6Efv03TBZLl
MD5:	D897DCA686A03495EB2C3323FAB0BEAD
SHA1:	1433BC303DE92F7B36F881C8595A42B35E0814FC
SHA-256:	F0B48DA7CA3659450D87CC0DDFDDFD28B464543DF1EE40D935C44D5CD7C9B9B3
SHA-512:	A1C4AE1E0EC26B159B0F5D058A7A77B8774F611A4D3C6AECEDD7186957D6BD9F15CDFCBA248FCC8A4B4146BD72CD7D66B9F88A2BF7CDEF416F1831A2F335D48C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Andorra) {.. {-9223372036854775808 364 0 LMT}.. {-2177453164 0 0 WET}.. {-733881600 3600 0 CET}.. {481078800 7200 0 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0 CET}.. {733280400 7200 1 CEST}.. {749005200 3600 0 CET}.. {764730000 7200 1 CEST}.. {780454800 3600 0 CET}.. {796179600 7200 1 CEST}.. {811904400 3600 0 CET}.. {828234000 7200 1 CEST}.. {846378000 3600 0 CET}.. {859683600 7200 1 CEST}.. {877827600 3600 0 CET}.. {891133200 7200 1 CEST}.. {909277200 3600 0 CET}.. {922582800 7200 1 CEST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Astrakhan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2063
Entropy (8bit):	3.679377249443024
Encrypted:	false
SSDEEP:	48:TvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDOP:rCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
MD5:	CB860328FA96A14055BF51A3B2D35A08
SHA1:	CFA49DC861F4AC3D29A78D63D71C2D6D83D68F84
SHA-256:	4B5FB0AF225974D117374028285F20A02B833FF4136E6BFAE7B65E6D6D28829E
SHA-512:	960152826F4245012462E53F80B69B0C45C27D75D46C70D485674CA19071DF268671C7691B614BE53B9E7BD8CFEC5D24F3DCF933F2F14D827F2A32EB347D7540
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Astrakhan) {.. {-9223372036854775808 11532 0 LMT}.. {-1441249932 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {7

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Athens

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7954
Entropy (8bit):	3.7252594544513795
Encrypted:	false
SSDEEP:	96:1D/8QdzFu+f+uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:Z/8ohvyDjivBeRF+W35Syrwl9h5j
MD5:	8B2C99E1CD04D7559709FDF8D382343C
SHA1:	C595D5159C742B815AF89EC8604376E01291F9F1
SHA-256:	47353319419505AAB205C23F8C97EA0B12E5DED2113147794F77B67349AFF52F
SHA-512:	227CA21A3B6160357988582E261A62AE7B09D46D479EABFAC8039185D710EFA765CD1694F4388EBF8800978A1E1DB69F6AF9BB9BF82C0FCD66E883930E1F8249
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Athens) {.. {-9223372036854775808 5692 0 LMT}.. {-2344642492 5692 0 AMT}.. {-1686101632 7200 0 EET}.. {-1182996000 10800 1 EEST}.. {-1178161200 7200 0 EET}.. {-906861600 10800 1 EEST}.. {-904878000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844477200 7200 1 CEST}.. {-828237600 3600 0 CET}.. {-812422800 7200 0 EET}.. {-552362400 10800 1 EEST}.. {-541652400 7200 0 EET}.. {166485600 10800 1 EEST}.. {186184800 7200 0 EET}.. {198028800 10800 1 EEST}.. {213753600 7200 0 EET}.. {228873600 10800 1 EEST}.. {244080000 7200 0 EET}.. {260323200 10800 1 EEST}.. {275446800 7200 0 EET}.. {291798000 10800 1 EEST}.. {307407600 7200 0 EET}.. {323388000 10800 1 EEST}.. {338936400 7200 0 EET}.. {347148000 7200 0 EET}.. {354675600 10800 1 EEST}.. {370400400 7200 0 EET}.. {386125200 10800 1 EEST}.. {401850000 7200 0 EET}.. {417574800 10800 1 EEST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Belfast

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.876296755647751
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQahs3QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/y72
MD5:	7160C6EE32380846653F016AE8AFD52A
SHA1:	DE7805089639C54893F2107FA67342DA72A79BBC
SHA-256:	557023674F6E8376707517103EE69C1DEBBE53CDD4BCAB11E763CC53B9CB1908
SHA-512:	FDBDECBBDB0C419226E2604608FD2923CFB06E4B6948493208FD83FD796880E81F6147C0FAFEB572079C9C916831B7B055620EC939164CCA1DAF76897BE60F2C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Belfast) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Belgrade

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7309
Entropy (8bit):	3.8204712502914653
Encrypted:	false
SSDEEP:	96:lp+/4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:lY41sFpM5vwA6Efv03TBZLl
MD5:	02A003411B61A311896A6407B622152A
SHA1:	3B8BC6D1AF698CE7BB14A08307F5A4295EB8ED03
SHA-256:	74B225511B518B0CED972CBB33D694697712CCB96A6D81E0F50ADA28CF6E2C92
SHA-512:	9E03B3EB1E528E5B1ADBA09F808E73BF9C4314EDCBF6F96E46844D51A5F425BED3EE8FD5BA8706C46A7FB9882485F119F81996F2EAB7E1E9B598978C402DDE0F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Belgrade) {.. {-9223372036854775808 4920 0 LMT}.. {-2713915320 3600 0 CET}.. {-905824800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-777942000 7200 1 CEST}.. {-766623600 3600 0 CET}.. {407199600 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 360

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Berlin

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8020
Entropy (8bit):	3.820756136386754
Encrypted:	false
SSDEEP:	96:Pi9+qFR274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:PQs41sFpM5vwA6Efv03TBZLl
MD5:	84027C3C8315BD479B38DE11F38E873F
SHA1:	6E92A2A9734A9C6B02ECCD99F114D667C909C5BA
SHA-256:	7E7111F06288069B52A4E1CA0B016216DF9328FB3B1560A740146497CCDD4D24
SHA-512:	5FFDE523021FC0C490261F55999204C9CE6C8C274888525EA6EE7C01BC5CCABC7A3877FD454B4167D81F4B89BACB087E8BA6AB0BAC46C2874ED9257BE2092340
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Berlin) {.. {-9223372036854775808 3208 0 LMT}.. {-2422054408 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-776559600 10800 0 CEMT}.. {-765936000 7200 1 CEST}.. {-761180400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717631200 7200 1 CEST}.. {-714610800 10800 1 CEMT}.. {-710380800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Bratislava

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.943205109348136
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVtXrAeovXHAIgoquXrsY6RL/yQahcvEB5yQazXrH:SlSWB9vsM3ymzbAeSHAIgozbsY6N/y7c
MD5:	C69AB60BE74D4BB7E31BE4E5ECCD8FD2
SHA1:	9DD0BA6171080F074858EF88ADA2E91C1F465619
SHA-256:	1D7C539AAA1E3AD5EF3574A629523B5B781F1A91D352C9B39B8DE7316756026E
SHA-512:	C273B97CCFB5F328EB7A13CCA3126DE8D91B3876CBD248990C0BE063DDBE5B0F31EA138E31A1C5C43B1ABCF42EA511448E6DC589EB99E8172D7C2A68BA31A8E7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Prague)]} {.. LoadTimeZoneFile Europe/Prague..}..set TZData(:Europe/Bratislava) $TZData(:Europe/Prague)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Brussels

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9223
Entropy (8bit):	3.8450929464870804
Encrypted:	false
SSDEEP:	96:RhcSQnG1Czyc1+FdDKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcM:Rh8zyc4Ss41sFpM5vwA6Efv03TBZLl
MD5:	E6C1153C3F71C8C005D7A46DDF6461FB
SHA1:	CBDF7D5D36AF57D83859C910B493464617EC9571
SHA-256:	1402A2072ADC9EBB35F4C0368D2E9A7A11493626C667C022614FFB7CC05B6CB6
SHA-512:	8B1B47678F75DBE59DB08E034F0701BD11FF4FD3AD0304C8ABF45E848F717D2787B8E47558D3C334D369E0938C633DC217178D3EAE6486CEFBE25CF1668479F6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Brussels) {.. {-9223372036854775808 1050 0 LMT}.. {-2840141850 1050 0 BMT}.. {-2450995200 0 0 WET}.. {-1740355200 3600 0 CET}.. {-1693702800 7200 0 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1613826000 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585530000 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301263200 0 0 WET}.. {

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Bucharest

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7974
Entropy (8bit):	3.7264631277913853
Encrypted:	false
SSDEEP:	96:vMSsQMAz5CXNU5paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:vMS1kdUoivBeRF+W35Syrwl9h5j
MD5:	88DB5686937D3499A8142413B2CF2EB5
SHA1:	E37BAD2127553600D0E38A43053D1B07B2498DA8
SHA-256:	C560D45104A8DD73FC7370B5AC1615E22043DBC93DFB46A9ECC6468C2D38B19A
SHA-512:	375B8A63CFF2E278CD8C78BF9DBC86288FFB1AD57DAED00CD2199F0B05F4FBFA7D17D93C6458B20B86F6D05F3E3A49D594E60AC97DDB47141E21D7CDE10F8456
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Bucharest) {.. {-9223372036854775808 6264 0 LMT}.. {-2469404664 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {296604000 10800 1 EEST}.. {307486800 7200 0 EET}.. {323816400 10800 1 EEST}.. {338940000 7200 0 EET}.. {354672000 10800 0 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Budapest

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8287
Entropy (8bit):	3.8244305880244567
Encrypted:	false
SSDEEP:	96:rHw0+D5xp4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:rQXj41sFpM5vwA6Efv03TBZLl
MD5:	11468F958796F971ADD5FB1A0C426D78
SHA1:	3FA58BEF391BCF7BAC6A124D093B6505B4EAC452
SHA-256:	B58F3E9066B8B57EB037D509636AA67A06ACC8348BE6C48482D87CDC49844A4E
SHA-512:	0492EABD6EE16392C00A196AF38995E5F9E55E30A82A50EFFB381DC978E9E63E801555CDC219869E6251BD51115972F742D8A7D9524372B8B11702AE4B28BFB7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Budapest) {.. {-9223372036854775808 4580 0 LMT}.. {-2498260580 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1640998800 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1600470000 7200 1 CEST}.. {-1587250800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555196400 3600 0 CET}.. {-906775200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-778471200 7200 1 CEST}.. {-762656400 3600 0 CET}.. {-749689200 7200 1 CEST}.. {-733276800 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-686185200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-492656400 7

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Busingen

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.952483060656419
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQahDZALMFB5h8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/y7D17/f
MD5:	CED145F8D9B231234E021D2214C1064B
SHA1:	7B111DC24CA01C78A382CECD3247CF495D71CD34
SHA-256:	F511A80AB70FF93A0EB9F29293F73DF952B773BB33EB85D581E4FB1FE06E4F05
SHA-512:	E2323C04BF99909ABA9A09A66F9B4696519B5F9FE3AF178FB04D5E0053F41CAA8B937DC4148954ED093D317F454E0547786BEC934F2ABF22A60AAA6A24E63BF9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Busingen) $TZData(:Europe/Zurich)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Chisinau

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8096
Entropy (8bit):	3.7635458172251406
Encrypted:	false
SSDEEP:	96:jXSsijEpkv2XkN8qc/OyEie8hF5WQ9VX/Zs1cw27oXqdCA5XqjqFLigTE9s5VpJ:jXS+WeUqKie8hF5f9PwdXM9
MD5:	E7F52393523729CA3916768B3F3B4E55
SHA1:	1524A3E610DCD33AC0006946BAB2929CA7F5A33F
SHA-256:	2BD1C0AB412A5E9C97F533C4D06B773D045215B92568A4E89ADC93C7462D62EC
SHA-512:	218674ECD9FD6C1A1C83EE69AFE6AA5AD0D5A8BB59FF497FDF2573B7CF52DAE98ECE0815CF99668CA4E172FF67D220B227369865076333B3EE802A8839C65279
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Chisinau) {.. {-9223372036854775808 6920 0 LMT}.. {-2840147720 6900 0 CMT}.. {-1637114100 6264 0 BMT}.. {-1213148664 7200 0 EET}.. {-1187056800 10800 1 EEST}.. {-1175479200 7200 0 EET}.. {-1159754400 10800 1 EEST}.. {-1144029600 7200 0 EET}.. {-1127700000 10800 1 EEST}.. {-1111975200 7200 0 EET}.. {-1096250400 10800 1 EEST}.. {-1080525600 7200 0 EET}.. {-1064800800 10800 1 EEST}.. {-1049076000 7200 0 EET}.. {-1033351200 10800 1 EEST}.. {-1017626400 7200 0 EET}.. {-1001901600 10800 1 EEST}.. {-986176800 7200 0 EET}.. {-970452000 10800 1 EEST}.. {-954727200 7200 0 EET}.. {-927165600 10800 1 EEST}.. {-898138800 7200 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-800154000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Copenhagen

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7722
Entropy (8bit):	3.8237774522471564
Encrypted:	false
SSDEEP:	96:vFKb+vS74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOR:vFKX41sFpM5vwA6Efv03TBZLl
MD5:	F9BC892F4BAE6712718C75AA5A07E1C7
SHA1:	D7BDB30B9E10A7B6FABB5A257F9F6C538C1E3371
SHA-256:	C6ABC78AD0F03F903E04DB41067B555F9E589E321E253A01ED819189C6FFFC0E
SHA-512:	A8F8BF7ED070A5DA021BC0A5F87003B7DE433EA66B38A09CA6BDC5F4DC964D35758AE325B0687694AA5F712EF563D1EB8444D11CBDD8332457AB8BBFF8602363
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Copenhagen) {.. {-9223372036854775808 3020 0 LMT}.. {-2524524620 3020 0 CMT}.. {-2398294220 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680490800 3600 0 CET}.. {-935110800 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 0 CEST}.. {-769388400 3600 0 CET}.. {-747010800 7200 1 CEST}.. {-736383600 3600 0 CET}.. {-715215600 7200 1 CEST}.. {-706748400 3600 0 CET}.. {-683161200 7200 1 CEST}.. {-675298800 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Dublin

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9810
Entropy (8bit):	3.7669748644882417
Encrypted:	false
SSDEEP:	192:fbxxHZiMU8EKTy74jT56XdEN1+UZBdMN186LPR:fbzZiMUZ6y0jT5bZHMN186LPR
MD5:	726F01B47BB99952639200AB73E29425
SHA1:	FF38CF353CE007BE871A27DDF836D198D21F167F
SHA-256:	930F4E37B6D60B6701CBA95EEA1F6053D85E5F9DE6BBE287A0D43E24B9D63FB0
SHA-512:	CF3567BCB23C75527F154C987FAFAD09A5E84E0745A3DB55D268688E5BB37D4E17E2D71EF608FA9C1CA99066BD384108AB9F8C7AD5CAC9A95BC6A541B0135699
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Dublin) {.. {-9223372036854775808 -1500 0 LMT}.. {-2821649700 -1521 0 DMT}.. {-1691962479 2079 1 IST}.. {-1680471279 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1517011200 0 0 IST}.. {-1507500000 3600 1 IST}.. {-1490565600 0 0 IST}.. {-1473631200 3600 1 IST}.. {-1460930400 0 0 IST}.. {-1442786400 3600 1 IST}.. {-1428876000 0 0 IST}.. {-1410732000 3600 1 IST}.. {-1396216800 0 0 IST}.. {-1379282400 3600 1 IST}.. {-1364767200 0 0 IST}.. {-1348437600 3600 1 IST}.. {-1333317600 0 0 IST}.. {-1315778400 3600 1 IST}.. {-1301263200 0 0 IST}.. {-1284328800 3600 1 IST}.. {-1269813600 0 0 IST}.. {-1253484000 3600 1 IST

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Gibraltar

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9509
Entropy (8bit):	3.8837074152297704
Encrypted:	false
SSDEEP:	96:QTOKVA1oCobz0W4x2+ZE74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNA:QyoCvTZ641sFpM5vwA6Efv03TBZLl
MD5:	D04F8EDDA1C3611692FB91E317CCADFE
SHA1:	1C483FC95459EC6F1D5FE4DD275879A9EBCA1718
SHA-256:	0524A31131405347C1D5D86C5EE38A2064AB055C030AB3B43F25DB3B28FFD8D2
SHA-512:	4E2E18EBDE2765F2251B1FE41EF8E6AC79875617348974A28619F5E59EC0467239C682CCE8DEBD7A698BE2F00252C77D1F7FA50B6CAFF920B3BE53A0B836F815
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Gibraltar) {.. {-9223372036854775808 -1284 0 LMT}.. {-2821649916 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Guernsey

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.879252060643389
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQakQAL/yQavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yYU
MD5:	07AF23DA01CB963EA9E57534E34E7704
SHA1:	1C4A214FF3B722E80C0ECACA0FFD5DFF302F6AE9
SHA-256:	F7046808A8E80B7AE449D1A49AE3E480096736B7D3F554A240C7DFB10F82076A
SHA-512:	713860D340C0EBA5EEF873ECB9B28CCDE9BFAD31B6A8626EF507E96585F5CC1091BF8D8A2DB7E5CB532E44F4561FBAE1797141724EF934755B69919FEA09A78A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Guernsey) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Helsinki

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7368
Entropy (8bit):	3.7258352536809705
Encrypted:	false
SSDEEP:	96:OsR0uO7DVopaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hzj:OkyDjivBeRF+W35Syrwl9h5j
MD5:	7FF902B06FA79F14553670A70E77FF8C
SHA1:	0105051541F38956EA6192BD0C7ED4047668005E
SHA-256:	5B5C0A9261A414EA8DC34F594EE05BEE16F695488B230857D2B569A6B603BC39
SHA-512:	551940199783A0FF9D73695B77B10300644F50E91D6B02FE79BB0CD4B78C7BA88CCE56F4B9408EC146361BF408F52D01A1F435183360C801EA5E219FB718247F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Helsinki) {.. {-9223372036854775808 5989 0 LMT}.. {-2890258789 5989 0 HMT}.. {-1535938789 7200 0 EET}.. {-875671200 10800 1 EEST}.. {-859773600 7200 0 EET}.. {354672000 10800 1 EEST}.. {370396800 7200 0 EET}.. {386121600 10800 1 EEST}.. {401846400 7200 0 EET}.. {410220000 7200 0 EET}.. {417574800 10800 1 EEST}.. {433299600 7200 0 EET}.. {449024400 10800 1 EEST}.. {465354000 7200 0 EET}.. {481078800 10800 1 EEST}.. {496803600 7200 0 EET}.. {512528400 10800 1 EEST}.. {528253200 7200 0 EET}.. {543978000 10800 1 EEST}.. {559702800 7200 0 EET}.. {575427600 10800 1 EEST}.. {591152400 7200 0 EET}.. {606877200 10800 1 EEST}.. {622602000 7200 0 EET}.. {638326800 10800 1 EEST}.. {654656400 7200 0 EET}.. {670381200 10800 1 EEST}.. {686106000 7200 0 EET}.. {701830800 10800 1 EEST}.. {717555600 7200 0 EET}.. {733280400 10800 1 EEST}.. {749

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Isle_of_Man

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.914274131294981
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQaqpfioxp8QavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/ycS
MD5:	F9A0F19FAF3131D8A70C50FF21B365B7
SHA1:	7FC2B5302FAD06BC4C633CD22A80A7D40073FFF8
SHA-256:	2F1151B0528A5325443379D4E7CCE32C00213722AD9DF764E1DC90198084B076
SHA-512:	6D04DF4480FE132A6641C4BF7E01936E2E4A71A3A6C2AB9F7DA7A9D8A4B836BC66EE2BB597B8C318D07A06F72C05B07E6785B53308ED9BC1103AE6DBDD0FF24E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Istanbul

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	3.814835316757376
Encrypted:	false
SSDEEP:	48:Qi0p05zvSPBUUl0ZFzo4ay0CREDcxn6nH78BV0QbCgkCPviiM0H7hdli80+j7x9L:Qiq66OFEIFMssCfMsXV3heM2MRlA0
MD5:	A8256656B971F58CB991BC270BF93B26
SHA1:	189796E1B8E29A7A7B8B0E143DD9B44BAF217AB2
SHA-256:	08061A80FC0F1EF375EEFE784EACDF0812E289FD67E8613BDEC36209985CA1D7
SHA-512:	1F11308B5BAC1F3DB75CAC7322BBEA6E51C6B4A2A3450F1DB84DE6AA127F0F1BAA7DAB409FAF1288C100BDA77DA6FA1C6E3C0BA962F9406D1445D7C9E2AA3A60
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Istanbul) {.. {-9223372036854775808 6952 0 LMT}.. {-2840147752 7016 0 IMT}.. {-1869875816 7200 0 EET}.. {-1693706400 10800 1 EEST}.. {-1680490800 7200 0 EET}.. {-1570413600 10800 1 EEST}.. {-1552186800 7200 0 EET}.. {-1538359200 10800 1 EEST}.. {-1522551600 7200 0 EET}.. {-1507514400 10800 1 EEST}.. {-1490583600 7200 0 EET}.. {-1440208800 10800 1 EEST}.. {-1428030000 7200 0 EET}.. {-1409709600 10800 1 EEST}.. {-1396494000 7200 0 EET}.. {-931053600 10800 1 EEST}.. {-922676400 7200 0 EET}.. {-917834400 10800 1 EEST}.. {-892436400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-764737200 7200 0 EET}.. {-744343200 10800 1 EEST}.. {-733806000 7200 0 EET}.. {-716436000 10800 1 EEST}.. {-701924400 7200 0 EET}.. {-684986400 10800 1 EEST}.. {-670474800 7200 0 EET}.. {-654141600 10800 1 EEST}.. {-639025200 7200 0 EET}.. {-622087200 10800 1 EEST}.

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Jersey

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.8801202136140915
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/yQap6cEBx/yQavKLS:SlSWB9vsM3ymvKA2PHAIgovKAH6N/yzx
MD5:	FE10770868A75F4F8D76C5E23D99AA81
SHA1:	30AC768BA47AF7A53831F5142B58ECEC41933621
SHA-256:	97EB33915ED7C9C34144F8F42357FAB2262B3CD45287F3CFFD26C33D65F7651E
SHA-512:	1D82DF45AB0CCDFBFAD0431C668794996E01776800F34DD4131C5287D37291657A749D497AA5B0AB81CAFF3190896633FBFF456BFFEB7E93A3420AA841E54842
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:Europe/Jersey) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Kaliningrad

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	3.941165221943348
Encrypted:	false
SSDEEP:	48:coNlj+X2uxhuHJkw0QqXknzaVV04v3TfdGY3kNmneVuNlh000sGpdh:coN9+1EpkwCXkSV3A8qc0
MD5:	104CCB93300F40BAF8F4D7CC882EFC05
SHA1:	EA83F3C3791BD6F083844939DC405B248E738FE3
SHA-256:	2387D26DF5429DF9867F42F7D4F872DC146643B4B3CC57DA7298C18561DE8BFE
SHA-512:	12724C5BBEE0835626A98B66BF55C3DF1311F07018C70D76FC5C50E7E7BA5C4A9F064D9EDC376CC3B06C4FFFECA3FAF5B66948615A03DFECA7C361E326D950EA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kaliningrad) {.. {-9223372036854775808 4920 0 LMT}.. {-2422056120 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780368400 7200 0 EET}.. {-778730400 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-749095200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Kiev

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7453
Entropy (8bit):	3.762620506765216
Encrypted:	false
SSDEEP:	96:j3C1LyEpkvIpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:j3C9VWdivBeRF+W35Syrwl9h5j
MD5:	1F0C92A6E5C6BAD82AD7E35814ACC388
SHA1:	F29C94DF4EE211481051186BBE5CD77EEDC6C33F
SHA-256:	08B137B7B933393F8F4574615A370013288E5297937B5C59D4179744273FAB26
SHA-512:	88E8B89439022D219D752340E28C21E461D8E288DA135DA4765C87037B610515E6D9E1B716707025B5BAE652FA2F2A89577949C8A923E5C8667AA6CB5C1BAD7A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kiev) {.. {-9223372036854775808 7324 0 LMT}.. {-2840148124 7324 0 KMT}.. {-1441159324 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-892522800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-825382800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {638319600 14400 1 MSD}.. {646786800 10800 1 EEST}.. {686102400 7200 0 EET}.. {701820000 10800 1 EEST}.. {7175

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Kirov

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2029
Entropy (8bit):	3.668326642402654
Encrypted:	false
SSDEEP:	48:FFvCAs6kKR6aQmF1cSNWrI+AjXgV/Ap40FjDM:FhCAs6kC6aZF1cSN4I+AjXgV/ApDFjDM
MD5:	57BB199152815B12FE4491C92FE25186
SHA1:	7BC5ECDE9EFADE812AF40CB92CCE5323FB57C78D
SHA-256:	60884D4B8B17A9AB8FB5697DA95F62E570755348109C661D783D56CD047BBE9E
SHA-512:	2043FDBA860E8F6578F7E26A80C7787B82C7D15188327923EC36D153FDF9BEEAE063012ACE4309B76DB9DBA2DFFB7404DE370BA85023CCE93159FCAD3B9B92B5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Kirov) {.. {-9223372036854775808 11928 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {78044

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Lisbon

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9878
Entropy (8bit):	3.8275310275285723
Encrypted:	false
SSDEEP:	192:j76abXsyZLEjx82YbtIaFF1w0us4qE3+sSGjT:j77bXsyZLEjx82atysLE3+sSGjT
MD5:	0DA331C2A815739E6758797BD24554EA
SHA1:	3829C441E908BEFDC4ED6AB65FD4ACD0C97D5E1B
SHA-256:	9FAC9812411F88014779D34722F3E0D2750E45BF21595DF1AE14CB9CCFD3F33F
SHA-512:	FEBBA05F64AC1F3066AF6351493DD89768154FD171D447503DAEDB90D16858BEDBCE4A74E24AC0C37B5FF191692AF44AADDE4A92E752F88C48DA646352AD9A0B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Lisbon) {.. {-9223372036854775808 -2205 0 LMT}.. {-2713908195 -2205 0 LMT}.. {-1830384000 0 0 WET}.. {-1689555600 3600 1 WEST}.. {-1677801600 0 0 WET}.. {-1667437200 3600 1 WEST}.. {-1647738000 0 0 WET}.. {-1635814800 3600 1 WEST}.. {-1616202000 0 0 WET}.. {-1604365200 3600 1 WEST}.. {-1584666000 0 0 WET}.. {-1572742800 3600 1 WEST}.. {-1553043600 0 0 WET}.. {-1541206800 3600 1 WEST}.. {-1521507600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1426813200 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1221440400 3600 1 WEST}.. {-1206925200 0 0 WET}.. {-1191200400 3600 1 WEST}.. {-1175475600 0 0 WET}.. {-1127696400 3600 1 WEST}.. {-1111971600 0 0 WET}.. {-1096851

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Ljubljana

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.948438246006353
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQavPSJ5Qahs0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNl
MD5:	56C6C95484FEAF9BAF755683E7417B58
SHA1:	A43176BEBC5B4D7144A7E1109E0AAEFD95C21EC6
SHA-256:	713A842197516D618F2D86977262542A1CA334D7DF6026539FA2F2980DBF4CD3
SHA-512:	566B6DF2D76A8A4D3405C4785C7A471A23D65CD8838831BD0DEDF5BF194E8A3B304CA9920CB4A8EC9D6CD60EAA9BE0335E38D9547A4D23C7E4E5E5A39A09DDAC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\London

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10211
Entropy (8bit):	3.826887992237191
Encrypted:	false
SSDEEP:	192:GNoCvTZtcf80KYiK3BG0Myj9TYQOeMAwbccM0Fp:GNNTZtcf15iOBG08eNwbccM0Fp
MD5:	0625C99E16D3C956DED1C0C0F867DEC3
SHA1:	6ACDF0DB619B63E21EC89046B9320A85FBD3397A
SHA-256:	D04C4E25DF4DE1C1CFE1EF84B3B6DD746CF08A271AB0958F22C7D580A3ED10E6
SHA-512:	07AC42F0635DF01CC0AFD13F9668B143D4943BA0E4C377D254B5AF034D9DDBAB77BA813187E9AB73D2EEAD86EBAA26DC15599FD74FC82EEF287F5A6AB9C01635
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/London) {.. {-9223372036854775808 -75 0 LMT}.. {-3852662325 0 0 GMT}.. {-1691964000 3600 1 BST}.. {-1680472800 0 0 GMT}.. {-1664143200 3600 1 BST}.. {-1650146400 0 0 GMT}.. {-1633903200 3600 1 BST}.. {-1617487200 0 0 GMT}.. {-1601848800 3600 1 BST}.. {-1586037600 0 0 GMT}.. {-1570399200 3600 1 BST}.. {-1552168800 0 0 GMT}.. {-1538344800 3600 1 BST}.. {-1522533600 0 0 GMT}.. {-1507500000 3600 1 BST}.. {-1490565600 0 0 GMT}.. {-1473631200 3600 1 BST}.. {-1460930400 0 0 GMT}.. {-1442786400 3600 1 BST}.. {-1428876000 0 0 GMT}.. {-1410732000 3600 1 BST}.. {-1396216800 0 0 GMT}.. {-1379282400 3600 1 BST}.. {-1364767200 0 0 GMT}.. {-1348437600 3600 1 BST}.. {-1333317600 0 0 GMT}.. {-1315778400 3600 1 BST}.. {-1301263200 0 0 GMT}.. {-1284328800 3600 1 BST}.. {-1269813600 0 0 GMT}.. {-1253484000 3600 1 BST}.. {-1238364000 0 0 GMT}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Luxembourg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9139
Entropy (8bit):	3.8497931755359303
Encrypted:	false
SSDEEP:	96:TkR06ZldaKsc1+FpbdKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiT1:wxRscASs41sFpM5vwA6Efv03TBZLl
MD5:	789594ED1BB0EDA605DFB567C1E7FE9E
SHA1:	66C7116CCBED0917A429BB277CF4E0B3361A5B41
SHA-256:	380E49D38F6ABE946A90A9343A277ED28492EB800747D6D14F4639FD3EA80EDE
SHA-512:	62CC68E72E79B7A377EAFE92B64D829CD5B9651FCA6782DEF4886C91BB9DF5FCFCD0CF8C5C7628F49E8C523A4AF917DA2745ABA56107683CA014C3E0254E780E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Luxembourg) {.. {-9223372036854775808 1476 0 LMT}.. {-2069713476 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1662343200 7200 1 CEST}.. {-1650157200 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1612659600 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585519200 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552258800 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520550000 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490572800 0 0 WET}.. {-1473642000 3600 1 WEST}.. {-1459119600 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1411866000 3600 1 WEST}.. {-1396224000 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269813600 0 0 WET}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Madrid

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8517
Entropy (8bit):	3.8326167134909177
Encrypted:	false
SSDEEP:	96:k5m01LdXKc0TJp+bwS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOn:+DaNVLSs41sFpM5vwA6Efv03TBZLl
MD5:	63263380F57B756A1DFA3796E4188CD3
SHA1:	8EEE707AC4FEA1C098C81AC2D289A46239121A5E
SHA-256:	5337C9843C56DEEC6B91C4468C76EC1C896E80421B72B583B69DE5579063E09A
SHA-512:	ACA4830020715C471741E27EB2292ACF002D2CD7EDCD1061978B64967EB447F61AA095F960D8A75A01B9B87558D83FF409F30BDACA83E063024F1E2381FA64C4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Madrid) {.. {-9223372036854775808 -884 0 LMT}.. {-2177452800 0 0 WET}.. {-1631926800 3600 1 WEST}.. {-1616889600 0 0 WET}.. {-1601168400 3600 1 WEST}.. {-1585353600 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269820800 0 0 WET}.. {-1026954000 3600 1 WEST}.. {-1017619200 0 0 WET}.. {-1001898000 3600 1 WEST}.. {-999482400 7200 1 WEMT}.. {-986090400 3600 1 WEST}.. {-954115200 0 0 WET}.. {-940208400 3600 0 CET}.. {-873079200 7200 1 CEST}.. {-862621200 3600 0 CET}.. {-842839200 7200 1 CEST}.. {-828320400 3600 0 CET}.. {-811389600 7200 1 CEST}.. {-796870800 3600 0 CET}.. {-779940000 7200 1 CEST}.. {-765421200 3600 0 CET}.. {-74849

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Malta

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8724
Entropy (8bit):	3.816380386871747
Encrypted:	false
SSDEEP:	96:KAGvi2GmkwwnpH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZN:KLsww141sFpM5vwA6Efv03TBZLl
MD5:	9B09D6EED8F23BAFFB62929C0115E852
SHA1:	4AEF15333C73C2836C09D818FD0E20440D7C4780
SHA-256:	C5C240BAAECE8235D1FBDD251C1A67CB2D2FC8195DD5BBE37FF9CFF0445FCDA2
SHA-512:	43AA3492BD335A290C6EFEE275B47EA18E544199E37A9BBAE2E350D42BDFF42F0E9ED461A4BB1824CA33F84A90D4060906844A3E22DA49C9821E4CB460832D6E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Malta) {.. {-9223372036854775808 3484 0 LMT}.. {-2403478684 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812588400 7200 1 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 3600 0 CET}.. {-81997200 7200 1 CEST}.. {-71715600 3600 0 CET}.. {-50547600 7200 1

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Mariehamn

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.959733196757503
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV1AYKjG5XHAIgoq2AYKjo0ARL/yQausWILMFJ8QaC:SlSWB9vsM3ymrAdjGJHAIgorAdjo0ANn
MD5:	C1844961691214F6E6DF6487788A7758
SHA1:	6D08E9FB7B8602A80622148BFACD9676F45F0E2B
SHA-256:	6136C3CFA4A767E7C9DDA23A283AD98B72E9868F192E6A8E3BFE6396F6989BD1
SHA-512:	B2D1EA51AC5B34792AC02820A9D60FD41F3B91AB6505896476FCB0DC339B8DC1DE9E2C89A7627F69E16247661AE8040D789FFD2F8F1CD59F243B57C4845B450F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Helsinki)]} {.. LoadTimeZoneFile Europe/Helsinki..}..set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Minsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2177
Entropy (8bit):	3.9354590900153172
Encrypted:	false
SSDEEP:	48:K8cVnR7xhuHJkminzaVV04v3TfdGY3kNmneVuNlh000sGpde:5mnRtEpkmiSV3A8qcN
MD5:	9C10EAE9FA0DE192C5FD4F76E12606F0
SHA1:	AFD5650410EC3E6ED564A8B2ABF91709D090B4AD
SHA-256:	8C95EA696EA578DEF726502AC181AF475A676030878F56B4E2D667757BBD1C49
SHA-512:	3B9ED6B68858485B9A46A0863B7D9D3C1E4C5BBA269457F24A9A12C274F0F9B35E63D8C25EB53E7200DB57DD35ACCB7FD7D8AB005FEE2C4D7FC6E72E8CF57194
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Minsk) {.. {-9223372036854775808 6616 0 LMT}.. {-2840147416 6600 0 MMT}.. {-1441158600 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-899780400 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-804646800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {670374000 7200 0 EEMMTT}.. {670377600 10800 1 EEST}.. {

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Monaco

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9186
Entropy (8bit):	3.856050322706834
Encrypted:	false
SSDEEP:	96:2d4STO1C+4qoM9JfKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcot:wvp+hSs41sFpM5vwA6Efv03TBZLl
MD5:	859DF194457CED25EA3EC247CDEA5025
SHA1:	970579F53446EBE50438CC3582D88094C7D7DEEB
SHA-256:	654B92E8B9E8FBDC967D094B48110908F458454D7057F680AC745B9C8D48FCC1
SHA-512:	3E589FC8CA5E0B0F7F6F17A6983813460AB7E07B9B631D8380836F00A8288FF80650D4139B2A6DEDFF245DE571C7726E087DFF3E6F5F9E7E9C9DFE72B839DC7A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Monaco) {.. {-9223372036854775808 1772 0 LMT}.. {-2448318572 561 0 PMT}.. {-1854403761 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Moscow

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2430
Entropy (8bit):	3.942836780611272
Encrypted:	false
SSDEEP:	48:7fnjazk7e+LxhuHJkvVineTeCTU50x0Y7:7fnjazk7eoEpkvVieTeCTUax0Y7
MD5:	4547D47E9364ACAFB2A4BEE52D04BFBB
SHA1:	1E7F964692F81D49AEAF581FE70AD22D4E36226B
SHA-256:	31F9C3C2F17B3EE4FA6D9EE6A86BF407AC0377DE4D666C65E86CE5AC591F829F
SHA-512:	7F1D7C80A1BF611D5440EEF9085DA6CDED86B5EF4C2737C105640030E5AA998A0951182E72DC224190A25DA8846CDE856A78EBAA8876AA0B18B1CBCADBB060FF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Moscow) {.. {-9223372036854775808 9017 0 LMT}.. {-2840149817 9017 0 MMT}.. {-1688265017 9079 0 MMT}.. {-1656819079 12679 1 MST}.. {-1641353479 9079 0 MMT}.. {-1627965079 16279 1 MDST}.. {-1618716679 12679 1 MST}.. {-1596429079 16279 1 MDST}.. {-1593820800 14400 0 MSD}.. {-1589860800 10800 0 MSK}.. {-1542427200 14400 1 MSD}.. {-1539493200 18000 1 +05}.. {-1525323600 14400 1 MSD}.. {-1491188400 7200 0 EET}.. {-1247536800 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Nicosia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.7873368289068905
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq85GKLlXHAIgNwMGKLZRRL/yQatHefeWFKYGKL8n:SlSWB9vsM3yZdL1HAIgGMdLZRN/y3HeA
MD5:	BE82205480617CF07F76BA0DF06C95BC
SHA1:	46D2D8D9FE4FB570C2A09BC809B02C8960F9601F
SHA-256:	FC93B7516933EDFDC211AC0822EE88BF7ACAD1C58A0643B15294F82EB0F14414
SHA-512:	F490A70053A6011D80FB0A4E96D2871BFEEB168690E21C4EC31F2F5C0E24A67C706528C81322A1D48E71242F0FFA277550192925FDE5B1F34BFCB308290E11FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Nicosia)]} {.. LoadTimeZoneFile Asia/Nicosia..}..set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Oslo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7922
Entropy (8bit):	3.818430983275607
Encrypted:	false
SSDEEP:	96:MC+4twRQqvSO774elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:MXRQqvSOv41sFpM5vwA6Efv03TBZLl
MD5:	9923D3F3C50D2BD96BD36558FBCD8E92
SHA1:	56584B8B9CB27B0ADCAD490C029EE58308C4D7C5
SHA-256:	5A28B5CEC79B57D4856E3F05615245E6F74DF6388B48BF3F605B792CA3BD972D
SHA-512:	1FA928EA5F468F2B4AA40B6B73CE6E42267832413B333C399431FE08C6CB4FD4BDD7E3DB15682C76E5EDEB5849224F1EE5B9667E68A8C5C89AF09B075E4F7755
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Oslo) {.. {-9223372036854775808 2580 0 LMT}.. {-2366757780 3600 0 CET}.. {-1691884800 7200 1 CEST}.. {-1680573600 3600 0 CET}.. {-927511200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-340844400 7200 1 CEST}.. {-324514800 3600 0 CET}.. {-308790000 7200 1 CEST}.. {-293065200 3600 0 CET}.. {-277340400 7200 1 CEST}.. {-261615600 3600 0 CET}.. {-245890800 7200 1 CEST}.. {-230166000 3600 0 CET}.. {-214441200 7200 1 CEST}.. {-198716400 3600 0 CET}.. {-182991600 7200 1 CEST}.. {-166662000 3600 0 CET}.. {-147913200 7200 1 CEST}.. {-135212400 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Paris

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9152
Entropy (8bit):	3.8506895725632746
Encrypted:	false
SSDEEP:	96:fySTO1C+4qoMYOKDBb0S274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdi:fdp+3Ss41sFpM5vwA6Efv03TBZLl
MD5:	9CAF8C5C5AF630E7F782C0480DD786E7
SHA1:	9FBEF9EEDD8BAFB48B17E3AC388CFEF8DCD10CB0
SHA-256:	AE61491C4A587F56426A9F2118E31060276F2B0231E750C461781577551CA196
SHA-512:	F809744BB597184A2815758A27B6A07C515C65DB96CFFB3625FD059DEBBF05EE903E999483B3459C7C8D3991824746F8530CD1378F8A63B1F54F60CFACE9F89B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Paris) {.. {-9223372036854775808 561 0 LMT}.. {-2486592561 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1520557200 0 0 WET}.. {-1507510800 3600 1 WEST}.. {-1490576400 0 0 WET}.. {-1470618000 3600 1 WEST}.. {-1459126800 0 0 WET}.. {-1444006800 3600 1 WEST}.. {-1427677200 0 0 WET}.. {-1411952400 3600 1 WEST}.. {-1396227600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364778000 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333328400 0 0 WET}.. {-1316394000 3600 1 WEST}.. {-1301274000 0 0 WET}.. {-1284339600 3600 1 WEST}.. {-1269824400 0 0 WET}.. {-1253494800 3

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Podgorica

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.910162937111088
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQazKIGl1/yQ0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNK
MD5:	52C36955D6BD1D9FE9CB64822D04B6DB
SHA1:	D5FF82EC486409E6FB314AD5ACE608577C9632CF
SHA-256:	B87630FF459DE07EB16CD0C2452660772E3FFC4EEB8419EA77A013B6F63A5900
SHA-512:	ABA49D3F05A41A4982600E4DA5C225D8994251F447401EE6FE8478E008BCD5D41C057034185B5CFF805634D571F3CC98EFE98093ABC8E6271351E11A4DA1E7AD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Prague

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8038
Entropy (8bit):	3.8240363895915914
Encrypted:	false
SSDEEP:	96:Kr9+neXAS274elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlh:KnASs41sFpM5vwA6Efv03TBZLl
MD5:	828134FA1263FEFA2B06A8B2F075F564
SHA1:	4B332DE6E0855F8B9517F7098A3FB439671FC349
SHA-256:	5D3AFED5C1B07C6C6635D6BDEB28A0FB4D11A61F25F26C91227B2254BE5F4AA0
SHA-512:	9AB1462CDBD7F13F0CECDCCC2D91A85D8C0576B71508F935D26638C25ED023CF8FF4BA4FFDA402B308E6142B135D1B9D88700A519DBE2381E8E945329A5354F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Prague) {.. {-9223372036854775808 3464 0 LMT}.. {-3786829064 3464 0 PMT}.. {-2469401864 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-777862800 7200 0 CEST}.. {-765327600 3600 0 CET}.. {-746578800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-728517600 0 1 GMT}.. {-721260000 0 0 CET}.. {-716425200 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654217200 7200 1 CEST}.. {-639010800 3600 0 CET}.. {283993200 3600 0 CET}.. {291776400 7200 1 CEST}.. {307501200 3600 0 CET}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Riga

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7658
Entropy (8bit):	3.7750218768791806
Encrypted:	false
SSDEEP:	96:eq+cEpkjXkSV385aNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:ePWjUS7ivBeRF+W35Syrwl9h5j
MD5:	0D3C919F60081388524BD5DB22E6904B
SHA1:	6691EAB901C8B57D2F2693120A45A67799D05FCB
SHA-256:	8B64A42BAFD90F9255CACFDBAC603D638DD7C18DC27249F9C9B515E1DA634424
SHA-512:	62A2820B8C1C5468AC1F1BB626F9AAAD0BA1DEC5B73740F00FE4DB8CFA3F2BCF9947968E693824FC8770BA20AB962F93F7E5E345AE8A85F99CDB18E2B510308E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Riga) {.. {-9223372036854775808 5794 0 LMT}.. {-2840146594 5794 0 RMT}.. {-1632008194 9394 1 LST}.. {-1618702594 5794 0 RMT}.. {-1601681794 9394 1 LST}.. {-1597275394 5794 0 RMT}.. {-1377308194 7200 0 EET}.. {-928029600 10800 0 MSK}.. {-899521200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-795834000 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {6

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Rome

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8813
Entropy (8bit):	3.8168470239811736
Encrypted:	false
SSDEEP:	96:hhGvC2GmkNXEq74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhn:hUsF41sFpM5vwA6Efv03TBZLl
MD5:	C4F49446D3696301EDB339691DCB2FDB
SHA1:	537963A77B9BE9BE6B997A812A6E6DD120F6F247
SHA-256:	DCD2D9144507311E573568598E1FFD0E0574FB677AA0DAFC5641D80A19EB6E58
SHA-512:	1F0A9A549FA0995C51E90AC392671E3F09744B268F1EE6A27CA7E3C41C2B02A4BA0F98369BE40BA482FBA1FED8F1EE712F0B3217AD86164D1AD498E369C24D76
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Rome) {.. {-9223372036854775808 2996 0 LMT}.. {-3252098996 2996 0 RMT}.. {-2403565200 3600 0 CET}.. {-1690765200 7200 1 CEST}.. {-1680487200 3600 0 CET}.. {-1664758800 7200 1 CEST}.. {-1648951200 3600 0 CET}.. {-1635123600 7200 1 CEST}.. {-1616896800 3600 0 CET}.. {-1604278800 7200 1 CEST}.. {-1585533600 3600 0 CET}.. {-1571014800 7200 1 CEST}.. {-1555293600 3600 0 CET}.. {-932432400 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-830307600 7200 0 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-807152400 7200 0 CEST}.. {-798073200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766717200 3600 0 CET}.. {-750898800 7200 1 CEST}.. {-733359600 3600 0 CET}.. {-719456400 7200 1 CEST}.. {-701917200 3600 0 CET}.. {-689209200 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-114051600 7200 1 CEST}.. {-103168800 36

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Samara

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2118
Entropy (8bit):	3.664269700453612
Encrypted:	false
SSDEEP:	48:7PvCAs6kKR6aQmF1cSNWrI+AjQnTRYZ/YF0LUdt/LkajuZbIJltiabs2Tb:7HCAs6kC6aZF1cSN4I+AjQTRYZ/YF0Lw
MD5:	965D987F6576F66A08871697144D4CDB
SHA1:	AF7226DF81C2B3C3A5832F59FC708A6BCBF389CA
SHA-256:	8F395352AA05D35E7D13380E73659A0D5B56FFC17E3F4E40E4F678A902F0E49B
SHA-512:	B82E0CFA5EDA0FCDF03609AE439255F8937A7E9EFA0AFE15EA8877316782AFC74514BCD2B4F06F1B5F0F3C5A64A933D73CB50D5AED2BB1491BD6CACBB77B10E8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Samara) {.. {-9223372036854775808 12020 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-1102305600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 10800 0 +03}.. {687916800 14400 0 +04}.. {701820000 18000 1 +05}.. {717544800 14400 0 +04}.. {733

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\San_Marino

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.955758257767983
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQawELDX7x/yQaxE:SlSWB9vsM3ymx5PHAIgoxvN/yt/yrE
MD5:	D253DA6880630A31D39DB0CFA4933ABD
SHA1:	E5798DAAE574729685FE489F296B964BC1CCF2E4
SHA-256:	B6856A0E38C2404F7D5FA1821559503F8AE70923A562F0D993124D131515F395
SHA-512:	CFB6005F3E8D1C585AF36EB7A8C9F49760EF6F446C97E7804EB61EFD0804424C4FB6AE81B71C5A867274EF89A17DAC0D2A0FF882A0F6AEA1D5FFD51593726C5F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/San_Marino) $TZData(:Europe/Rome)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Sarajevo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.937834327554967
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawEX3GEaQa5:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNZ
MD5:	F7C7DAE9C5D371EF9EE1F490246ED3CC
SHA1:	40C388FE2A55078C8E0524A4385B3F8846960E24
SHA-256:	BC00D953C2F3E55E40EDA13838AB66B9E9D0BDAD620E4EB917637761ABB06FB1
SHA-512:	EB22C59F4D58D96797A718FC59B010795F587626E456D44A3E6398E0FBF4ECD97BCDC151BC1359151798B5AF2964FE5708233F8ECD0D344C3E27629F2645687F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Saratov

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2061
Entropy (8bit):	3.6638125261109824
Encrypted:	false
SSDEEP:	48:yFvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDQ:yhCAs6kC6aZF1cSNcjXgV/ApDFjDQ
MD5:	CC4D7C478790588D232568CAB12D8E67
SHA1:	07A7CFCFFFF91D124EDFC99F5053BAFC79FBB12B
SHA-256:	AB90363DEE5077C39EC55FE8E519593FF08223E5A8E593F6CCE01FB5B8B35BAE
SHA-512:	23944D20624C942CFDE58F1019160D64401BD0AFB8C3EC49F904038482FAA6741812548C860A2DAE050B8D17A7E08ED9C6EBE7FF19393CFA46D78B1D21B1CACA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Saratov) {.. {-9223372036854775808 11058 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {764722800 14400 1 +04}.. {780

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Simferopol

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	3.9502615086649637
Encrypted:	false
SSDEEP:	48:wM2wE0xhuHJkN+2kCnbdSisa0ewEKGfUslIYtq8X:UwEAEpkuCgaNl7
MD5:	1953A171614196D2FD2CA12FFE6F70D4
SHA1:	20958D5888F94C1FF2C90DDB97915435095AA67C
SHA-256:	4186A873A6218FF746957A0AAED1D61FC28FF5ED6D44BF38F36B5120A21C06C6
SHA-512:	35A628EBB2C2068A7DE07175494E195D75ADE30CB4B8BFE7EE7EA0A3B30F68BF6E0F21590A0A2DA0E02B944473545A5887BF95692A9C9E9DCD08CB8D542D142B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Simferopol) {.. {-9223372036854775808 8184 0 LMT}.. {-2840148984 8160 0 SMT}.. {-1441160160 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-888894000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-811645200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 7200 0 EET}.. {694216800 7200 0 EET}.. {

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Skopje

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.953089768975736
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQawOgpr8Qahr:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNO
MD5:	0BF8ADBB63F5D6187C75FF1B0BAC761E
SHA1:	7DE15E767D34812F784CE6E85438A592E2CBA418
SHA-256:	52F20858433261B15797B64F0A09CEE95D552EF93B5DAA7C141BFAB6D718C345
SHA-512:	27D395635427C8FA1A4E0063A32F482701D2CC7C7724B4A06E661D4A419D23E219672888D37367FE5E70B6872914EB9EE034AE359DCB6A4C4CE05CA34C3589A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Sofia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7654
Entropy (8bit):	3.727428614069594
Encrypted:	false
SSDEEP:	96:8lmG4+K7Gjz5CXNUatpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYf:8lmGWwkdUasivBeRF+W35Syrwl9h5j
MD5:	91357DFC23ADB0CE80C463E4B6D896BE
SHA1:	273F51BE4C67A9AC1182F86AC060E963684151D5
SHA-256:	6415F279CB143EA598CF8272263AC5B502827B10CEEB242B39E6EFCC23A2EE12
SHA-512:	8EA7E2D4C2239879A4D6CCE302C38A6D2A9093A2CADEF4F4294E60D373AB9A2C468BA6E3D54DEC7F73D954CE5226EF2B022F8BDEF29B3B4AAB3838B05C72EA29
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Sofia) {.. {-9223372036854775808 5596 0 LMT}.. {-2840146396 7016 0 IMT}.. {-2369527016 7200 0 EET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-788922000 3600 0 CET}.. {-781048800 7200 0 EET}.. {291762000 10800 0 EEST}.. {307576800 7200 0 EET}.. {323816400 10800 1 EEST}.. {339026400 7200 0 EET}.. {355266000 10800 1 EEST}.. {370393200 7200 0 EET}.. {386715600 10800 1 EEST}.. {401846400 7200 0 EET}.. {417571200 10800 1 EEST}.. {433296000 7200 0 EET}.. {449020800 10800 1 EEST}.. {465350400 7200 0 EET}.. {481075200 10800 1 EEST}.. {496800000 7200 0 EET}.. {512524800 10800 1 EEST}.. {528249600 7200 0 EET}.. {543974400 10800 1 EEST}.. {559699200 7200 0 EET}.. {575424000 10800 1 EEST}.. {591148800 7200 0 EET}.. {606873600 10800 1 EEST}.. {62259

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Stockholm

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7308
Entropy (8bit):	3.817544865319589
Encrypted:	false
SSDEEP:	96:Skhe74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:Sky41sFpM5vwA6Efv03TBZLl
MD5:	A17318A055D4BB049FB4621CDC2AFED3
SHA1:	61BA62F253BD4D8B34C2CFCDB96AB458D413E214
SHA-256:	12447CE016745FC14584CB5F753E918C23ECA5D028CA50042E0714CF3783608A
SHA-512:	90CF037C1DBF55C5D70164D2B2CBDC9580F7FE496279416F578E42A444AD6CEBFF29336921619AAFC4E872B886A9AC5EF45006D2B9585D17AA3864F773C89610
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Stockholm) {.. {-9223372036854775808 4332 0 LMT}.. {-2871681132 3614 0 SET}.. {-2208992414 3600 0 CET}.. {-1692496800 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {315529200 3600 0 CET}.. {323830800 7200 1 CEST}.. {338950800 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Tallinn

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7549
Entropy (8bit):	3.76585669030767
Encrypted:	false
SSDEEP:	96:dUusEpkjXkSV3AMaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:O0WjUSWivBeRF+W35Syrwl9h5j
MD5:	54EF0224F5E28FA78F212EC97D4AE561
SHA1:	FA7C9A951ED943F1E1E609D2253582016BC26B57
SHA-256:	6F3594CCDA78B02B2EE14C8FAE29E668E47193AF2DFCF5AF1ECD210F13BCE9CE
SHA-512:	2D1CA2BB1945AE5E3F56AF8FA7F950CE7169F215C783E683634581C5EC01B54159E47A0E9551897077BBEAB06158906029A4E4B0051A263D9E5D903EA9DA1692
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tallinn) {.. {-9223372036854775808 5940 0 LMT}.. {-2840146740 5940 0 TMT}.. {-1638322740 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1593824400 5940 0 TMT}.. {-1535938740 7200 0 EET}.. {-927943200 10800 0 MSK}.. {-892954800 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-797648400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 10800 1 EEST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Tirane

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7675
Entropy (8bit):	3.809498345470167
Encrypted:	false
SSDEEP:	96:n05NWKIHBJ9AE4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhlt:0iKqxAE41sFpM5vwA6Efv03TBZLl
MD5:	1983B88075A92942209BB2B80E565F4E
SHA1:	12A0401026C5C036144FD1D544173AAB39969F61
SHA-256:	C62686BF598138FEFB72E8CC6632BA75A5FE147F2A30124EE3583BE1F732E38D
SHA-512:	E95C38FA0A2B526C00B9DCF5CDF53059DECF64B085AA18BE000968DA626561944415D053CF7A5C32BC672085538920CFD67A3A3B627CFD5B1A4C9CEC49AA3F96
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Tirane) {.. {-9223372036854775808 4760 0 LMT}.. {-1767230360 3600 0 CET}.. {-932346000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-843519600 3600 0 CET}.. {136854000 7200 1 CEST}.. {149896800 3600 0 CET}.. {168130800 7200 1 CEST}.. {181432800 3600 0 CET}.. {199839600 7200 1 CEST}.. {213141600 3600 0 CET}.. {231894000 7200 1 CEST}.. {244591200 3600 0 CET}.. {263257200 7200 1 CEST}.. {276040800 3600 0 CET}.. {294706800 7200 1 CEST}.. {307490400 3600 0 CET}.. {326156400 7200 1 CEST}.. {339458400 3600 0 CET}.. {357087600 7200 1 CEST}.. {370389600 3600 0 CET}.. {389142000 7200 1 CEST}.. {402444000 3600 0 CET}.. {419468400 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {457480800 7200 0 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 C

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Tiraspol

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.906212162381389
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV+NM/LWXHAIgoq9NM/HARL/yQa3MPgJM1p8QagNMj:SlSWB9vsM3ymI6CHAIgoI6HAN/ytM4MO
MD5:	E0C99DB7673EEE440BA1848046455BA1
SHA1:	1BCCC1BE46306DEF8A9CA249DE8FA11FC57CC04D
SHA-256:	FDD53FDB5F754BBBA8FF98F0B1555FE0BAEB7852843220A7CF93A190B641A9AD
SHA-512:	CD56B540AE9084DEAA9D0A1DBBAF89733C465424C22CE74696B9AE90FD4FEFAB265CF23C5B13A7F04597D75FD0147BD593E0552B56D87372170CB4CA1BFC8259
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Chisinau)]} {.. LoadTimeZoneFile Europe/Chisinau..}..set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Ulyanovsk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	3.680951255407528
Encrypted:	false
SSDEEP:	48:kFvCAs6kKR6aQmF1cSNWrI+AjQndgV/Ap40FjDOP:khCAs6kC6aZF1cSN4I+AjQdgV/ApDFj4
MD5:	83C86E437B5FBA1DC9CC5235396AC381
SHA1:	5493A59C3A5A1B55ACD493E67F9E29D2A415A8DB
SHA-256:	9FA9D09509B4F8F5A9C8E422DBA02605070C3EBDAEB7C1DF8527C8EEF5E3632D
SHA-512:	86222489C65C87646939DECF91C2EC336EB46F64B644526A3FA8A4854B9D11819F6FD253107AB8A3DE911E254C88092D25137442164A6E437CDAF258A7CBB66C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Ulyanovsk) {.. {-9223372036854775808 11616 0 LMT}.. {-1593820800 10800 0 +03}.. {-1247540400 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 18000 1 +05}.. {591141600 14400 0 +04}.. {606866400 10800 0 +04}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 7200 0 +03}.. {670377600 10800 1 +03}.. {686102400 7200 0 +02}.. {695779200 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Uzhgorod

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7541
Entropy (8bit):	3.769633712898356
Encrypted:	false
SSDEEP:	96:dpSlo5Epkn/paNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:dpUWnmivBeRF+W35Syrwl9h5j
MD5:	4AD237C8A1D94E2CB70377C49867AC76
SHA1:	121303331223925BFB708918BAED3CD2F0E33C60
SHA-256:	747F543B7A875214F8EEBFDAE3182D91B1E93CEB57B58D2B7657672F949B13A9
SHA-512:	FD2FB930CB81BD3427AEF374ACAC2A120F6AD447625824AD6D08E68868A3B389FDDE7E2A82FCFF3490488601ADE646AC989AA7CEF1FE77A700E232D7561B6E74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Uzhgorod) {.. {-9223372036854775808 5352 0 LMT}.. {-2500939752 3600 0 CET}.. {-946774800 3600 0 CET}.. {-938905200 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796870800 7200 1 CEST}.. {-794714400 3600 0 CET}.. {-773456400 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {631141200 10800 0 MSK}.. {646786800 3600 0 CET}.. {67

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Vaduz

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.953146873643623
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVnCMPfXHAIgoqkCM4ARL/yQa1NEHp8Qa5CMS:SlSWB9vsM3ym5XPHAIgo5gAN/yvNEJ8G
MD5:	A0BAEC8B6AF1589ECBE52667DDB2A153
SHA1:	37093F4F885CBFA90A1F136D082E8B7546244ACC
SHA-256:	06B235BF047FC2303102BC3DC609A5754A6103321D28440B74EEC1C9E3D24642
SHA-512:	DBEC235AFB413FA8D116FA1AFFE73706762E7458038B6D68E0BFD71C339510D766825BA97055A06DEE14D5880EAE6CD035BFE0C935C0DF44B0107A356D293A78
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Zurich)]} {.. LoadTimeZoneFile Europe/Zurich..}..set TZData(:Europe/Vaduz) $TZData(:Europe/Zurich)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Vatican

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.914414313741477
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVvjF3vXHAIgoqspvVHRL/yQa1xLM1p8QaxE:SlSWB9vsM3ymx5PHAIgoxvN/yvN+8rE
MD5:	2404265F8DE1F7D7745893DD4752BA1C
SHA1:	C07E7F72DBDC7F5F746385523EA733C2714F5DA2
SHA-256:	C203E94465BD1D91018FC7670437226EF9A4BB41D59DDE49095363865CA33D00
SHA-512:	5C20834542B74041AAB1DBE35686781B32EEB5814B1A35A942E87D1FC3B6D8F9264CB90433C44A480EA86DDEA65D8C152F41CE3E983C1DE5FA74D6FB5208F701
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Rome)]} {.. LoadTimeZoneFile Europe/Rome..}..set TZData(:Europe/Vatican) $TZData(:Europe/Rome)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Vienna

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7930
Entropy (8bit):	3.8193566380830273
Encrypted:	false
SSDEEP:	96:8F6zq+gH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:8ozE41sFpM5vwA6Efv03TBZLl
MD5:	6A3A8055DD67174E853C7A208BABAC9B
SHA1:	64445543DE9D6C01FA858442976E249E37BE23EF
SHA-256:	A8165313C9B51DAEF130401439CBA60DAA9887FC5EAA61A5AFD4F7BAD1AD934F
SHA-512:	4407B9E8709A8DD05337A10030895AA9876EAF64EF5347952249EE2A541E304331B46D38532FD7CDFF9E633BF8C9884282F0A5ED259EBA1D99DC0914AF1A50C6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vienna) {.. {-9223372036854775808 3921 0 LMT}.. {-2422055121 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618700400 3600 0 CET}.. {-1577926800 3600 0 CET}.. {-1569711600 7200 1 CEST}.. {-1555801200 3600 0 CET}.. {-938905200 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796777200 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-780188400 3600 0 CET}.. {-757386000 3600 0 CET}.. {-748479600 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-717634800 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {323823600 7200 1 CEST}.. {338940000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CE

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Vilnius

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7485
Entropy (8bit):	3.7711709848169592
Encrypted:	false
SSDEEP:	96:FAhEpkwCXkSV3A/PplKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBK0:FfWHUSKivBeRF+W35Syrwl9h5j
MD5:	1AB5FCEACC4E09074BA9F72F0B7747D5
SHA1:	E0134E61EC0ADC60BF6DB4544EA7B7FFA4EC7857
SHA-256:	B762DB4A068DC79FA57691E070D7026086E5A6D2FC273D5C1872E7C8E3711533
SHA-512:	07565071D05CF972DD64F6060599EB68A00BF264172873BA310168AD07CE0CFCF90D0019B775433EC910DA748B89F0C614E7FD4E821993DA53C7E33F194C6A97
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Vilnius) {.. {-9223372036854775808 6076 0 LMT}.. {-2840146876 5040 0 WMT}.. {-1672536240 5736 0 KMT}.. {-1585100136 3600 0 CET}.. {-1561251600 7200 0 EET}.. {-1553565600 3600 0 CET}.. {-928198800 10800 0 MSK}.. {-900126000 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-802141200 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 7200 0 EEMMTT}.. {606873600 10800 1 EEST}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Volgograd

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2123
Entropy (8bit):	3.667144931158014
Encrypted:	false
SSDEEP:	48:menvCAs6kKR6aQmF1cSNWJjXgV/Ap40FjDqR:mevCAs6kC6aZF1cSNcjXgV/ApDFjDqR
MD5:	53E5BA5747B3255BB049F6FF651CEE25
SHA1:	A69E2BFDB89AC8756E1CD2EAA9109ACD924A0850
SHA-256:	22968D40DAC2B669E6D2BC43ED6B16C8A9CA3E1F9DACBF8B246299C3C24CC397
SHA-512:	3269D20DF9C9DDFF8252F33ED563B118771FC71049542DA7C6678E0B5B75FFEA00845FA6F3BC26EDABB4BB7CE449B0B7E00B72473D8D95F126AB3893A9A969B4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Volgograd) {.. {-9223372036854775808 10660 0 LMT}.. {-1577761060 10800 0 +03}.. {-1247540400 14400 0 +04}.. {-256881600 14400 0 +05}.. {354916800 18000 1 +05}.. {370724400 14400 0 +04}.. {386452800 18000 1 +05}.. {402260400 14400 0 +04}.. {417988800 18000 1 +05}.. {433796400 14400 0 +04}.. {449611200 18000 1 +05}.. {465343200 14400 0 +04}.. {481068000 18000 1 +05}.. {496792800 14400 0 +04}.. {512517600 18000 1 +05}.. {528242400 14400 0 +04}.. {543967200 18000 1 +05}.. {559692000 14400 0 +04}.. {575416800 10800 0 +04}.. {575420400 14400 1 +04}.. {591145200 10800 0 +03}.. {606870000 14400 1 +04}.. {622594800 10800 0 +03}.. {638319600 14400 1 +04}.. {654649200 10800 0 +03}.. {670374000 14400 0 +04}.. {701820000 10800 0 +04}.. {701823600 14400 1 +04}.. {717548400 10800 0 +03}.. {733273200 14400 1 +04}.. {748998000 10800 0 +03}.. {

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Warsaw

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8662
Entropy (8bit):	3.8187545871488995
Encrypted:	false
SSDEEP:	96:ELn9M9Nivtctwwoy4qelPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCso:E6Nivtctgq1sFpM5vwA6Efv03TBZLl
MD5:	992C1D268E336AF1FB8200966C111644
SHA1:	C893B82224C8EF282DB2E16A5BBCC3A21C49B6FE
SHA-256:	F9DC10EC2AE2CC810A6C08837059B34BE651900BA4E1CEDB93C209972CCFB5A2
SHA-512:	EC4E0D8684D57FA66144F11D8E8C80E5272D4A7304300FEBE20E236476C1B8B33BBC5E479BF96D9ED12900FE6D41DD1DC0D11CBE02B89E0C4C7A153B4BFBCB1F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Warsaw) {.. {-9223372036854775808 5040 0 LMT}.. {-2840145840 5040 0 WMT}.. {-1717032240 3600 0 CET}.. {-1693706400 7200 1 CEST}.. {-1680483600 3600 0 CET}.. {-1663455600 7200 1 CEST}.. {-1650150000 3600 0 CET}.. {-1632006000 7200 1 CEST}.. {-1618696800 7200 0 EET}.. {-1600473600 10800 1 EEST}.. {-1587168000 7200 0 EET}.. {-931734000 7200 0 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796870800 7200 0 CEST}.. {-796608000 3600 0 CET}.. {-778726800 7200 1 CEST}.. {-762660000 3600 0 CET}.. {-748486800 7200 1 CEST}.. {-733273200 3600 0 CET}.. {-715215600 7200 1 CEST}.. {-701910000 3600 0 CET}.. {-684975600 7200 1 CEST}.. {-670460400 3600 0 CET}.. {-654130800 7200 1 CEST}.. {-639010800 3600 0 CET}.. {-397094400 7200 1 CEST}.. {-386812800 3600 0 CET}.. {-371088000 72

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Zagreb

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.899266605519742
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV/sUE2tovXHAIgoq8sUE2oAovRL/yQa5rXv1/h8Q0:SlSWB9vsM3ymhrE2tSHAIgohrE2LovNB
MD5:	B07D9D3A5B0D11A578F77995A5FBE12B
SHA1:	1C4E186F2D53C0A1E6A82A6D33B172E403A41D6D
SHA-256:	A49B3894EB84F003EB357647D6A40CEAF6213523196CC1EC24EEFD7D9D6D3C3E
SHA-512:	43520AE325980B236C47C866620D1DA200AC0CD794E8EB642D2936D4B0ECEFE2DA0A93C9559D08581B3CCE2BC75251A4D5B967D376B16EB0C042B0ADCE1DCD01
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Belgrade)]} {.. LoadTimeZoneFile Europe/Belgrade..}..set TZData(:Europe/Zagreb) $TZData(:Europe/Belgrade)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Zaporozhye

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7490
Entropy (8bit):	3.767302554706298
Encrypted:	false
SSDEEP:	96:rnziEpkvV5lpaNlKkUpvBeRF+iDlKSdkwSMTHkB2vwz59F06Kgr/y/rYjlBKb0hH:rhWd50ivBeRF+W35Syrwl9h5j
MD5:	CC195C2ED7DEE40A4A42C6CCF64E4DB6
SHA1:	34DC86891FBAAAE0FF328D4896566C777CDF1075
SHA-256:	F0045F64F64A2C40088F2960616AB8E0AABB8D6309F489FEE842056FB8412F72
SHA-512:	8F58C8023260B5BBA51EE05811F33A2315A79996C900F04069372114EF3B1AB593CE7155288B8699BF2B2E9B284FE5109827B3FC8644012DB54D039E73F2B8EA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Zaporozhye) {.. {-9223372036854775808 8440 0 LMT}.. {-2840149240 8400 0 +0220}.. {-1441160400 7200 0 EET}.. {-1247536800 10800 0 MSK}.. {-894769200 3600 0 CET}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-828226800 3600 0 CET}.. {-826419600 10800 0 MSD}.. {354920400 14400 1 MSD}.. {370728000 10800 0 MSK}.. {386456400 14400 1 MSD}.. {402264000 10800 0 MSK}.. {417992400 14400 1 MSD}.. {433800000 10800 0 MSK}.. {449614800 14400 1 MSD}.. {465346800 10800 0 MSK}.. {481071600 14400 1 MSD}.. {496796400 10800 0 MSK}.. {512521200 14400 1 MSD}.. {528246000 10800 0 MSK}.. {543970800 14400 1 MSD}.. {559695600 10800 0 MSK}.. {575420400 14400 1 MSD}.. {591145200 10800 0 MSK}.. {606870000 14400 1 MSD}.. {622594800 10800 0 MSK}.. {638319600 14400 1 MSD}.. {654649200 10800 0 MSK}.. {670374000 10800 0 EEST}.. {686091600 7200 0 EET}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Europe\Zurich

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7305
Entropy (8bit):	3.8199799674700277
Encrypted:	false
SSDEEP:	96:94hH74elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxOrnW+:9Y41sFpM5vwA6Efv03TBZLl
MD5:	EBD66FAEA63E1B90122CC1EB21634ECE
SHA1:	C6487BB8AB2A6A72B2170B220F383ADB6B9AC91C
SHA-256:	95AFA61E439CA38551306D8FDB11C2788D935C42768D0407C9E4337F105A3E93
SHA-512:	25A8D0ED9BBE6BF23A1A76CC6D5378CF4D50544AA22DA97DDCD0673D7A5CCFEFFD81B660A1AEFB254B8BBEA55F6EF734BBBD3F0CB903E0721BE107667CA1E328
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Europe/Zurich) {.. {-9223372036854775808 2048 0 LMT}.. {-3675198848 1786 0 BMT}.. {-2385246586 3600 0 CET}.. {-904435200 7200 1 CEST}.. {-891129600 3600 0 CET}.. {-872985600 7200 1 CEST}.. {-859680000 3600 0 CET}.. {347151600 3600 0 CET}.. {354675600 7200 1 CEST}.. {370400400 3600 0 CET}.. {386125200 7200 1 CEST}.. {401850000 3600 0 CET}.. {417574800 7200 1 CEST}.. {433299600 3600 0 CET}.. {449024400 7200 1 CEST}.. {465354000 3600 0 CET}.. {481078800 7200 1 CEST}.. {496803600 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600 0 CET}.. {606877200 7200 1 CEST}.. {622602000 3600 0 CET}.. {638326800 7200 1 CEST}.. {654656400 3600 0 CET}.. {670381200 7200 1 CEST}.. {686106000 3600 0 CET}.. {701830800 7200 1 CEST}.. {717555600 3600 0

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\GB

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.8978035005721265
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/wox6QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/wRj
MD5:	68667037110E713DB3F51922DDE929FE
SHA1:	2EB02BE3FD35F105B59847892A78F1AA21754541
SHA-256:	E20D829C605A7C5B2A96B83C3480DF28C964A13381A8BD2C72C2A37295131FA7
SHA-512:	3A8CC2EC9E3053283F996CA2C4B422061D47F1D16CA07985CBA2C838DF322C23CC9DD28033646F22EAE0E401781480B9D3AF82A539444166A4DD9B7BCCAE45FE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:GB) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\GB-Eire

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.90874180513438
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxKL823vXHAIgoqyKL8H6RL/w4b/h8QavKL81n:SlSWB9vsM3ymvKA2PHAIgovKAH6N/w4E
MD5:	625520BAAB774520AC54BFB9EDCF9FCA
SHA1:	C72F0FD45F448901C6B2E24243175729591B9A54
SHA-256:	C9334480D0A970254B6BA6FF22E958DC8DD8BF06288229461A551C7C094C3F1D
SHA-512:	1B672218FF9C86168E065A98C3B5F67DAB710D1C2A319E9D6599B397C4B4C00D3721B76C735C8AB04BCB618C1832B07F6CCDAF4266CC0D12A461A3A862D1AEB2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/London)]} {.. LoadTimeZoneFile Europe/London..}..set TZData(:GB-Eire) $TZData(:Europe/London)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\GMT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.867609984313873
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wZ8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wZ8RQy
MD5:	A01FE6FC260711F0E11C85DC3DE3550A
SHA1:	988311B71498591425C63669DC3F802F270B2C44
SHA-256:	747C15CDC239855D5380B7A7F47112F2A26C61B0BF300EEB9711E6521550D189
SHA-512:	BE4678DCBAE5DBC72865665413206C1909F28BA54F4943257870EFFBA6525457866DED7A985E89F2689C810B314DE4AA2FA3A0A1826A664727F5F7113AA56595
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\GMT+0

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.917182390229381
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/we7/8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wI8RQy
MD5:	3327B1BF3118AC6AFC02C31DF5B67CD9
SHA1:	3932577E66801AD31519B0BB56CCE7B9E36221A9
SHA-256:	BE48462CCFBB3AEE19597F082A17C2C5D2FD8BB1C9122245EFAB0A51F8F413B0
SHA-512:	53866FD513B039E8203E51FF3434D5736D3A4C4E0A46874D1C99A17115181AF749F0D079C2E14C5B0538D3DFA52B1645C977CD6599DA3EDA57CC7F84EEAB2D06
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT+0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\GMT-0

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.904279164422928
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/w4Hp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/w4J8RQy
MD5:	0CFFC5655F031D954BD623CC4C74DC9C
SHA1:	CE5E7AD67252F52D7E70719725FF5BE393DD6EF0
SHA-256:	944C86F516141DDC3AEC1AE4A963E9769879C48ED12DADDF4ED63A01313ACD00
SHA-512:	C7352D1394E8B8AC90CD19EE753D5277259BE5512ADDCAED2A2DEF144762CF20BE7A9FA09AAA1829EE401DD195C2AED8C967A7FF46739236E042AF4298EC84A2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT-0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\GMT0

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.892526720357546
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wPHp8RDMovn:SlSWB9vsM3yFXHAIgnvVHN/wvp8RQy
MD5:	565B41A5DB28F9FE7D220E9BA39062A4
SHA1:	5183689210F07C8A71F880DCE8E5C2CB62CEB17D
SHA-256:	54850A5F488205DB01FBB46E2DA9FFF951C4571029EA64D35932DDEA5346DAAF
SHA-512:	BD6E5141F06B03D62DCF725E9E48D6AA8ECD6E8E47A4015B25DC3F672392065FFFD80D688C6695324DC105EA528025CF447FA77E6D17E15D438E61DC51879CB7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:GMT0) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Greenwich

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.917976058206477
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqSsM4DovXHAIgexovYovHRL/wE+FB5yRDMovn:SlSWB9vsM3yFXHAIgnvVHN/wE6BURQy
MD5:	443FA76F107ED438F9571A044B848C6A
SHA1:	1CF508429DFC40643B1FAB336A249A3A287D8C7C
SHA-256:	9E7A8DAA26CE36E8F7D7F13460915C063EE98E2A4DB276AD9D15CA5C7C06815F
SHA-512:	6C0C5FF513A742FBDA349AC3A2581D456701B5348A54ECF38E496DAA1EFC74D937982B6F69F1761CC2FC4B88D9A971EFA2B16096E71EAF002EC5CE4130B533DE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/GMT)]} {.. LoadTimeZoneFile Etc/GMT..}..set TZData(:Greenwich) $TZData(:Etc/GMT)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\HST

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.90682088010982
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x//LhdNMXGm2OH1V90v:SlSWB9eg/jJDm2OH1VGv
MD5:	79C82A5F8B034E71D0582371E3218DBB
SHA1:	1476CE8EA223095094B6D25D171E6319C96669F4
SHA-256:	8D710699AF319E0DDB83E9F3A32D07AE8082EA2F7EABBD345EFFFFB0F563062E
SHA-512:	ADEE55581D1A158929F09A63B03883ABE9193337DDF225C61AFDBB8A2C7D0BD248ADC4714E0EEFD334826C54C1AFFC8B1E6C2B0D6EF830C3CCA50CC79834F473
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:HST) {.. {-9223372036854775808 -36000 0 HST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Hongkong

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.913328649996328
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8Li0vXHAIgN2qfvRL//XF1p4WFKQyvn:SlSWB9vsM3yW2HAIgAOvN///p4wKlvn
MD5:	6A307B229C302B1BAE783C8143809269
SHA1:	EA169AF81AD12380A69FB6B7A12479BA8B82878B
SHA-256:	359C9C02A9FA3DE10BA48FA0AB47D8D7AFF3B47F950CFAF5EB68F842EA52AB21
SHA-512:	505445FD0B3E140384EDC27993923BBF9ACD23A244B0F14D58804BFAA946D0BC4C0D301FBCCB492BAFDA42C8A92F4163FB96F4D75DD7374858D1C66183BEC24B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Hong_Kong)]} {.. LoadTimeZoneFile Asia/Hong_Kong..}..set TZData(:Hongkong) $TZData(:Asia/Hong_Kong)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Iceland

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.888934660651573
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqLGsA/8rtyXHAIgvMGsA/8rJARL/+GAKyx/2RQqGsAW:SlSWB9vsM3yj6SHAIgv1sAN/+XZx+RQK
MD5:	F51C5B80789F65136304CE107E4E60E1
SHA1:	3F4690BCCA45C0ADEC184175DEC53730C326733C
SHA-256:	E4AB3A08ED590D907F9741D4B8FE27E552B19FE0257F14CE2ED5289D5685974C
SHA-512:	9D0BB2D8C9D42C3F7274E0831B4320023069A7DF2069AA5EB6FF1BBBF5781629020BBB70C9ECCC38955FC79A5E2CB3110AB90C21191A6FB421F3195C31FC984C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Atlantic/Reykjavik)]} {.. LoadTimeZoneFile Atlantic/Reykjavik..}..set TZData(:Iceland) $TZData(:Atlantic/Reykjavik)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Antananarivo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.807410166086502
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6EL/liEi2eDcVVMB:SlSWB9vsM3y7VTHAIgNTxcAN/+LzM2eV
MD5:	0F20CBF1F7600D05F85D4D90FDAB2465
SHA1:	2F3C9479C4F4CD7999B19C07359B89A5FB1B9839
SHA-256:	1B1177CE4D59D7CBCAE9B0421EB00AD341ECB299BD15773D4ED077F0F2CE7B38
SHA-512:	657341FC2CCD6A4F7B405ABC8E24C651F6FFEFD68EBD6E2086ADF44834DCBF21D1B9D414436E42C8DCE46FFB88116B98C1D073782E214B3996D49EC00DFF4383
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Antananarivo) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Chagos

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.853088038233057
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/+L6EL9WJx3vFNMXGm2OHi/FvoHscfJ7XH0VQVFV6VVFSTVV:SlSWB9eg/+LxWJxPDm2OHqFvoH9+VQV3
MD5:	06143C3DFD86B3FE4F2A3060C0E05BB6
SHA1:	88E0E30CEE4AB8117860A35AD03B16AF48988789
SHA-256:	11044AD7CB0848CC734D2A67128AA6AC07CB89268399AA0A71A99024DE4B8879
SHA-512:	79195D3D0D475BEA982F40683D4BA14AC33B3FA91311F513DCED955C9297C2B0F12D94CCA930FAE0FB7F95DB34CD4E74B5AF0233E792122646592B7EFF0F3163
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Chagos) {.. {-9223372036854775808 17380 0 LMT}.. {-1988167780 18000 0 +05}.. {820436400 21600 0 +06}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Christmas

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.957836950238227
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/+L6EL9FBIEW3odNMXGm2OHAWMx5oHvTLyvMVSYovV:SlSWB9eg/+LxpW3SDm2OHAnx5oHvTIMI
MD5:	DA36A8158AF3480E67CD6EF3ABB875E3
SHA1:	9DA259BFB6B39AB0425E67A1E4F1ECAA1321AD72
SHA-256:	CB43DEAFAD0F8BF7DE8567841790A58D358EF2B210BB2022686B3EB7F97B2E5B
SHA-512:	48B20BFD14B0C756CD3AAA9A422837D7D5012612294EB01EBF12A26D0147D85087DED1B95C3E5CAB1485E8BC3B19A69B9DB234D06562AD0482CB7518977256BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Christmas) {.. {-9223372036854775808 25372 0 LMT}.. {-2364102172 25200 0 +07}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Cocos

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.861380366254495
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/+L6EL9dsFNMXGm2OHGXTvxoeoHvmVUXxXW5d6TW7Ay:SlSWB9eg/+Lx2Dm2OHGXCeoHv3BG5UI9
MD5:	4D5285269D6F0A54495B10EEF4994E01
SHA1:	FEE44907B02B660390CFDC560E3981112D5774BB
SHA-256:	71194B896CC00967EBBE3F9F4609F8C5CD73CE56B2529646A7A6AC679BB03400
SHA-512:	068D29EA51465A5232724A0CEF0274FD5DFC16A44720823CEA470125129FF527BF411EDAAFAEBE5F9783334BD93DB92372D0847207E4A42C79A0F6158163F1C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Cocos) {.. {-9223372036854775808 23260 0 LMT}.. {-2209012060 23400 0 +0630}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Comoro

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.825881690094318
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6EL9TKlBx+DcVVMB:SlSWB9vsM3y7VTHAIgNTxcAN/+LxGV+V
MD5:	7EBDFA311C7852AFADF880395071DE48
SHA1:	F6EC21FDFB75EC1BE45B1C4170147CBA3E870E7B
SHA-256:	53FA58E32DC2E4ABB574B2F78011815EEB7F89F453CC63C6B6C1460ABBB4CA5C
SHA-512:	DFBCD4EA4AFFA1D1CAE7308168874527FD36B5CAE76153AADA9C5E5F628258AB26654A16C8A5F8906FC5918398FD880B15B6DD4E3EF6AD3BE63D4A2455701FA8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Comoro) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Kerguelen

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.871582172327986
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/+L6EL12h2FNMXGm2OHvavFd9vM0VQVFv:SlSWB9eg/+L53XDm2OHEd1nVQVV
MD5:	5D07EBAAF83E8E473C23142CB09A05BF
SHA1:	34FD76789085EB6336193889D8FB5A8B3142383E
SHA-256:	C7AFDE6978D8CE5413730D370E2776E2ACC7D96570A6034EB504C0F42CA5D1E7
SHA-512:	FC5613EFC3B8EFA3553ECD3232383FF4CF5F4D777A1E46C4D212080711EA33F38A59449F828C6E33CB1F359249F254B4869AFD8F434FBD5213E657732D832777
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Kerguelen) {.. {-9223372036854775808 0 0 -00}.. {-631152000 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Mahe

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.942285614866899
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/+L6ELzJM5FNMXGm2OHuVdF+YoHscfNmHIRNVsRYovV:SlSWB9eg/+L/YDm2OHWgYoH9YHkSN
MD5:	ECA9671460E65583ADF4892E40F2402E
SHA1:	6E5DE51DD1FB619E33254F5967647A77A5D7C496
SHA-256:	8E1D0F7268A5EE75E8A7C17FD6E1A9880BAD18A612346C29D70B462024D7371E
SHA-512:	CBD970D789943120B8DE5A166B97ABC7E221F7692DE26FC5523FB0D76C4BF9D10F541778ED1ABB7A3B9529547C20B804B702B7221516970B7B3225A87682AC93
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Mahe) {.. {-9223372036854775808 13308 0 LMT}.. {-1988163708 14400 0 +04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Maldives

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.883092265054605
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/+L6ELzE5FNMXGm2OHnz8eoHvZT5lxV/uUQwGN0VQVFv:SlSWB9eg/+L/EJDm2OHnz8eoHvZT5rdI
MD5:	4DF975C040D78FA8F9C92E5565D63A73
SHA1:	48488F076871530D32278084F1C9CB90CB1E6AB4
SHA-256:	9FAC69DC609CC6074ECD67E0BE8AE62E33D8D9C7F055A3E0DEE1430C7FFC54F6
SHA-512:	880B920FB51F48731BA8C741B9583038A3276221C55F1CE0B464D2797D71EF9D22B4E166841BAB0544B7091CE683697BFCA5A4235FF1E6264B0619DBDD4BB619
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Maldives) {.. {-9223372036854775808 17640 0 LMT}.. {-2840158440 17640 0 MMT}.. {-315636840 18000 0 +05}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Mauritius

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.5144164346164715
Encrypted:	false
SSDEEP:	6:SlSWB9eg/+L/GDm2OHlNnoH9SvulvSNFF+c0FSFFMVhvSNFFVBjvVFSFFVGlvSN:MB86+L/CmdHlNnCy6qB0FScZq9BjVFSL
MD5:	05362B6A17C5F4F4E8CBE5A676D5D0DE
SHA1:	84675D5E8D1425A5E9DB07D1BC1E6A5921B5AC91
SHA-256:	A2B1B93CBEECBD900ED71E61A4932509EB52688E97A6015DAD067066D0D42072
SHA-512:	351D2BC5F5888D8E842BF160D11D57E059811186D63B0413061768C7FE348CECB700748A0C0125F0ABCBB039FC74FF7BEEFDD42088BA1E28C785E545ED2CDF24
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Mauritius) {.. {-9223372036854775808 13800 0 LMT}.. {-1988164200 14400 0 +04}.. {403041600 18000 1 +04}.. {417034800 14400 0 +04}.. {1224972000 18000 1 +04}.. {1238274000 14400 0 +04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Mayotte

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.828945679595274
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/+L6ELzO1h4DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/+L/O1hm
MD5:	8ABBEC0E138C1A68CB5D096E822DE75E
SHA1:	E9C5CE1A249F6DC0F6EDBB3F5B00F3106E3BD6CA
SHA-256:	845C45FD7B6F0604B03A3C72DB117878B568FB537BCA078304727964157B96AB
SHA-512:	15790CCA70140D3139F3E2A202DC8F12E68466A367C68458D6A78CDDC7822FB5EDB87D630926B51F3DE48D95DE7CA3FCB946CD7B762FE5B15866DAA9DBA40B46
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Indian/Mayotte) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Indian\Reunion

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.978742383555601
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/+L6ELsAcCFNMXGm2OHuU7oeoHsdvcUeNVsRYovV:SlSWB9eg/+LBXDm2OHb7oeoHTfNSN
MD5:	A03BEEC3F4CF0F6E1077A04C67CF3375
SHA1:	4C39038341E26C2E68F2E46AD243A0955098F149
SHA-256:	E039B16CAAB8F5D8F85625E0CC1D0FE42369715F2A4810BDF7F9CF19A28B5603
SHA-512:	B23C6C28FEE0A8CA93DB2928A9AC97DD8475B7C1FC6DCB70E696F066D67DF4FF0285D7631400DEDD780C4B5F868B194CC59108FCFA519473D1ADDEC36CC53262
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Indian/Reunion) {.. {-9223372036854775808 13312 0 LMT}.. {-1848886912 14400 0 +04}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Iran

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.809541513808179
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8g5YFeovXHAIgNqjyVHRL/+XiMr4WFKBpv:SlSWB9vsM3yA5oPHAIgcjeHN/+Xvr4wY
MD5:	A90C26358FEF60E49044E3BE02866FAC
SHA1:	137AC8CCA23F39E7A16C4050EA9A3A8731E9AAD7
SHA-256:	FE7F4453CB5F6B81B23C1C795356B91FE319F0762BE7868FAFE361DB1F9C2A2B
SHA-512:	D6C74CACF69D29E14CB46E5DD885234AC50EE2E258E0C5E3AC76465061622F064F974D33E91A6A020B9D618D90799DDA6EB1EA53022EDB6E26A9CB6ADFE0AA30
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Tehran)]} {.. LoadTimeZoneFile Asia/Tehran..}..set TZData(:Iran) $TZData(:Asia/Tehran)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Israel

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.8290104377288925
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq85zFFfXHAIgN0AzFFVHRL/+WXnMr4WFKYzFgn:SlSWB9vsM3yZbPHAIgCAXRN/+zr4wKY+
MD5:	6BCC43951637D86ED54585BE0819E39C
SHA1:	6F04F306B3AB2A6419377294238B3164F86EF4A3
SHA-256:	805105F5F17B78929F8476BAE83ED972128633FF6F74B7748B063E3C810C27A6
SHA-512:	ABB9F4308BF4BD5C62C215A7ECD95042CBFB3005AF1E75F640962B022574C930DD5A12CD0CE0AF8A3D7E38B999E37C3A45A55091683F6A87E9D0CDA9EE417293
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Jerusalem)]} {.. LoadTimeZoneFile Asia/Jerusalem..}..set TZData(:Israel) $TZData(:Asia/Jerusalem)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Jamaica

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.722012123002917
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx00EIECWXHAIg200EIE/vHRL/9S//2IAcGE0EIESvn:SlSWB9vsM3y795VHAIgp95HN/029095c
MD5:	1F020341AD51AA82794B8018F214DE0D
SHA1:	4414E56C1277B4D31FE557F8652D522C0594F4B2
SHA-256:	F01B00D52BD7B2694BF5CB55A17028C30A41BD22A774CA54740E8B1DDE4FCB2E
SHA-512:	CC41848A851D4992AE9F27C38669CB87CE2FD05A33AB6989EA21AFCB1A2707DE0CB4D62BCC45E536DD944859991D7564847205F47509A42D41932370496A77D7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Jamaica)]} {.. LoadTimeZoneFile America/Jamaica..}..set TZData(:Jamaica) $TZData(:America/Jamaica)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Japan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.8422204749795545
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8aofXHAIgNqsRL/9hM7/4WFK9vn:SlSWB9vsM3ypPHAIgcsN/4r4wKNn
MD5:	9554A65BFFCFFCFB2C1588569BB4638E
SHA1:	B377ECB04586396D37093856AEF8BBDC93192F66
SHA-256:	98DBD07AE3B9251B9091F4D265336CE98BDFB492AF863C1F3FF25248A2CADF35
SHA-512:	E2E761B8B1995B68721BC714A546E0F45EEC025FAF81DE579FF0D73D37783D0E031B9E78BA2FAC6B097E3673C47AFB8761FBC58E42E33018FD44B77F2871E0C6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Tokyo)]} {.. LoadTimeZoneFile Asia/Tokyo..}..set TZData(:Japan) $TZData(:Asia/Tokyo)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Kwajalein

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.810216093939366
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG1/EOM23vXHAIgObT1/EOMH6RL/8/FMKpUDH1/Ex:SlSWB9vsM3yc1EiPHAIgOb1E+N/8xMEx
MD5:	05C0C40F2AA456F580EAAFC4F7E49B56
SHA1:	5796A9122693B2D6010BC5E617A6091F46330B0C
SHA-256:	85E95363ACF468043CD5146927A97B2D9E3B141EDA0A7993DADA9382D1D6DD54
SHA-512:	2155F8E3EB73312F0AFD5CDDF4B19EBB67A15658101870C2CEDF96955470DBC7B30F34E143D9C14CBFA7A138F63324009581BD0B807AE295C68588CA0470D7AD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Kwajalein)]} {.. LoadTimeZoneFile Pacific/Kwajalein..}..set TZData(:Kwajalein) $TZData(:Pacific/Kwajalein)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Libya

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.829980800076139
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsbKJqYkyXHAIgNGEnKJp0ARL/7beDcbKJ6v:SlSWB9vsM3y7JSHAIgNTxAN/PeDE
MD5:	4D44D88336212E162CCEFADE6321EDBC
SHA1:	B9EE7AFE26DC61AA9EA37EB99A3C10DD176E8063
SHA-256:	F776839C1999056E6A0D2ECFDF9054FC309454AFDFF8E8BC803F33EC423B7361
SHA-512:	FDDCBD194DE07B51DEBBDEF4FD96762EE3507117443FB9F7975FB56E0AE97B0D1F8657FE26B092021FB12B5A5D3EFFAB9E0A54B1C2AFCEC1029855442A0A95AB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Tripoli)]} {.. LoadTimeZoneFile Africa/Tripoli..}..set TZData(:Libya) $TZData(:Africa/Tripoli)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\MET

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7736
Entropy (8bit):	3.799706947156251
Encrypted:	false
SSDEEP:	96:aJCP8D3pCS2JWk55EyqJNSPTub3NDOyFyJYVtLbTxdqs0xcQVq+O7JSAmwQZjltB:FSyWBSPTujlOyqc3JuzVNvTN
MD5:	02B993B4A6956014A2DB844E8A5498C0
SHA1:	378333547254AC43BEB4FA2CBC24B8DE241B3078
SHA-256:	DF45F5414F1636B1856C7534BB5F3D4387C32D56283A68BB47D8C48C1DDAD5BC
SHA-512:	CC3ABCC1FB5ABD10A685F140931DE38D6875142D3595F8D9A581F5B31A7F354FA4CCC9727B69F58E0D2F773EA0F76D9ACFDF7ACBAFC6BAA6E93A46EAE8F18672
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:MET) {.. {-9223372036854775808 3600 0 MET}.. {-1693706400 7200 1 MEST}.. {-1680483600 3600 0 MET}.. {-1663455600 7200 1 MEST}.. {-1650150000 3600 0 MET}.. {-1632006000 7200 1 MEST}.. {-1618700400 3600 0 MET}.. {-938905200 7200 1 MEST}.. {-857257200 3600 0 MET}.. {-844556400 7200 1 MEST}.. {-828226800 3600 0 MET}.. {-812502000 7200 1 MEST}.. {-796777200 3600 0 MET}.. {-781052400 7200 1 MEST}.. {-766623600 3600 0 MET}.. {228877200 7200 1 MEST}.. {243997200 3600 0 MET}.. {260326800 7200 1 MEST}.. {276051600 3600 0 MET}.. {291776400 7200 1 MEST}.. {307501200 3600 0 MET}.. {323830800 7200 1 MEST}.. {338950800 3600 0 MET}.. {354675600 7200 1 MEST}.. {370400400 3600 0 MET}.. {386125200 7200 1 MEST}.. {401850000 3600 0 MET}.. {417574800 7200 1 MEST}.. {433299600 3600 0 MET}.. {449024400 7200 1 MEST}.. {465354000 3600 0 MET}.. {481078800 7200

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\MST

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.902637155364683
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/6xtNMXGm2OHrXV4foAov:SlSWB9eg/6lDm2OHrCAAov
MD5:	36119516E87814F3C219193069CD6A90
SHA1:	BDB25531B30E6FC454100F37177EC9D4A0FB4E39
SHA-256:	E57746D5DB479A8B30973F2BC16E2B8DFB6E2BFAECBFF0FB956F04526E4B935B
SHA-512:	2730C5DABA0B2CCFD32A799C48EE07351659F51B9C2B91DCD145675AF276F2D0B5AA51ACF7D283C0DC236D3AFA3A75E58EB9F970B1831A6E36F02139CAF6A655
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:MST) {.. {-9223372036854775808 -25200 0 MST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\MST7MDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	3.8405400251137207
Encrypted:	false
SSDEEP:	96:T1ktwmGaLV911sF7Lv/PCewtA8CzSPyDLbrcUia:TswDPlLv/PCenJzS6cy
MD5:	87B3BCD4A793BA383889ECFDB44C846E
SHA1:	3EA34B5E6E3078A9501653BA069D5E5E879D7FE4
SHA-256:	A5DEB89D59613D9A54C1E146056A805B3DE9F2A2593AEC2B8A25F863328699C0
SHA-512:	AA4DAC2614661EF18A2A60A5BD4D5BBBCCB5D721F90A25E9D11C5B6AF8C39FD475B3E23894719E2F8F74469F13D5492FF31DDD193D9E3172182FBCBCDD860A41
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:MST7MDT) {.. {-9223372036854775808 -25200 0 MST}.. {-1633273200 -21600 1 MDT}.. {-1615132800 -25200 0 MST}.. {-1601823600 -21600 1 MDT}.. {-1583683200 -25200 0 MST}.. {-880210800 -21600 1 MWT}.. {-769395600 -21600 1 MPT}.. {-765388800 -25200 0 MST}.. {-84380400 -21600 1 MDT}.. {-68659200 -25200 0 MST}.. {-52930800 -21600 1 MDT}.. {-37209600 -25200 0 MST}.. {-21481200 -21600 1 MDT}.. {-5760000 -25200 0 MST}.. {9968400 -21600 1 MDT}.. {25689600 -25200 0 MST}.. {41418000 -21600 1 MDT}.. {57744000 -25200 0 MST}.. {73472400 -21600 1 MDT}.. {89193600 -25200 0 MST}.. {104922000 -21600 1 MDT}.. {120643200 -25200 0 MST}.. {126694800 -21600 1 MDT}.. {152092800 -25200 0 MST}.. {162378000 -21600 1 MDT}.. {183542400 -25200 0 MST}.. {199270800 -21600 1 MDT}.. {215596800 -25200 0 MST}.. {230720400 -21600 1 MDT}.. {247046400 -25200 0 MST}.. {262774800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Mexico\BajaNorte

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.884776849010803
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0qfSfXHAIg20qfORL/6AdMSKBbh4IAcGEqfBn:SlSWB9vsM3y7ekHAIgpeON/68K5h490m
MD5:	3050A0100A2313C1D3AB4278B464F17A
SHA1:	1A140447B3972900F13768659FD6979F68126E97
SHA-256:	F8CA38A845CD01BF785EE222277DAD9325AB6BD17E44A362C450855AEB522814
SHA-512:	C91C4BF2318C50D473E6051855C12F0E11CBAA8580B88115CDDE054D36476A1D8DDC5D17A7A123BD84148C20B96BD839511EAD573F5FD2C9A8556646B9CDE5E5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Tijuana)]} {.. LoadTimeZoneFile America/Tijuana..}..set TZData(:Mexico/BajaNorte) $TZData(:America/Tijuana)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Mexico\BajaSur

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.8897674180962145
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0zjRJ+ovXHAIg20zjRJ8yHRL/6AdMPCoQIAcGEzjy:SlSWB9vsM3y7zjRJvHAIgpzjRJ8yHN/Z
MD5:	FAFD9727A0E153AFCB726690D215DA76
SHA1:	3CD3B2737FC781F38DE26E255968CBB88B773CBF
SHA-256:	2E6E32A40487F0146B59150B66FF74901CA853B12D47922819AF23EEA5B4149C
SHA-512:	76D110494D4EB76961C818B2A2CCB2303B31DA161664FA712C87B95B81DE7B8F3E50DC7B2836C6ECC6437AE9595668E62E4E706F1B343EFEA12C32210F113540
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Mazatlan)]} {.. LoadTimeZoneFile America/Mazatlan..}..set TZData(:Mexico/BajaSur) $TZData(:America/Mazatlan)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Mexico\General

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.877941255622543
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7zBDSHAIgpzBx6N/6BXl490zBf:MByMYzppzH6t6Bi90z1
MD5:	29ACBFCD0FD521EC0C9523906B9E2252
SHA1:	BBC1AD3F78CAA634A2F0BC38059975EF8E4A2CE9
SHA-256:	2DFF1B83FECFAD5C27EC47B206696C29B91398F8185B5D406A66FA9E0AECA93F
SHA-512:	802502010CFB6F1F4E60C22ECB0E6CA22750975E5838BE7E7DC9D12EA019CB6508F0F87465A113A98356CC9E145E32E6633AE2B45B93412A358C4AD13E923EFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Mexico_City)]} {.. LoadTimeZoneFile America/Mexico_City..}..set TZData(:Mexico/General) $TZData(:America/Mexico_City)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\NZ

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.888611285267583
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG/u4WXHAIgObT/KvRRL/5E1nUDH/uov:SlSWB9vsM3ycqXHAIgObOvRN/iy
MD5:	92548E239012515D756E002768CA876A
SHA1:	6BDC73DBD7356C3F82C5C76E6E2D58656FA9E21D
SHA-256:	E22D629D53C54960AD156C377DE0AE461C27F554990A3D1305724CA8F869BCE4
SHA-512:	42AD074EE08E083EE91270F203707698A8B3308005C94514B8B2D950F4C6F0B37D7D32973EC9F6AB49A0875209076FB40341B31433A27E47B3CC0EA711ECE321
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Auckland)]} {.. LoadTimeZoneFile Pacific/Auckland..}..set TZData(:NZ) $TZData(:Pacific/Auckland)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\NZ-CHAT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.881663364410736
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG9WQ+DyXHAIgObT9WQiovRL/5AmtBFB/pUDH9WQg:SlSWB9vsM3ycwQ+DSHAIgObwQTN/zzJ7
MD5:	3811C133C6311E33FDAF93660E1EAED5
SHA1:	64756FF877B2EB91BAED2889B3924DAB6784DF43
SHA-256:	83F4CA3522B64F9B151EDEFAE53E0F28C2E6C4CE16D0982186B3344F2A268724
SHA-512:	7724D6CD08E13E116CCDF073F86CE317C0D4A849C5FE81DF3127D435704507FBF554BFC6E7A50CCA3852F6001D8654B7FF90466878DB8C3298338BE16149FD32
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chatham)]} {.. LoadTimeZoneFile Pacific/Chatham..}..set TZData(:NZ-CHAT) $TZData(:Pacific/Chatham)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Navajo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.8545620422964015
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/5vf1+IAcGE6RB:SlSWB9vsM3y7+SPHAIgp+ON/pd+90+B
MD5:	5E9F3294F68873BF503F3DDDDF6713B0
SHA1:	954CD6F123C043E64F5E49733327E2C78877BDFB
SHA-256:	2CC8CE235F2EE3160E6AFD04A4E28AA0312494EBB6FED08D8CC81D414EC540EE
SHA-512:	200FC489989CA57219D5B28FB135BE5BDAC67239F3D243C496545D86D68089E51856CEAC4D2E700C0E47BAE4D5FEAB18A367C554235615B2B860F4E5E1BB08C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:Navajo) $TZData(:America/Denver)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\PRC

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.902914099699953
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8qvfXHAIgNtaYFARL/nL75h4WFKdy:SlSWB9vsM3yMPHAIgO8AN/H5h4wKU
MD5:	87C439DC623BF5C7EB01ADA6E67FB63A
SHA1:	1CC357558E09CDEA49F821826D2AEA9A6EF2C824
SHA-256:	6A5BAA9CA54B2A2C6D21287443BE0B1064AA79B5C4C62939933F8A0AD842B73E
SHA-512:	E628B8F1C967AABAEFBB68A33416F6FE47422970BA18414BB3396AC063E65A4DC892595D4071395194AF320633EE915A494E1F8D4216EE8194A034739D275C49
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Shanghai)]} {.. LoadTimeZoneFile Asia/Shanghai..}..set TZData(:PRC) $TZData(:Asia/Shanghai)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\PST8PDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	3.836877329152454
Encrypted:	false
SSDEEP:	96:0KhTG0hjvZkR/bvtw+N6IkWq/WHQlb/RYRWVIKr7cRRL:0sG0U9bFzN6IkWq/WHQt/RY4yP
MD5:	45E7E9E183A990F56E17C04FA48CE620
SHA1:	A1F39E0ECEA3C64E761A9A3159E331FA51B625F9
SHA-256:	D148708F1E70EEFA51E88E5823776CBE710535D4D6D6356E7753A44463A1C5AB
SHA-512:	1D1F4BA90D07D7EE12DFD0E37DBFD5410A4EAFFBA8960B816FDD5963CD6B20938080A4248E7B249AAE02F068E817AB9A85735D226F7DA8DD2C5462A70B18E8EF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:PST8PDT) {.. {-9223372036854775808 -28800 0 PST}.. {-1633269600 -25200 1 PDT}.. {-1615129200 -28800 0 PST}.. {-1601820000 -25200 1 PDT}.. {-1583679600 -28800 0 PST}.. {-880207200 -25200 1 PWT}.. {-769395600 -25200 1 PPT}.. {-765385200 -28800 0 PST}.. {-84376800 -25200 1 PDT}.. {-68655600 -28800 0 PST}.. {-52927200 -25200 1 PDT}.. {-37206000 -28800 0 PST}.. {-21477600 -25200 1 PDT}.. {-5756400 -28800 0 PST}.. {9972000 -25200 1 PDT}.. {25693200 -28800 0 PST}.. {41421600 -25200 1 PDT}.. {57747600 -28800 0 PST}.. {73476000 -25200 1 PDT}.. {89197200 -28800 0 PST}.. {104925600 -25200 1 PDT}.. {120646800 -28800 0 PST}.. {126698400 -25200 1 PDT}.. {152096400 -28800 0 PST}.. {162381600 -25200 1 PDT}.. {183546000 -28800 0 PST}.. {199274400 -25200 1 PDT}.. {215600400 -28800 0 PST}.. {230724000 -25200 1 PDT}.. {247050000 -28800 0 PST}.. {262778400

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Apia

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	909
Entropy (8bit):	4.042826306713664
Encrypted:	false
SSDEEP:	12:MB86HbmdH2oVCvcCfdf3NaDyTb6Dye78ubUt1NEUtszIVbUtoUtoUt3mbUt4qUt6:Yekv5fcfem+Cuy
MD5:	E5B913965F72AB807BAE67BD20C0A699
SHA1:	2161B73EC868C8D18C09970766D19A8583FF7981
SHA-256:	983884249ACC11C3FE740D78E72B1A89BE9C8B077283549BF6BCD8C93FA71731
SHA-512:	F8807C52DB852C48C62F25569C990C31D977BC7D0DF502CF2B92F9ED6BCB89A6DD8A6758FBD1185E0B5C34DE5450D5C748B71760AC93E72DC3976B3B31D1A605
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Apia) {.. {-9223372036854775808 45184 0 LMT}.. {-2445424384 -41216 0 LMT}.. {-1861878784 -41400 0 -1130}.. {-631110600 -39600 0 -11}.. {1285498800 -36000 1 -11}.. {1301752800 -39600 0 -11}.. {1316872800 -36000 1 -11}.. {1325239200 50400 0 +13}.. {1333202400 46800 0 +13}.. {1348927200 50400 1 +13}.. {1365256800 46800 0 +13}.. {1380376800 50400 1 +13}.. {1396706400 46800 0 +13}.. {1411826400 50400 1 +13}.. {1428156000 46800 0 +13}.. {1443276000 50400 1 +13}.. {1459605600 46800 0 +13}.. {1474725600 50400 1 +13}.. {1491055200 46800 0 +13}.. {1506175200 50400 1 +13}.. {1522504800 46800 0 +13}.. {1538229600 50400 1 +13}.. {1554559200 46800 0 +13}.. {1569679200 50400 1 +13}.. {1586008800 46800 0 +13}.. {1601128800 50400 1 +13}.. {1617458400 46800 0 +13}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Auckland

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8772
Entropy (8bit):	3.900078030355782
Encrypted:	false
SSDEEP:	96:pj4hKuZaqaaiFKgjGeGV3atL67G9kJGsU+mpe7Vy:Cla1KgjGeGcQMsa
MD5:	8174D7205622711F58E0B515246FE89D
SHA1:	9777B2633ACF5588268D5072F817E65C879358AC
SHA-256:	201CFADB00FBCD3283249DAD73872ED75C5BEC07F5A5B157726638C20728B833
SHA-512:	64121ED1EE70D5423710319E806B19261576AECC89A64CBEC44A29BF4AC9FEE21C6484CC3C4550CC92C315B3855BE265F696F8CD4D95027226D608B3ADD022F1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Auckland) {.. {-9223372036854775808 41944 0 LMT}.. {-3192435544 41400 0 NZMT}.. {-1330335000 45000 1 NZST}.. {-1320057000 41400 0 NZMT}.. {-1300699800 43200 1 NZST}.. {-1287396000 41400 0 NZMT}.. {-1269250200 43200 1 NZST}.. {-1255946400 41400 0 NZMT}.. {-1237800600 43200 1 NZST}.. {-1224496800 41400 0 NZMT}.. {-1206351000 43200 1 NZST}.. {-1192442400 41400 0 NZMT}.. {-1174901400 43200 1 NZST}.. {-1160992800 41400 0 NZMT}.. {-1143451800 43200 1 NZST}.. {-1125914400 41400 0 NZMT}.. {-1112607000 43200 1 NZST}.. {-1094464800 41400 0 NZMT}.. {-1081157400 43200 1 NZST}.. {-1063015200 41400 0 NZMT}.. {-1049707800 43200 1 NZST}.. {-1031565600 41400 0 NZMT}.. {-1018258200 43200 1 NZST}.. {-1000116000 41400 0 NZMT}.. {-986808600 43200 1 NZST}.. {-968061600 41400 0 NZMT}.. {-955359000 43200 1 NZST}.. {-936612000 41400 0 NZMT}.. {-923304600 4320

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Bougainville

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.715653436088026
Encrypted:	false
SSDEEP:	6:SlSWB9eg/FtTfDm2OHHhp5oHvZiuo2HvDVeEU8vScH9syZEizy:MB86FtTLmdHf5CvZiIvJeJ8HH9F6izy
MD5:	4E858B3754BD8864719A61839ACA64E6
SHA1:	597025A8DAFD5AE75EBD162AC0E9DA71815816BA
SHA-256:	2D3BFDED297214BA25CFD8C6F508D0C8B1A1CD7D46701A78EC5E510076185EB6
SHA-512:	720F301B73C852EA8EEFA79DEF6B6762554E50222DE114FE87EB5178507F1895A9A39B3872A1A4B9DFF58D1CC6460BA4A82F2C165E3659E13036451F22E389C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Bougainville) {.. {-9223372036854775808 37336 0 LMT}.. {-2840178136 35312 0 PMMT}.. {-2366790512 36000 0 +10}.. {-868010400 32400 0 +09}.. {-768906000 36000 0 +10}.. {1419696000 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Chatham

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8165
Entropy (8bit):	3.6566720439018874
Encrypted:	false
SSDEEP:	96:gpvlGCcn6AadFurBrioCdL49mq9X4a2t3I/KVE:gOCBdFurBr0soaz
MD5:	8105A806A1762932897AB59C47BBE89E
SHA1:	386E41A4A83FA84DBFCA994F679242D067CEED64
SHA-256:	CA0EEF84DBC5964EF2265E9252237BE58BB8D75C34817CC2305CCCFAEC7E690C
SHA-512:	8A609E7F4868BD455DA811E62142FECD792D0CA0DAAF7C10C4E4254C9EC44B8EB92D388D9224C8FD3CC3FB326A106D831B80F5E1264CCF3EABBCE177BB82E9D6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Chatham) {.. {-9223372036854775808 44028 0 LMT}.. {-3192437628 44100 0 +1215}.. {-757426500 45900 0 +1245}.. {152632800 49500 1 +1245}.. {162309600 45900 0 +1245}.. {183477600 49500 1 +1245}.. {194968800 45900 0 +1245}.. {215532000 49500 1 +1245}.. {226418400 45900 0 +1245}.. {246981600 49500 1 +1245}.. {257868000 45900 0 +1245}.. {278431200 49500 1 +1245}.. {289317600 45900 0 +1245}.. {309880800 49500 1 +1245}.. {320767200 45900 0 +1245}.. {341330400 49500 1 +1245}.. {352216800 45900 0 +1245}.. {372780000 49500 1 +1245}.. {384271200 45900 0 +1245}.. {404834400 49500 1 +1245}.. {415720800 45900 0 +1245}.. {436284000 49500 1 +1245}.. {447170400 45900 0 +1245}.. {467733600 49500 1 +1245}.. {478620000 45900 0 +1245}.. {499183200 49500 1 +1245}.. {510069600 45900 0 +1245}.. {530632800 49500 1 +1245}.. {541519200 45900 0 +1245}.. {56208

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Chuuk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.600179085934857
Encrypted:	false
SSDEEP:	6:SlSWB9eg/ZzSDm2OH9pvoHT1YoHvmdcXALEzvScHoVvXKnOjvScHb01Fy:MB86RGmdH9pvCT1YCvnXALEzHHIfKOjd
MD5:	AEC058BE796F1513F3DF3E545290D223
SHA1:	27D274974AC95B724A4BFDD65CB1B9DD92F73E3D
SHA-256:	492DF366BB0A7D29D2DB4A9C40CF0C15CB47343FF908D1AA86092C8E84E4434B
SHA-512:	E0924AB86E512AE1B800DEFA637F6B1743FF77F1FEFDC5068A7C30C1AC0BAC60F0D0351278866FD98A59D56BA2C56A1AFC1EBB4F14AAFE5D450085587B7C8F4A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Chuuk) {.. {-9223372036854775808 -49972 0 LMT}.. {-3944628428 36428 0 LMT}.. {-2177489228 36000 0 +10}.. {-1743674400 32400 0 +09}.. {-1606813200 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 36000 0 +10}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Easter

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8203
Entropy (8bit):	3.546693824302767
Encrypted:	false
SSDEEP:	96:QXn3AWkHkPp2YXaVU+PO/Un4n6MSmSmiTpk9eL6Z5waKkhWILTc:QXn3AWJB2m+PO/UnOSmSmS6ZaILg
MD5:	B8B2048F107528DEB4B04CB3E698A5BD
SHA1:	0E82DCB11A4553771760B8B0A748EC03F953D2FB
SHA-256:	84B815988D1A5AC16F3EC52844BDCE7A8E8707800C782235B5928473EEF9B433
SHA-512:	511E3C51B4016641146D21264C031151F2CE9F916F0D97C47D623B66F6244BA9243108179C786B63B8B71F77885B916AC6D18C10CFA1001290019CE6B73278D9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Easter) {.. {-9223372036854775808 -26248 0 LMT}.. {-2524495352 -26248 0 EMT}.. {-1178124152 -25200 0 -07}.. {-36619200 -21600 1 -07}.. {-23922000 -25200 0 -07}.. {-3355200 -21600 1 -07}.. {7527600 -25200 0 -07}.. {24465600 -21600 1 -07}.. {37767600 -25200 0 -07}.. {55915200 -21600 1 -07}.. {69217200 -25200 0 -07}.. {87969600 -21600 1 -07}.. {100666800 -25200 0 -07}.. {118209600 -21600 1 -07}.. {132116400 -25200 0 -07}.. {150868800 -21600 1 -07}.. {163566000 -25200 0 -07}.. {182318400 -21600 1 -07}.. {195620400 -25200 0 -07}.. {213768000 -21600 1 -07}.. {227070000 -25200 0 -07}.. {245217600 -21600 1 -07}.. {258519600 -25200 0 -07}.. {277272000 -21600 1 -07}.. {289969200 -25200 0 -07}.. {308721600 -21600 1 -07}.. {321418800 -25200 0 -07}.. {340171200 -21600 1 -07}.. {353473200 -25200 0 -07}.. {371620800 -21600 1 -07}.. {384922800

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Efate

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	789
Entropy (8bit):	4.0457106900970325
Encrypted:	false
SSDEEP:	12:MB86HmdH6mvCON3Xj/kw2eX/xtDedjX24ots0FX2ud5KRGkpFxy:uegazZBzCdXUFQzy
MD5:	6841B8A2FB9BBF464AA00088CBDCEC80
SHA1:	26CC5CCE00A765F8B6493ED24F50957AA7F0089B
SHA-256:	332372E5EFB46123FBB66F9F32F91B59EBD88ADB956249DB3F14CAAB01CE2655
SHA-512:	A6C67A0F7361E599369597E9A8A52FC7D5C96DE6B5A7C1BE1D02F5DF11051F448289786C7F0E82E71CDEB825215E64E072CF034C45D6E2F822D7201AB8B41B57
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Efate) {.. {-9223372036854775808 40396 0 LMT}.. {-1829387596 39600 0 +11}.. {125409600 43200 1 +11}.. {133876800 39600 0 +11}.. {433256400 43200 1 +11}.. {448977600 39600 0 +11}.. {464706000 43200 1 +11}.. {480427200 39600 0 +11}.. {496760400 43200 1 +11}.. {511876800 39600 0 +11}.. {528210000 43200 1 +11}.. {543931200 39600 0 +11}.. {559659600 43200 1 +11}.. {575380800 39600 0 +11}.. {591109200 43200 1 +11}.. {606830400 39600 0 +11}.. {622558800 43200 1 +11}.. {638280000 39600 0 +11}.. {654008400 43200 1 +11}.. {669729600 39600 0 +11}.. {686062800 43200 1 +11}.. {696340800 39600 0 +11}.. {719931600 43200 1 +11}.. {727790400 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Enderbury

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.82787610497142
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG11avXHAIgObT11ORL/nUDH7/UDH11B:SlSWB9vsM3yckHAIgObON/h
MD5:	CD1AC50AADC3CF9C0E7A055D587E790D
SHA1:	BEE0E16D3954DF33C697DEA469A130BD9875AB8B
SHA-256:	790E6B48B261D6DEF7D183CC8F38FB8D8A6E3EFB8844281EFABB2DFD621E53B5
SHA-512:	B6A93DFB4CBE2F35268AACA88FDCC4D19949A2E8DC9464D8341C38065C6FF48A3C49FE756FFCE777C8F806DE309C8AFC4CE4BC4ABD183C28808F995A0F89B091
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Kanton)]} {.. LoadTimeZoneFile Pacific/Kanton..}..set TZData(:Pacific/Enderbury) $TZData(:Pacific/Kanton)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Fakaofo

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.913439535905759
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDH4ErKYofMXGm2OH18VkeoHvmUENBBy/aCPFVFv7Dy:SlSWB9eg/BE3ofDm2OH1VeoHvmH7y/Fy
MD5:	6250F332356787613A2D1853EF6D1AC3
SHA1:	0464B9EE8B691990022295D2DEFE1AAE4B247E63
SHA-256:	336058DCA4802C79ED43F6177ADB73085D4FA0754B94051CAE2A19346B0C4904
SHA-512:	B8FAB5E128D2EF3CB7050DA717D80247045BE09F7F6542AA154CB85F4A56884F195EE2776421890A3F86D133106DCA4672D7D9329E0DE6F4A7CF8F4030822988
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Fakaofo) {.. {-9223372036854775808 -41096 0 LMT}.. {-2177411704 -39600 0 -11}.. {1325242800 46800 0 +13}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Fiji

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5636
Entropy (8bit):	3.637086785452708
Encrypted:	false
SSDEEP:	96:9QdCQvGPccyGqjXKZ2luR7oVqqJZozv88s2:Wd9vGPfyGi6Z2opCs
MD5:	D2A17937A99B50B3BCD50F8C10520B56
SHA1:	A27681C6EC2B4625262359E5ADFEA09CAB58FAFC
SHA-256:	A29FAAEE67BC07F5DF858DAC070F03E45E29B67A5F9DE6DD992E79A9601979B7
SHA-512:	A16F96B17E7221A9C60EF506D7ABFE806304AAAB8C64A69E340E9960BEB64C7334931CD6FBBA5F22A1A3BFFE55690BDF04E60852E516CB3048EE34AC3EAB16CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Fiji) {.. {-9223372036854775808 42944 0 LMT}.. {-1709985344 43200 0 +12}.. {909842400 46800 1 +12}.. {920124000 43200 0 +12}.. {941896800 46800 1 +12}.. {951573600 43200 0 +12}.. {1259416800 46800 1 +12}.. {1269698400 43200 0 +12}.. {1287842400 46800 1 +12}.. {1299333600 43200 0 +12}.. {1319292000 46800 1 +12}.. {1327154400 43200 0 +12}.. {1350741600 46800 1 +12}.. {1358604000 43200 0 +12}.. {1382796000 46800 1 +12}.. {1390050000 43200 0 +12}.. {1414850400 46800 1 +12}.. {1421503200 43200 0 +12}.. {1446300000 46800 1 +12}.. {1452952800 43200 0 +12}.. {1478354400 46800 1 +12}.. {1484402400 43200 0 +12}.. {1509804000 46800 1 +12}.. {1515852000 43200 0 +12}.. {1541253600 46800 1 +12}.. {1547301600 43200 0 +12}.. {1573308000 46800 1 +12}.. {1578751200 43200 0 +12}.. {1608386400 46800 1 +12}.. {1610805600 43200 0 +12}.. {1668261600 4

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Funafuti

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.018668544746349
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDH4QwyFPMXGm2OHwodGeoHvmcpXrWXVN0UIoAov:SlSWB9eg/BCPDm2OHwxeoHvmgSX0YAov
MD5:	C1547FDC362DA1162FE7B53BC16AEA87
SHA1:	3249423B61C42E6CE54A77BACA0A8FDFD2594CF9
SHA-256:	B2ACF1461318A0B21653B6F21DE5E54651A417A469AAD0DBF8099626040BEB51
SHA-512:	76D0F4489CCB32A8CDCA5151E086E93A0199C6FF5066DD73F873F103F7592BFE4A3765BC862246817C2F0CA7F33B02EF40E5A3C9CF461A07D9AF03F623FC08FB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Funafuti) {.. {-9223372036854775808 43012 0 LMT}.. {-2177495812 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Galapagos

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	247
Entropy (8bit):	4.687336389955113
Encrypted:	false
SSDEEP:	6:SlSWB9eg/fEGDm2OHvQYeoHTie7KVQRncRvinrN5/uFifriX:MB86fhmdH0CTV7OcdrN5/uFiGX
MD5:	0557D164DCD8DF5D99F7AF5A2AB1AD4F
SHA1:	68AFD04303E5F541480425405D82E1827F78A8DF
SHA-256:	192545659F971084ADC8489A2B96A6439FF391599DC962AA13375ACCFB3C09D9
SHA-512:	1DA004E51F8E7A712EDE920CBB62E81F9F55450FB52B62F78F1CD4F8F4E342B4DAB2C28AA5161E8B24942A7A5BD55F978AFDA1C5E1949241E71D738079DEF9B8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Galapagos) {.. {-9223372036854775808 -21504 0 LMT}.. {-1230746496 -18000 0 -05}.. {504939600 -21600 0 -06}.. {722930400 -18000 1 -06}.. {728888400 -21600 0 -06}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Gambier

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.976931060677737
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDH5hBYfMXGm2OHKToxYoHsdNfis:SlSWB9eg/DDm2OHPxYoH4qs
MD5:	45330CE0FA604304C6ACF8EF8CAF51EC
SHA1:	20EEF9646996C2EC9B2641EBCCBE4766BF38B17B
SHA-256:	190E02A0C00D165FA45C73AEF9C0D6C82B1720E7406E5610DD860AED10A021A5
SHA-512:	51C7931B503405DA0B4078F6BE411895DD00E86AC7C5BE475030664D5302AD614293541DEE7FFC3D86A9DDB1BDA32BCAA746CF1D207DB063FBA2F9E9BE12836C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Gambier) {.. {-9223372036854775808 -32388 0 LMT}.. {-1806678012 -32400 0 -09}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Guadalcanal

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.9796189407775255
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDH5RyJTLJ5FNMXGm2OHddHvpoxYoHsdMWdHPVtyn:SlSWB9eg/LJHjXDm2OHdFGxYoHgHPLy
MD5:	DF09960360D8CEDCA2A4DC19A177C4A6
SHA1:	9F73F271B8C85B25FE6392B8BF7465C92EFFE621
SHA-256:	161762334DFF48B1D58824911E1FF4171386EA18234DD3DD5B0798515593086A
SHA-512:	1BE9E0F90DA529C99E317F399BFDB913A076651CF8801A1849247B26A350A76D8B5807AB139F3DBB97790DDFC332BDBEB57B364BF67FA2BB440AFEDC4130A648
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Guadalcanal) {.. {-9223372036854775808 38388 0 LMT}.. {-1806748788 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Guam

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.244282318063802
Encrypted:	false
SSDEEP:	12:MB862mdHanCTCtBCv1yWQkHHLTaWJ+x+87W0x+8+yWSi+JW7+sWU0dwaW1j+FaW2:FeaC2twvY3knLGs+I87p+8d9i+J7s70c
MD5:	BA319E451BE323C852A8ABFC299DDA28
SHA1:	FC9314C162FF1FE1ED5E2C5DF962A55D4D6D8115
SHA-256:	42CB69ABC83415F63CA7D2A3E5314A41817AEE3206ECCC7172C50A74B1597DB0
SHA-512:	3BF733B9ED2A57B01BE173A8421B2D5A45888A230461EA0BD8C5B4AC7DC010BB527346731196141C70AFECDF88DD47AFE48636243DFC395D88E58231BEDF7D2A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Guam) {.. {-9223372036854775808 -51660 0 LMT}.. {-3944626740 34740 0 LMT}.. {-2177487540 36000 0 GST}.. {-885549600 32400 0 +09}.. {-802256400 36000 0 GST}.. {-331891200 39600 1 GDT}.. {-281610000 36000 0 GST}.. {-73728000 39600 1 GDT}.. {-29415540 36000 0 GST}.. {-16704000 39600 1 GDT}.. {-10659600 36000 0 GST}.. {9907200 39600 1 GDT}.. {21394800 36000 0 GST}.. {41356800 39600 1 GDT}.. {52844400 36000 0 GST}.. {124819200 39600 1 GDT}.. {130863600 36000 0 GST}.. {201888000 39600 1 GDT}.. {209487660 36000 0 GST}.. {230659200 39600 1 GDT}.. {241542000 36000 0 GST}.. {977493600 36000 0 ChST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Honolulu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	344
Entropy (8bit):	4.640604617840767
Encrypted:	false
SSDEEP:	6:SlSWB9eg/PeDDm2OHsVVoHvBrai3UNFv+rUXaWFvAHovj/0nvCv7p+v:MB86WXmdH0VCvBz0GOTA0/0y74v
MD5:	F3F0E64655FAA79E40860765EEBB5B77
SHA1:	7F6C2FC100AEABC26B7205AB53C1E016B12E4D60
SHA-256:	69319015799D32D3CF7C0A3E9991B4B1F3E0C5D1B4FBF400517350CCA9D2C3B7
SHA-512:	7C9238BCCB13B90D4DC9B5E776C421A42C25D21B4E026406F57FA1E70983E8F6BF1CE927AB9D0D6261C5C1802A8B810399F506915262F82F487417CFD704B2F1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Honolulu) {.. {-9223372036854775808 -37886 0 LMT}.. {-2334101314 -37800 0 HST}.. {-1157283000 -34200 1 HDT}.. {-1155436200 -34200 0 HST}.. {-880201800 -34200 1 HWT}.. {-769395600 -34200 1 HPT}.. {-765376200 -37800 0 HST}.. {-712150200 -36000 0 HST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Johnston

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.844454917943834
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3yc6e8SHAIgOb6eKAN/NWyVheo:MByMdniinbtNWzo
MD5:	4244078A03C2493009EF2F6BDA2F326F
SHA1:	AC2FF3E91A8831A479B33DF32A0118BC2EB255D0
SHA-256:	6E52B361AC8A6A578C709F6D58AA7535F06C0CB1707081C2D5A63FA8545D955C
SHA-512:	398B32E0FAF80E40DF3ACD203DF380D61DC39322F0BA0388A18281BC26973945F45683A104B9A785BB9DF5E514322F6994F934289E4B56B7982F94D4528D4272
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:Pacific/Johnston) $TZData(:Pacific/Honolulu)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Kanton

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.669308556946547
Encrypted:	false
SSDEEP:	6:SlSWB9eg/KyXDm2OHEMmzQwXy29BVyv7y/fTVVFty:MB86KyTmdHEZzQUBVyDy/fZvty
MD5:	544A0A83241333805192A6F03888E359
SHA1:	99D2BE79D57B44BD538386F9E7551C9E1874D7E3
SHA-256:	0B1345555EC2B4738CC4DEBFE496C287966F238386263032FF1E27912CCBFBA6
SHA-512:	61C91265632D01FBB7F4C739368756C428258FA6C141E49E88B6C78ABEA6150A74B8DFCF14C5AADDA03C1EA6F04D122734654495C26B8614561786B1C5C7EF10
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kanton) {.. {-9223372036854775808 0 0 -00}.. {-1020470400 -43200 0 -12}.. {307627200 -39600 0 -11}.. {788871600 46800 0 +13}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Kiritimati

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.739672105601744
Encrypted:	false
SSDEEP:	6:SlSWB9eg/iSDm2OHjkeoHvmLVFFz4YWXfSzvjNv:MB86iGmdHpCvU4VfSbxv
MD5:	1B695BBB9C50F6AFC05F67DE30374160
SHA1:	08AD8BBB6C99EB36FC3E462DB41C6896F52F150C
SHA-256:	4F7235B956A5A01676BE05275E086D5157EBC24FD91022E87817020669F915F7
SHA-512:	DC35CB1C2E5E035A82F91D1B1F4B48D7B112D9B7A1A7DB9C4A4C42C4D58002E1ECD9D24B2EA5B624DBB526ADDF9A8AB37D4315843207C34C16B2EFE33A254752
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kiritimati) {.. {-9223372036854775808 -37760 0 LMT}.. {-2177415040 -38400 0 -1040}.. {307622400 -36000 0 -10}.. {788868000 50400 0 +14}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Kosrae

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	394
Entropy (8bit):	4.441317927120857
Encrypted:	false
SSDEEP:	12:MB869nmdHlCTvrvCvKcHwzHHI/HKOjHHwZaLYkcy:2ecrrqvGznISknwZaLxcy
MD5:	B489D7BDE8EB805B2A24726A6FB0C441
SHA1:	7997A33AA56857EC52B1198DBEF4CE1DB50D69FD
SHA-256:	B528E5E712E5F878603183E7CCFF55E5DB97CB47D7628BCB635342796317B899
SHA-512:	4898AC2747FB8620BE29933CC7AA344AF1A3B7777D1AFF08BB4C6CE6E7AF205581937CCB488F3CB39CC8CA7FB42EDC8E1CAD8BADC9FCA40E3CAD23271CD66FCB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kosrae) {.. {-9223372036854775808 -47284 0 LMT}.. {-3944631116 39116 0 LMT}.. {-2177491916 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 39600 0 +11}.. {-7988400 43200 0 +12}.. {915105600 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Kwajalein

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.5947337310364835
Encrypted:	false
SSDEEP:	6:SlSWB9eg/yEyDm2OH4T2eoHvmfKnOjvScHrkL/Xy2185k0YAov:MB86XmmdHWCv6KOjHHgLN8tby
MD5:	7D1FC9913941693ACBD6A3CCB2F34555
SHA1:	D07C8AAED1DF9614BCA6EEF0F72FB98BE46CF5EF
SHA-256:	38133BE70100D7DC244A680827879E6B240646C7C0B68F58652051E681A71985
SHA-512:	419F0A1D1D71C8F84765C7B54271D7EFD6A81F428751523A214ABB24A8770DD5A7666F634A20AF97D5AAB8F21C0DEF23DCDE068CF4C1CCC7639ABC43864A9DBC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Kwajalein) {.. {-9223372036854775808 40160 0 LMT}.. {-2177492960 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-817462800 39600 0 +11}.. {-7988400 -43200 0 -12}.. {745934400 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Majuro

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	333
Entropy (8bit):	4.49621343701744
Encrypted:	false
SSDEEP:	6:SlSWB9eg/QpDm2OHyexYoHvmf/aHwzvScHoVv3HKnOjvScHr8e0LYX0YAov:MB86cmdHyuYCvMiHwzHHI/HKOjHHYe0I
MD5:	CA7ED52987F13BA6A3043C324F72C3D0
SHA1:	F5798473DB3A9AA588E5F0D772AD2145A90DE707
SHA-256:	67EA1A2A84E0FA686C04EF327E7EEACCC15E21BED79A801E64BB57FE4184509A
SHA-512:	4EA25564E1430615D0FE75319B3CFC88E3FB7BCE026B4C59842FC513CBE7BFF3AD39CC283ED88DD7292DFE8185ACECD5E1ED0D5997F27082F3F6B2D1317D86C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Majuro) {.. {-9223372036854775808 41088 0 LMT}.. {-2177493888 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-818067600 39600 0 +11}.. {-7988400 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Marquesas

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.976348164850869
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHzrHeWNMXGm2OHOx5oHsdNpNFvvIVVFvYy:SlSWB9eg/cHeSDm2OHOnoH4/FvQVVFAy
MD5:	80CB45F42BAB1AA72CD7C7BC394DF3F8
SHA1:	8B5ED2BCCA1AEB41F22AFD14F46533959828B2BE
SHA-256:	AE0B5055C6E57516F23749B13681205EAD376E682959716A457B1377AF8160BA
SHA-512:	71562E340B7A96B91D04FCBCAF71B66EA725CA1BD1094343C4442F8F9A8C67A3BE378034849197407D21C3EE74E2C753B1FD3BAFF2378714B993AD9336236A0E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Marquesas) {.. {-9223372036854775808 -33480 0 LMT}.. {-1806676920 -34200 0 -0930}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Midway

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.81307101485774
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/nUDHz0HvUDHurKv:SlSWB9vsM3yciemHAIgObiecN/Zevn
MD5:	13CE48F8FF74BFCEFCB8D217D6357E38
SHA1:	296D31E3F868934C6EB34BF1BF4C23F3E1839294
SHA-256:	F62C6A2DEC1E9EC78115D5F14E5B9DB7C86F788662D2E68F7E6714F4A05DC974
SHA-512:	778813FC08EF803743F392000BECE73C1C079883DAFC26FAC0AF8FA3FA4AE1D94BA8F3CAA5E82DD4DB1A5F12AD49E123901908F5483E0E325952622AB4C4A26A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:Pacific/Midway) $TZData(:Pacific/Pago_Pago)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Nauru

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.702705620563736
Encrypted:	false
SSDEEP:	6:SlSWB9eg/JdDm2OHceoHx6sCH/ZdqvScH9cd0YAov:MB86J5mdH9CMhcHHauby
MD5:	30A8285FCCE2E98889E53DF60B906C3D
SHA1:	C7789CB11A2C8FE3861FF3C0A7A41F6CAFD87631
SHA-256:	22C367F3219B5FC736260D9DBFEF5FCB767F1A6BDA991C9352F790A3D1FFE884
SHA-512:	02DA82680588839B06F820979AECC78B7FBEAB9D6D49176B513B80F1C8BA2D55FB3674B19EFDD574EE6FC01539EF7C3081A4B34D14A54DACF367D816B62E5843
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Nauru) {.. {-9223372036854775808 40060 0 LMT}.. {-1545131260 41400 0 +1130}.. {-862918200 32400 0 +09}.. {-767350800 41400 0 +1130}.. {287418600 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Niue

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.846897598147338
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHwMQA3WNMXGm2OH0SNoHoRWVGXyOyovFaSUGFAZvBByV:SlSWB9eg/Jm3SDm2OHJoHFGXCodZUGFd
MD5:	6E8EC957423917AE7A7EF503661C1A77
SHA1:	B4FA3C3E3F96C28B7DB87BFD441D2EE99CC81B6F
SHA-256:	869CCA656BE88E4E7481C75737C3656BAB6924AD1751505815AC719C59269842
SHA-512:	9047ABE673259699C7A548BC7B5636DD646DD382C751B796522F65404162AB1B0BB022FD274653921E5B23C847EE248AEF6749E15ED2CFC1DCE35BBA294D8251
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Niue) {.. {-9223372036854775808 -40780 0 LMT}.. {-543069620 -40800 0 -1120}.. {-173623200 -39600 0 -11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Norfolk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	3.65794255179185
Encrypted:	false
SSDEEP:	48:K/yg8hZbeS07HbbYTqge+gDrWnAxhejtB0e+Pwn1UVimqNQrKvyXrStkCDv:K/y7hNeS07sq0Erk10lINQrKvyXrwv
MD5:	E19700A894AA64715D14F501D8D2FA98
SHA1:	57CFC96E2EBB985720DB290F59181860AF2AC1AA
SHA-256:	5D16C3EF1DB996C1B8E33AD884C33946F77DA872F35F41EC3BD5B288F43CC9AF
SHA-512:	E11EAF2A7B217CDBEECB57635184F04171F0DB088FCC4702AA8D40A3A5453904592F5869849913E2EB02DC5941C84203A76D270E8930B0B691A3B9C39B78BF30
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Norfolk) {.. {-9223372036854775808 40312 0 LMT}.. {-2177493112 40320 0 +1112}.. {-599656320 41400 0 +1130}.. {152029800 45000 1 +1230}.. {162916200 41400 0 +1130}.. {1443882600 39600 0 +11}.. {1561899600 39600 0 +12}.. {1570287600 43200 1 +12}.. {1586012400 39600 0 +12}.. {1601737200 43200 1 +12}.. {1617462000 39600 0 +12}.. {1633186800 43200 1 +12}.. {1648911600 39600 0 +12}.. {1664636400 43200 1 +12}.. {1680361200 39600 0 +12}.. {1696086000 43200 1 +12}.. {1712415600 39600 0 +12}.. {1728140400 43200 1 +12}.. {1743865200 39600 0 +12}.. {1759590000 43200 1 +12}.. {1775314800 39600 0 +12}.. {1791039600 43200 1 +12}.. {1806764400 39600 0 +12}.. {1822489200 43200 1 +12}.. {1838214000 39600 0 +12}.. {1853938800 43200 1 +12}.. {1869663600 39600 0 +12}.. {1885993200 43200 1 +12}.. {1901718000 39600 0 +12}.. {1917442800 43200 1 +12}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Noumea

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	326
Entropy (8bit):	4.531117764974758
Encrypted:	false
SSDEEP:	6:SlSWB9eg/JcSDm2OHTYoHgnX2czO/FxgV62JFy:MB86JcGmdHTYCgX2czUjgM2ny
MD5:	2F1E92A11DF44C72DC305C13111DEA35
SHA1:	847F551C3D6C75CD2D0D6D87FCF3294CA8DD90B2
SHA-256:	238683C027D2319C33D975A837E9FC9D24DD53B1A67108EDBF7ABDF0DB050881
SHA-512:	E35D8C71AFDBB9A7507E873925001AEDE3734B1D235F509D19952E85279CBCC233A73412EA1F79CB534A45D36FEAA8AFDA98D9964DC93C7892B318F4AFC9A076
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Noumea) {.. {-9223372036854775808 39948 0 LMT}.. {-1829387148 39600 0 +11}.. {250002000 43200 1 +11}.. {257342400 39600 0 +11}.. {281451600 43200 1 +11}.. {288878400 39600 0 +11}.. {849366000 43200 1 +11}.. {857228400 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Pago_Pago

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.985607855830399
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHurKeTFfXMXGm2OH2ivkeoHvUPi1TsYoHsdfWTVvvVFv:SlSWB9eg/XecDm2OH23eoHvWieYoHiWB
MD5:	E86D90DAA694B0EAC42F8C01346BC95B
SHA1:	CD29DEFC291C939296E86DC7EF5D0654D85285E8
SHA-256:	CCA96640AB3BC707224FA86D9AF66F9D53A204A97B370B2785BA8208688BF8B6
SHA-512:	937BA420061E3781F831779B458E914A0FC465C4B41796F8B7CB1E548822F5777A6450FC6002AB13EBC5C9F54E374D3ED731D05B2B302B95359BE34094E5062B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pago_Pago) {.. {-9223372036854775808 45432 0 LMT}.. {-2445424632 -40968 0 LMT}.. {-1861879032 -39600 0 SST}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Palau

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.919381181565273
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHugEZF3fMXGm2OHKvkeoHucRbgnJnoHvmdQ4+vScFAy:SlSWB9eg/Xg2PDm2OHK8eoHTWJnoHvmi
MD5:	2E6C7EC61C7E29A147475C223B163F6B
SHA1:	3A98D3441335224E7EBC0648990BCA1DE3BDF5C6
SHA-256:	97DE6C2C717BFEAD00F83B5D39D654C32CEE580226F5F084484EBAD57BBCE7FF
SHA-512:	5868C43966DDEBA8EC4BBBB29CDFDDFF0C7B01FD4D579FF655F3363029059F969B39C9221190672B6A2F7938583594AA0B103FC2A7ED573E2BC1C3A1623DE8DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Palau) {.. {-9223372036854775808 -54124 0 LMT}.. {-3944624276 32276 0 LMT}.. {-2177485076 32400 0 +09}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Pitcairn

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.809907977056877
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHuQTWLMbNMXGm2OHUVFvoHvmXUlgloWkcyf/vGpn:SlSWB9eg/XQyLMJDm2OHUVVoHvmXUKm2
MD5:	3F4987676F9C461895EDF9985AD22E06
SHA1:	A96E470209010B837EF5BB3AC93BAE74BF2CCF64
SHA-256:	5D363729A986E24C79F4B817CC88D2B22ACCCE3ADD20138D51C4422C4297AD6F
SHA-512:	988FB98EFD3F57F5D66A932CC6B9D0387E9B0951FC590E08DAF19ACF5E4F39BC1B25265F16E14930BCF394902F5F0EF507E0E91C98902DFB10FA16D716091AB0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pitcairn) {.. {-9223372036854775808 -31220 0 LMT}.. {-2177421580 -30600 0 -0830}.. {893665800 -28800 0 -08}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Pohnpei

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	338
Entropy (8bit):	4.55704384204571
Encrypted:	false
SSDEEP:	6:SlSWB9eg/XyiDm2OHANgYoHT6WKNoHvmScHwzvScHoVv3HKnOjvScHb0Zzy:MB86C2mdH1YCT61NCvfcHwzHHI/HKOjX
MD5:	497B7BE4CE7A51C19CE7D4DDC3109281
SHA1:	5ED794E3B95A99CF1B9520174A15396A3A8ADF28
SHA-256:	88D62B644BB96A9318427B4CA56DB37C8217DA449328C801ED77007BE9420F9C
SHA-512:	2E0898F7135E1634298BD5DE73F129433F9DA47E6F08E5A58D83A4DF4F6FC0F54B6FC2660B0EE4C13561A925841B160B893D4A21A0622125D2E3DC66883C5080
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Pohnpei) {.. {-9223372036854775808 -48428 0 LMT}.. {-3944629972 37972 0 LMT}.. {-2177490772 39600 0 +11}.. {-1743678000 32400 0 +09}.. {-1606813200 39600 0 +11}.. {-1041418800 36000 0 +10}.. {-907408800 32400 0 +09}.. {-770634000 39600 0 +11}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Ponape

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.786230343954939
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQGuySeyXHAIgObTuyoAFARL/nUDHu3HppUDHuyB:SlSWB9vsM3yciySeSHAIgObiyJAN/X3y
MD5:	D32F290A7020C13D7A130A0548112B02
SHA1:	314877B3C316D7BD9962DE18A9D57A59556E0D95
SHA-256:	EDC43EF78691A1B22D111BC4390EA442B893E61771A6FD76BDAE1D46C5904C0C
SHA-512:	9054C22EA382CACE946FE08F0118E2A4120DE4FF1F3FA908869E4BFA20D2DF8AED0DD5F169871BD09743563639F6E24C7DB8BBFB3A7268DE15DB7CCAFE622192
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pohnpei)]} {.. LoadTimeZoneFile Pacific/Pohnpei..}..set TZData(:Pacific/Ponape) $TZData(:Pacific/Pohnpei)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Port_Moresby

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.945354510868153
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHuwKXI3SMXGm2OHwdvoHvZUeQTnoo3v/vnqMVVMUMy:SlSWB9eg/X/43SDm2OHwdvoHvZZQTnoQ
MD5:	2CFB7C2A3D26D7AF0F6AE32ADD81C364
SHA1:	80C96E50D23A9A9531E4EE33744CF445C054B901
SHA-256:	124C137B091D9D54D5E0579131485428FAAE040ACC978D20D6A8C8E4DE9889AA
SHA-512:	A215FF5A69BD3E786BD3F8C952C8593396402EFA85005F5342093028617A6862EAE8BFD7B6D5737F90D90897AB62CF785544A4157A222AE4D0F70797FFBEC2CB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Port_Moresby) {.. {-9223372036854775808 35320 0 LMT}.. {-2840176120 35312 0 PMMT}.. {-2366790512 36000 0 +10}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Rarotonga

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	969
Entropy (8bit):	3.943959457262612
Encrypted:	false
SSDEEP:	12:MB86VrjmdHI5Cvn9HCFkN00hjNFq++UE+q0hwA+A7VxVnDEFn:IeZv8w0MNFq+xE+uAtx1c
MD5:	64AD3A103F4D145C48484BF8FACF41C2
SHA1:	40C00CFA56C87E506C254A93A164D7227DFF3BD5
SHA-256:	5AB006A686E564E30C94884FF8A9D728AEC74681DA8772E9722B6FE203630B5D
SHA-512:	D1088C3B673B5456A8706B69BE4D7AB18615EE53A82BF4ABE76E86700837E6BAD0BD79C13EDA9B04776B08A95B835BA755AA565F86E45BFE507E8783896C1EE2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Rarotonga) {.. {-9223372036854775808 48056 0 LMT}.. {-2209555256 -38344 0 LMT}.. {-543072056 -37800 0 -1030}.. {279714600 -34200 0 -10}.. {289387800 -36000 0 -10}.. {309952800 -34200 1 -10}.. {320837400 -36000 0 -10}.. {341402400 -34200 1 -10}.. {352287000 -36000 0 -10}.. {372852000 -34200 1 -10}.. {384341400 -36000 0 -10}.. {404906400 -34200 1 -10}.. {415791000 -36000 0 -10}.. {436356000 -34200 1 -10}.. {447240600 -36000 0 -10}.. {467805600 -34200 1 -10}.. {478690200 -36000 0 -10}.. {499255200 -34200 1 -10}.. {510139800 -36000 0 -10}.. {530704800 -34200 1 -10}.. {541589400 -36000 0 -10}.. {562154400 -34200 1 -10}.. {573643800 -36000 0 -10}.. {594208800 -34200 1 -10}.. {605093400 -36000 0 -10}.. {625658400 -34200 1 -10}.. {636543000 -36000 0 -10}.. {657108000 -34200 1 -10}.. {667992600 -36000 0 -10}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Saipan

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.854594370903023
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG5RFeyXHAIgObT5RV5RL/nUDHtluKpUDH5Rgn:SlSWB9vsM3ycdeSHAIgOb7N/vKbn
MD5:	EFC985F07B24BEDA22993C9D0EA7E022
SHA1:	6D05D12925621F1D05999A5DCC81B8C6F4D18945
SHA-256:	4F6A1C20A11E186012466091CD4B3C09D89D35E7560F93874DEC2D7F99365589
SHA-512:	5FB4D8784D2EB8AEF660D6CBC7C403561EE5874BEC0439762F3688C64830B52B1F557B467CA65B64B1210E82F385E134BF676F3CA443FB480702A2C90B3C3757
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Guam)]} {.. LoadTimeZoneFile Pacific/Guam..}..set TZData(:Pacific/Saipan) $TZData(:Pacific/Guam)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Samoa

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.78073436515702
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQGurKeTnXHAIgObTurKefVHRL/nUDHthA5nUDHurK:SlSWB9vsM3yciemHAIgObiecN/NXevn
MD5:	8E335F5D0A2082BB673E7FEB56167A89
SHA1:	EF37235922D4477AC9B3D9576888CDE41E700741
SHA-256:	98D06302EFC18FAD7751F7E5A059FE4ABAFBC361FDC365FE1EB576209D92C658
SHA-512:	2572D99EE8BAF264B8A2EF3D7647D33A387EE83E036F9E7BDB21F64C2FCB43317AF9C899C8CDD822A2A5A207EF17504E71B217370473ED95AE925BBA2CFA90F9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pago_Pago)]} {.. LoadTimeZoneFile Pacific/Pago_Pago..}..set TZData(:Pacific/Samoa) $TZData(:Pacific/Pago_Pago)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Tahiti

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.946903999617555
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHqhFPMXGm2OHl/oeoHsdNqRU7vV:SlSWB9eg/TTPDm2OHloeoH4qRW9
MD5:	341B0F535043051A91A21297BFA39DC0
SHA1:	6AD9177FC237503E6D36DE5408790A68D5D36E2C
SHA-256:	440A87DDB4F304DCBEAED1B0DE8F6058840E597918B688E0782F584DA03B1BBC
SHA-512:	D97D399A0F1B4347F8AE5F15E43A8787697339AB0EFB4E1106C790528FFC529ADC5B44B231D95449D39DB464D84A5DDF7B61E7D190E3E2B0091D1EC204B530A2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tahiti) {.. {-9223372036854775808 -35896 0 LMT}.. {-1806674504 -36000 0 -10}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Tarawa

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.969953728206455
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHqQ3fMXGm2OHyyFpoeoHvmciRrWFN0UIoAov:SlSWB9eg/T+Dm2OHyyFGeoHvmbu0YAov
MD5:	AA67FBBB6A02F5B30486C54E3A5C11D7
SHA1:	C64FD3654A47A0ECDD681B8A4D9B621AC6D97DBE
SHA-256:	91AA5DA8D5D1E72B1F561D0AEAB4B07E02EDD4EB95AE8C9F1C503C820460599F
SHA-512:	FC170904098011C091622A263CA554CEE952D64888D3573EB324E0A262E1A0C0885C059429F0FFF9219FEB8F1B6B97EC34661DD8DD547124D0C6C0A1C8EE24B7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tarawa) {.. {-9223372036854775808 41524 0 LMT}.. {-2177494324 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Tongatapu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	451
Entropy (8bit):	4.343299747430587
Encrypted:	false
SSDEEP:	12:MB86PmdHmCdC/V7XZXw8Ut2rbUtGiAUtb4bUtqVy:iemn/VbKeOSy
MD5:	87CFDA2399A8126117E5BFC018B06518
SHA1:	6291611BCFB34293F9C20BA77170A13C1502C2ED
SHA-256:	ECC9D2E7AD7B5E5D6599CF442941595C99C4D69E802A4DDB4DA321898CDDE91D
SHA-512:	846FE07FEB82EC5F87FAE137D23074934246DBB7C7EE30F44F6C5373183B5FD2211B58E5CF1AB9A47938D282CA322FBDE80B58054FE6517CDC549992439F19A8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Tongatapu) {.. {-9223372036854775808 44352 0 LMT}.. {-767189952 44400 0 +1220}.. {-284041200 46800 0 +13}.. {915102000 46800 0 +13}.. {939214800 50400 1 +13}.. {953384400 46800 0 +13}.. {973342800 50400 1 +13}.. {980596800 46800 0 +13}.. {1004792400 50400 1 +13}.. {1012046400 46800 0 +13}.. {1478350800 50400 1 +13}.. {1484398800 46800 0 +13}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Truk

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.913386161054243
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG9CoveyXHAIgObT9CuYFARL/nUDHqAOsvUDH9Coy:SlSWB9vsM3yckGeSHAIgObkXFAN/TAO2
MD5:	643A77CAA5D7E031418C150A2D114BC4
SHA1:	BE00B59D7AEB6AAB871D87A1C6243233833C4539
SHA-256:	BDD8C779AF9D671AD7F20832FFF8EB3B25C9989A619C23337743F112FF4C8764
SHA-512:	1CC7BFC35FB4FFE9517F0E6C9CA52E4FC71BFBA9E85F77773E490BCB3EF5F0C041E3C24A08A9A39F749161AB6F4027F703A254CF6158C1AC31E9CFBDBAAA2A45
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chuuk)]} {.. LoadTimeZoneFile Pacific/Chuuk..}..set TZData(:Pacific/Truk) $TZData(:Pacific/Chuuk)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Wake

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.981440234973766
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHpDFNMXGm2OH4VkxYoHvmcDVv0UIoAov:SlSWB9eg/8Dm2OHYkxYoHvmyv0YAov
MD5:	11F5DFD4F782517FAEFBB7D7FEF3CED6
SHA1:	B511E65FCB17E8910E347DE1C94B5BCF1A9A6081
SHA-256:	2D18D9AB10C9D8947A88D486D0BC0B0523049A2ED2CA2FBDFA0577E40F189D13
SHA-512:	0F72C4ACF54758B61ECC4584B86C0257178D0A82C98076C56B417DC4D0CB6743FD1D47E5DBC5EE9635E8297704C86F6841DB4704706C96F89F47D0CE55883230
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Wake) {.. {-9223372036854775808 39988 0 LMT}.. {-2177492788 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Wallis

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.977211872736631
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/nUDHpEYdNMXGm2OH3UPoHvmcCRQH0UIoAov:SlSWB9eg/tiDm2OHkPoHvmiH0YAov
MD5:	DA5CFD5BFC06355B732CAFB11B2BBBCA
SHA1:	5AA3838C8799CE33D261331971E42494E2A88041
SHA-256:	A3D83E6C504EAC75C4CD87B696F0DF2703D0A78DF27D8B1FAC161ACB07F2A9DE
SHA-512:	95444BDD838DAF8C4B70BFE0345C7437DF5E1FA8BF3C8E4AD43C3F9887B2B4A1885E8EDDBE5EF7306BEBFBF597A662603001A5EF4144F204A6EDAB9A5D671EC0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Pacific/Wallis) {.. {-9223372036854775808 44120 0 LMT}.. {-2177496920 43200 0 +12}..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Pacific\Yap

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.935135597072032
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG9CoveyXHAIgObT9CuYFARL/nUDHnHPUDH9Coy:SlSWB9vsM3yckGeSHAIgObkXFAN/eBl
MD5:	BF20184F9BBBE1E43490F93E97DA202D
SHA1:	D44B0A82DCE2131BDB52BFE70B8B59F412551B52
SHA-256:	E348A2D02966CF9599B5F6F1F5B6C3412113DEF548BD322F0C22376106E12D92
SHA-512:	C1BA813BB3F8628866C1042669051C2763FD2B13CA724CB91F0BEC0CF97D77FFF353157036C789D3589238D7FC013FB61248356CFB8D14C54D9EE525AF2D1331
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Chuuk)]} {.. LoadTimeZoneFile Pacific/Chuuk..}..set TZData(:Pacific/Yap) $TZData(:Pacific/Chuuk)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Poland

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.940195299412468
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVqEGIV5XHAIgoqpEGYvWARL/nSi67x/yQa0EGIy:SlSWB9vsM3ymc4HAIgocVAN/27x6qF
MD5:	E6AA2F6A05B57AA9B4AEF8E98552EEB2
SHA1:	22470C204152702D8826CA52299E942F572C85ED
SHA-256:	C27E1179B55BF0C7DB6F1C334C0C20C4AFA4DBB84DB6F46244B118F7EAB9C76E
SHA-512:	B28A264907C32F848D356FB0F5776C2CE819DCB6BC08A5E2DCD4FA455EE1616966E816748079C7A55485BABFFB292D567E6F958168F945889E33A267B0E7EDA9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Warsaw)]} {.. LoadTimeZoneFile Europe/Warsaw..}..set TZData(:Poland) $TZData(:Europe/Warsaw)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Portugal

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.9353841548970205
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxVxMvLS3vXHAIgoqyMvLL6RL/nM24h8QavMvLBn:SlSWB9vsM3ymvMv2PHAIgovMvH6N/e8i
MD5:	7D7BD6E40D3ADCA04754255D69B5CC9D
SHA1:	EE32167B450DE7B0F1A15199795AEF9524BE623B
SHA-256:	EFD666F3062D52C5D0B4F83B1A206E6840C1EAEC356CD77A0A71C7EDFA78C964
SHA-512:	6056AAF078316A89079D19555F0BAEFB4C1CDBAA5426A8BEE76E0BFA5C69A5DAAFD199DEF978ABD67287AE1B80F754B7845EAFD5CC0995FE10E44D1F34D5435C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Lisbon)]} {.. LoadTimeZoneFile Europe/Lisbon..}..set TZData(:Portugal) $TZData(:Europe/Lisbon)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\ROC

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.795776391333205
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8qMveyXHAIgNqBLFARL/lOr4WFKfMy:SlSWB9vsM3yKMveSHAIgcBJAN/S4wKfB
MD5:	C5AE3A1DAD32C870651C74E367F604CF
SHA1:	9FF81383C43D98441841E182BC783381EF565204
SHA-256:	9AEC39777013B23D63D0509EBB2F01D57A2C1592264DBB19CE2C61C7D7DDD8DE
SHA-512:	3A7217ED885011972262B71DB7F5D7E4C9C6E82B4BEEF0718BCB9452E49FDBDD5ED78564156577AB09150140B862E1944B4B739BCE0C50E63667050C35329503
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Taipei)]} {.. LoadTimeZoneFile Asia/Taipei..}..set TZData(:ROC) $TZData(:Asia/Taipei)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\ROK

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.900717350092823
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq8ZQckovXHAIgNtvQMHRL/lmFeWFKKQ7:SlSWB9vsM3yJJHAIgbHN/pwKv
MD5:	59E4C80F97FAFC92987B08BFA03B5EE5
SHA1:	4F86FCE17A51C3789DEB887BE01A1A0E6EA3D2DE
SHA-256:	63153B40225270ADB7CD248788CA9F18C6DEBAF222B3165BBAB633337592DF44
SHA-512:	9FCC0F747096775D0FB8DD252A73E6F47C16BF2D7DB0C3FBDFD206EE57393276FB40F65C1441296AE2AC115CFEE11098474DF3FEF8EE1FABE139427A8991F052
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Seoul)]} {.. LoadTimeZoneFile Asia/Seoul..}..set TZData(:ROK) $TZData(:Asia/Seoul)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Singapore

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.85623787837429
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyq801c3vXHAIgNtK1tyHRL/kZ8O5h4WFKf1z:SlSWB9vsM3yUgHAIgWv6N/kth4wKf9
MD5:	5EABBAAF3B29B5DFF9E54136F7ABC654
SHA1:	44615F03264012D97512F9AB386413DD72BE1090
SHA-256:	B9443FB17F0128DDB9F2DF657DC5D2DF176F64C61B0D02B272E5DFB108537678
SHA-512:	B930D637A1E69E0847ADDEAB013B2C25BC27EBB9CDF20B9CDDFDAC111E9F26BB5EBC83194E845ACC3E1B9A08C386C94FCC4FDE32292EB558E3F7463832BB38B9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Asia/Singapore)]} {.. LoadTimeZoneFile Asia/Singapore..}..set TZData(:Singapore) $TZData(:Asia/Singapore)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\AST4

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.996391010176349
Encrypted:	false
SSDEEP:	6:SlSNJB9vsM3y7p5oeSHAIgppON/kjx+90ppv:JByMYbpwt8+90b
MD5:	1AC81E2C60D528A6C5BF2E6867146813
SHA1:	73D2D24FE6D56CA34ABF11B9A95DC22F809C5158
SHA-256:	978C4E5256057CE7374AD7929605090FC749B55558495BD0112FB0BB743FA9C2
SHA-512:	DB2673FB54C1308BBEB298A186F9130FB9090CE33B958C82D62B9BD88EE39BAB9A1BE40645547BA4167FD475892A323CF8EBA16C97F6FDF5693F1BF7A313FE9A
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:SystemV/AST4) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\AST4ADT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.9470542553730255
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFtFb+MuUyqx02NEO/vXHAIg202NEqA6RL/kRDwh4IAcGE2NEOyn:SlSNJB9vsM3y7UEOXHAIgpUEqA6N/k+H
MD5:	2AB4B896957F26B114A990F69989F3FB
SHA1:	8048C99F5EE02C021F311709B30EB28D650D884D
SHA-256:	0114C111F5BCD838A28F2E16E01ECB79D8AFC8CBF639A672889ED0D692FC6CDC
SHA-512:	353744359CD94B1E8184A8B83F762459C69D3AEEA43DA638C1F4CC34E01E9D86C2EBCF7F7BFD059CB23B64051510D1C4556A49D180F8A92DE8449139194DCDC9
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Halifax)]} {.. LoadTimeZoneFile America/Halifax..}..set TZData(:SystemV/AST4ADT) $TZData(:America/Halifax)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\CST6

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.957831162100758
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFtFb+MuUyqx0sAzE5Y5XHAIg20sAzEo5RL/kR/eIAcGEsAzEpv:SlSNJB9vsM3y7hzi2HAIgphznN/kc90q
MD5:	3EC0B09EAB848821D48849673B24401C
SHA1:	41599CBA78E124A7DA9744D2B4EA8CDC10008E0B
SHA-256:	30428B85B37898AD98B65BE5B6A8BD599331D9A1B49605FC6521464228E32F8F
SHA-512:	9A3303B3338C01B281A40BB48B93C446ADB92BBDC45371667F09EDA92F9EE2AEC60CE8E98CE15C0112B823799C76AEF14895B15DC997DA506494D75BBE58D662
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Regina)]} {.. LoadTimeZoneFile America/Regina..}..set TZData(:SystemV/CST6) $TZData(:America/Regina)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\CST6CDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.975428048518589
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFtFb+MuUyqx096yXHAIg20961yHRL/kRwx/h4IAcGE967:SlSNJB9vsM3y796SHAIgp9616N/kyxpQ
MD5:	D85CCC5EFAA1ED549D02F09A38A53C68
SHA1:	642ED571E4C6F60A953D42DA4F756F2262E4E709
SHA-256:	44BEF7D4660A9A873EB762E3FDC651D31D97893545DE643FA1B2D05991C090A1
SHA-512:	3CC6A14A17EA4833958A7D444073D6C2709FD61BF54387E5C362151E9143F795B2432B621080DD53E0FC9BDD7C58F406E046E3D0A2BBA4132D99E7C705E6D645
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Chicago)]} {.. LoadTimeZoneFile America/Chicago..}..set TZData(:SystemV/CST6CDT) $TZData(:America/Chicago)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\EST5

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.928128138328689
Encrypted:	false
SSDEEP:	6:SlSNJB9vsM3y73G7JHAIgp3GZRN/kkp4903G8:JByMY3G7Kp3GntVp4903G8
MD5:	506D15E2F37F501F5A592154142A5296
SHA1:	5ACA12E0BA0FFF9734ED978A9C60AAA9D1E05A59
SHA-256:	798F92E5DDA65818C887750016D19E6EE9445ADFE0FCB7ACB11281293A09C2C7
SHA-512:	2EE08D39461CAD3492BE88B421BA463B4CEB8497F036518794BCF605F477057FEA218A9DFBB6335A28A5120750EA06AED9D2EA84CD0007D34CDE562DCD79CC0C
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indianapolis)]} {.. LoadTimeZoneFile America/Indianapolis..}..set TZData(:SystemV/EST5) $TZData(:America/Indianapolis)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\EST5EDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.113680059406992
Encrypted:	false
SSDEEP:	6:SlSNJB9vsM3y71RHAIgp1aAN/krp4901Yn:JByMY4pltw+90q
MD5:	AAD8EF3067E97785D4052B80F5C4ACE1
SHA1:	3EF0A06FCC41119F4A60A32CED0E5A1E0E8B4300
SHA-256:	D159140114A13C69F073CFE9AD0B67D713E8811CBFF773A3D1681FC38EA0E699
SHA-512:	A8774ADF6818D85476A6C147A45E55B338F413CD9B61BF9FDB0CB7A335C0CE8F8C6D1970783FEFECC2CE18388DF91304CB295BD4DFD29FB538D74F6A414A441D
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/New_York)]} {.. LoadTimeZoneFile America/New_York..}..set TZData(:SystemV/EST5EDT) $TZData(:America/New_York)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\HST10

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.9733028894475195
Encrypted:	false
SSDEEP:	6:SlSNJB9vsM3yc6e8SHAIgOb6eKAN/kQmrheo:JByMdniinbtRTo
MD5:	458061B3F3C8F06C61B5726393A26BA2
SHA1:	E894F5615654D1110C9964B8F6A54C048442D8EB
SHA-256:	BF62C8650BBA258000F62F16B0C7CBB66F4FD63F8CFDAF54273BB88A02A6C8D6
SHA-512:	6A161A7AE44CBF8CE4C704C94456A5B714AAF2A3FAF30731254C9FE056F9DDF207119D516CC6A4C44AE76EC078F5C59F5EC6DD6701FAA3A36F061AF3953B7C7D
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:SystemV/HST10) $TZData(:Pacific/Honolulu)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\MST7

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.999038624718282
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/kRgFfh4IAcGEuto:SlSNJB9vsM3y7OBHAIgpONYyHN/kch4y
MD5:	B06AB4998A57446FC4D5A5B986BCA0A9
SHA1:	5E4A28466383CBAB2067B9B6D22882CF6D83C3FB
SHA-256:	FEBE49FAE260E5595B6F1B21A0A3458D8A50ACA72F4551BF10C1EDB2758E0304
SHA-512:	9E44174C4E348E1B768039585BA6393FD001B606E111092EEC57C75210A1E87BF3C72728321945D584CA60D4C848D88EB8B2F82CB88F38F90224A43FDCFEA9AA
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:SystemV/MST7) $TZData(:America/Phoenix)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\MST7MDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.956231227702093
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFtFb+MuUyqx06RGFfXHAIg206RORL/kRMMFfh4IAcGE6RB:SlSNJB9vsM3y7+SPHAIgp+ON/kD490+B
MD5:	5D3C1ADB8AC4EAC9E9A31734CD6884BD
SHA1:	535B024EA088B9B192BE4206CBDD56BC5B163762
SHA-256:	64556A7B20E425C79375C2A7CCF72B2B5223A7DE4FF4C99A5C039DB3456C63F6
SHA-512:	FB799A42880613752AD6010D7B4E97ACCF7F6AE281D9A37057F6423AEF2607B608DB2AC52176F1653D8B2D086223C9658B101E73125F0FF7D6D9E8CD876EEC53
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Denver)]} {.. LoadTimeZoneFile America/Denver..}..set TZData(:SystemV/MST7MDT) $TZData(:America/Denver)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\PST8

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.831981174214766
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFtFb+MuUyqTQGuQTWLM4YkovXHAIgObTuQTWLovFvHRL/kRQB5nv:SlSNJB9vsM3yciQyLM4YJHAIgObiQyLQ
MD5:	B568B46A0207800D9C022BAB1E48709B
SHA1:	71CE3F0E75E440D5BBA219BCBB92AF9C1F5A7466
SHA-256:	0B8227AFC94082C985E8E125DF83E5EFADE7CD9CA399800D7B8E8B2BEAE22C7D
SHA-512:	5067AAD0CD02EBDECA6980F9C7CCC80D076C34D6463C5B6B19B678D76B5E69C1C3639D046F56FE9D6255CBEA49189EDD735F66AD9EE2CB0389BE020E7ED3AD50
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Pitcairn)]} {.. LoadTimeZoneFile Pacific/Pitcairn..}..set TZData(:SystemV/PST8) $TZData(:Pacific/Pitcairn)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\PST8PDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.003766957083974
Encrypted:	false
SSDEEP:	6:SlSNJB9vsM3y7DvPHAIgp5N/kQ1p490Dy:JByMY8p5th090W
MD5:	7E587175CA0F938C47FA920D787C57BD
SHA1:	C3F7D8576C0AC74D6B70F4363EE2C174FADC70B0
SHA-256:	D51D9549835E9C058F836C8952932CB53C10F7F194CD87452E9B13494D1C54C9
SHA-512:	4460686AAA470F07A6DB1F8957FA4DB600E116273497F46E8A2D3FDECF622122DF753556B78C39FA2ADFDB2AF3C3ABB3C330ADA79B35C6A3CD8C498A0319CEE6
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Los_Angeles)]} {.. LoadTimeZoneFile America/Los_Angeles..}..set TZData(:SystemV/PST8PDT) $TZData(:America/Los_Angeles)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\YST9

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.9524733332469095
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFtFb+MuUyqTQG5hB5WXHAIgObT5hByY6RL/kRKlUDH5hBpvn:SlSNJB9vsM3ycT2HAIgOboN/kNv
MD5:	5970A466367825D72D9672293FCD4656
SHA1:	1A736D61A6797295EEC8C094AED432171E98578E
SHA-256:	55710EFDED5B5830B2F3A2A072037C5251E1766F318707ED7CD5EB03037FED43
SHA-512:	1F2A1B2A7D0A3E410652546C174D9EC18C91C9327F11C384A0AA1EB12D7EFE85C4D53CA3C2A6C347C0068A4CE92A3138EB17232B0DEC88D52465C5DEDEEE6827
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Gambier)]} {.. LoadTimeZoneFile Pacific/Gambier..}..set TZData(:SystemV/YST9) $TZData(:Pacific/Gambier)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\SystemV\YST9YDT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.994125896811442
Encrypted:	false
SSDEEP:	6:SlSNJB9vsM3y7/9EtDSHAIgp/9Ef6N/kB490/9E9v:JByMY/947p/9XtN90/9s
MD5:	560B18DFB138DAF821CFDAE017B94473
SHA1:	0BB0312C742CC0097DF033656AE3D10723035C30
SHA-256:	DA20018DE301F879E4F026405C69FA0370EB10184FE1C84A4F1504079D5DAFA1
SHA-512:	B1D4EAD5F549E319DAD55EE67DAFD732E755164748C08633AA8F07C280B2CF617380D6F886304142D0E4D50026E63678DACFBE2DC809F780BA4CFF35A90DE906
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Anchorage)]} {.. LoadTimeZoneFile America/Anchorage..}..set TZData(:SystemV/YST9YDT) $TZData(:America/Anchorage)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Turkey

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.9295990493611495
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqxV0XaDovXHAIgoq3XRFvHRL/jCl1yQaqXKv:SlSWB9vsM3ymQa2HAIgoQ/HN/SymKv
MD5:	1FABF2DFD4BFD0184AE22ED76F7569E5
SHA1:	5859266B26357B4FCADD7EC65847667631E303EB
SHA-256:	8471A5575B9D9E47412D851A18A26C4405480540AABC8DAED5F81BE0C714C07C
SHA-512:	1DCBECEF6D1F923E6C9CEA70CB10F1FF4E453265966AA88FBC8739E93EF40F8A16AAD85AF4ECC5CC1E52F22F49E5D3F4EE01A97DE2302FC4FBC063FE814F3851
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Europe/Istanbul)]} {.. LoadTimeZoneFile Europe/Istanbul..}..set TZData(:Turkey) $TZData(:Europe/Istanbul)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\UCT

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.844017562912325
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/iGMFfh8RFB:SlSWB9vsM3yzTHAIgm6N/iP8RX
MD5:	DA060D2F397C978E0842631B4EC73376
SHA1:	649BC85430B04662BE079C0AAD43DF5D5D499D28
SHA-256:	356A9BB6F831971C295CF4DCE0F0CDC9EDF94FD686CA3D3195E5F031A0B67CBA
SHA-512:	3359BFC6F0837D2DA9D72DA8053773CE0C1A1B1A47C33163BF38965E2104F57BC147F9EEC228A3591B75BF1BA93285AB83E8427E8E2E697AB18501DC017B6E6A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:UCT) $TZData(:Etc/UTC)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\US\Alaska

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.911775112130145
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0/VXEtDovXHAIg20/VXEfovRL/iOGl0IAcGE/VXEN:SlSWB9vsM3y7/9EtDSHAIgp/9Ef6N/i4
MD5:	4379C0BF618649AA07CC4BDAC75F62EF
SHA1:	7813B54BF2BD0C40A39CA9A29CC50C6D034880A3
SHA-256:	CED56F09D68BE00555219594C7B2F3E7EFE8323201FB3E2AA0E1FA9A6467D5AF
SHA-512:	AC822061F5C9743120A66E11C02B199253A40460A87F78DC154B0BDD91E410EDDA581E889F5D2A74670939034F39A7F6C7E814E038A1371DAB71EF79A8911AE7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Anchorage)]} {.. LoadTimeZoneFile America/Anchorage..}..set TZData(:US/Alaska) $TZData(:America/Anchorage)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\US\Aleutian

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.8886795125313585
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0/yO5WXHAIg20/yOoNvWARL/iObMEIB/4IAcGE/y2:SlSWB9vsM3y7/yrHAIgp/yH0AN/itE8h
MD5:	AB14CF1840CBDA2B326660DBD51273B4
SHA1:	78144B3A2C75568307E4E86AE3B01EA7F541B011
SHA-256:	A4F1398CF84D0AE09BF19288770756622D1710CCBFBFE79E0D3239497731287D
SHA-512:	557A3ED9D1401E76291DC41524A1FD04AFF0829CEF66E103CEF9D10CD751F04FDEB6B7C0490302C71297F53AA8DC42930649AD274215D5DF068BCDE837E73756
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Adak)]} {.. LoadTimeZoneFile America/Adak..}..set TZData(:US/Aleutian) $TZData(:America/Adak)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\US\Arizona

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.9334626069754455
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0utLaDovXHAIg20utLRYovHRL/iQMfQfBx+IAcGEB:SlSWB9vsM3y7OBHAIgpONYyHN/iZfQfl
MD5:	30ED80335BE37C7CBA672C33FDE23490
SHA1:	B627E86F023FE02A5590FE8D55FF41946BE6D24B
SHA-256:	9503403F231BA33415A5F2F0FDD3771CE7FF78534CE83C16A8DB5BC333B4AD8A
SHA-512:	C1352612EC0B4FF2F6F279CDB6008D7E9DA7F94F0009EFD959AD3092393150ECA83A09E72C724E1A4BFC3A057B9218D54A87FFA1102E2D9BF058B78AC0A0B1AB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Phoenix)]} {.. LoadTimeZoneFile America/Phoenix..}..set TZData(:US/Arizona) $TZData(:America/Phoenix)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\US\Central

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.90255068822036
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx096yXHAIg20961yHRL/ibXgox/h4IAcGE967:SlSWB9vsM3y796SHAIgp9616N/iB490+
MD5:	7770A6B85B2FE73BCCE9D803E0200F23
SHA1:	784AD1082FF1569961C2AC44F6D6F7605FBBE766
SHA-256:	B6AC9FAE0AB69D58ECFD6B9A84F3C6D3E1A594E40CEEC94E2A0A7855781E173A
SHA-512:	EEE79D37D77E6B80B91E8F30CE48B107371F6A58F0C91785E3C74EF210AE1011D0EB913113F1873BE6099B0BE1260410F0C74650446CB377F8FDB5505A44F266
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Chicago)]} {.. LoadTimeZoneFile America/Chicago..}..set TZData(:US/Central) $TZData(:America/Chicago)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\US\East-Indiana

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.7645631776966715
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y73GK7JHAIgp3GKZRN/i3E0903GK8:MByMY3GK7Kp3GKnti3t903GK8
MD5:	96828B6BA17CA96723794F4B3744B494
SHA1:	C3A824A925AEFE2A13A0E65548078D9842C2C7D7
SHA-256:	5D86F8D36598516FB2342A18A87DB2701BABD265B0671CC9321C48DB22C7ECA5
SHA-512:	2A27A455787DEAC3EC78A2784FB989DAB178E9D6DD7721CD3F5D3337231A3C651994B964D6CE040B7858E0127D7F70C0C48CB0D553D5B725B649C828288224B5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Indiana/Indianapolis)]} {.. LoadTimeZoneFile America/Indiana/Indianapolis..}..set TZData(:US/East-Indiana) $TZData(:America/Indiana/Indianapolis)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\US\Eastern

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.0345860115708785
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqx0wAy0vfXHAIg20wAyGWARL/i37oxp4IAcGEwAy0yn:SlSWB9vsM3y71RHAIgp1aAN/i37oxp4P
MD5:	375DB249106C5D351CA0E84848835EDB
SHA1:	ECC5C0C9DA68773B94C9013F4F1A8800D511CC4C
SHA-256:	2FFCAD8CBEF5ECDC74DB3EE773E4B18ABC8EFA9C09C4EA8F3A45A08BADAF91A9
SHA-512:	21550743BF4E1A79754F76AB201F0EB6BA6B265F43855901640054316A4A32A5D01D266B2441E4A6415720715A2ABD367D82E3D40949A7A66BE9F8366E47A8DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/New_York)]} {.. LoadTimeZoneFile America/New_York..}..set TZData(:US/Eastern) $TZData(:America/New_York)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\US\Hawaii

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.88075715646936
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqTQG2fWGYFeyXHAIgObT2fWKARL/ioMN75nUDH2fWWv:SlSWB9vsM3yc6e8SHAIgOb6eKAN/ioER
MD5:	C0475756CFEC302F737967468804846E
SHA1:	85C13CA0A908C69B8BBB6040FC502AFF96B8F8C7
SHA-256:	529BB43EFDA6C1584FEAEA789B590CEF1397E33457AB3845F3101B1FC126E0FB
SHA-512:	D3FF374443344E8438D50803872E8A8EA077B2299B38C1BD155386B4D2C6008BBD0C0B0B26DE9680812D4AFC9A187B644BDCCB04C23880337228BCEC06D5D61B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Pacific/Honolulu)]} {.. LoadTimeZoneFile Pacific/Honolulu..}..set TZData(:US/Hawaii) $TZData(:Pacific/Honolulu)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\tzdata\Zulu

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.8800842076244715
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqAxmS3vXHAIgELyHRL/taFBURFB:SlSWB9vsM3yzTHAIgm6N/YFaRX
MD5:	DDB6F69CA4F0EF6A708481F53F95EAB9
SHA1:	A63E900A9257E9D73B4BB4BACBA8133C3D1DC41B
SHA-256:	A06E8CCCF97CC8FB545DFDB4C89B5E5C8EDF0360547BDC1823B4AC47B1556C31
SHA-512:	C8EA1039BE001F5EF52662B28DBF46D02E4848F08F05923850DEA1994732037B4C8D6030B742D97FA4276AF5FEE3F17C47C7DDA4F44DD23244F9976A076D5CC4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Etc/UTC)]} {.. LoadTimeZoneFile Etc/UTC..}..set TZData(:Zulu) $TZData(:Etc/UTC)..

C:\Users\user\AppData\Local\Temp\_MEI12922\tcl\word.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5030
Entropy (8bit):	4.838527643033185
Encrypted:	false
SSDEEP:	96:HgTQWiZuhdFQJmuldFQofsGP3R1hF9Dl19arB0E9Dl1YoaEhHe2Gu/q1ZFyJRpqk:8iZUroxvR197ABr971h5GIqrmbqIc+b/
MD5:	70450A0CF04EF273EFF2B070053FCFA6
SHA1:	47974D6C0FC986EE1273C4E13DDB9E1288CEF0FF
SHA-256:	678F891615E2209A8ECBA17857922A9723E78709ADB983032E89CA706000C44D
SHA-512:	AFD3E47324D1497CC46AC6141191FCEB843977D0B0285C807FF8985DCC56FDE10977F57D503D986CD2C1EDC6C62F01E405A0EB483340B247B129FC8D6D9FE689
Malicious:	false
Preview:	# word.tcl --..#..# This file defines various procedures for computing word boundaries in..# strings. This file is primarily needed so Tk text and entry widgets behave..# properly for different platforms...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998 Scritpics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# The following variables are used to determine which characters are..# interpreted as white space.....if {$::tcl_platform(platform) eq "windows"} {.. # Windows style - any but a unicode space char.. if {![info exists ::tcl_wordchars]} {...set ::tcl_wordchars {\S}.. }.. if {![info exists ::tcl_nonwordchars]} {...set ::tcl_nonwordchars {\s}.. }..} else {.. # Motif style - any unicode word char (number, letter, or underscore).. if {![info exists ::tcl_wordchars]} {...set ::tcl_wordchars {\w}.. }.. if {![info exists ::tcl_nonwordchar

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\bgerror.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8806
Entropy (8bit):	4.863085192885279
Encrypted:	false
SSDEEP:	192:RpwYLapGk1BlM4UBIHpJFVUXUziMJ5Kxyk55qxUr7Vdk5vNR:RuYfvMdOXyj+01f
MD5:	C5E9A2E32AE83A79DF422D1145B692DF
SHA1:	08350F930FB97A95970122920C91FB9CED8329E9
SHA-256:	8822365EE279BEBF7A36CFDEDBA1114762F894781F4635170CC5D85FF5B17923
SHA-512:	71420E15A3D63329560074F6FFAD42CB464401284BC29D0DC8E34D83F8F77079F26BB4C5703E656A48E6931C3DBF6B873756FB212D0860483E0301B29EDE1212
Malicious:	false
Preview:	# bgerror.tcl --..#..#.Implementation of the bgerror procedure. It posts a dialog box with..#.the error message and gives the user a chance to see a more detailed..#.stack trace, and possible do something more interesting with that..#.trace (like save it to a log). This is adapted from work done by..#.Donal K. Fellows...#..# Copyright (c) 1998-2000 by Ajuba Solutions...# Copyright (c) 2007 by ActiveState Software Inc...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>....namespace eval ::tk::dialog::error {.. namespace import -force ::tk::msgcat::.. namespace export bgerror.. option add ErrorDialog.function.text [mc "Save To Log"] \...widgetDefault.. option add ErrorDialog.function.command [namespace code SaveToLog].. option add ErrorDialogLabel.font TkCaptionFont widgetDefault.. if {[tk windowingsystem] eq "aqua"} {...option add ErrorDialog*background systemAlertBackgroundActi

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\button.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	21612
Entropy (8bit):	4.947590677310969
Encrypted:	false
SSDEEP:	384:Tv7cBCAsj9oqlFFSsB3VfRt+lMpWaNwJgzCHarc6gAsj9oqlFFSsB3VlRtYlMpBz:TvweHBBTfIZxHBnZWqbJPBFIaVlCj26+
MD5:	AEB53F7F1506CDFDFE557F54A76060CE
SHA1:	EBB3666EE444B91A0D335DA19C8333F73B71933B
SHA-256:	1F5DD8D81B26F16E772E92FD2A22ACCB785004D0ED3447E54F87005D9C6A07A5
SHA-512:	ACDAD4DF988DF6B2290FC9622E8EACCC31787FECDC98DCCA38519CB762339D4D3FB344AE504B8C7918D6F414F4AD05D15E828DF7F7F68F363BEC54B11C9B7C43
Malicious:	false
Preview:	# button.tcl --..#..# This file defines the default bindings for Tk label, button,..# checkbutton, and radiobutton widgets and provides procedures..# that help in implementing those bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 2002 ActiveState Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for buttons...#-------------------------------------------------------------------------....if {[tk windowingsystem] eq "aqua"} {.... bind Radiobutton <Enter> {...tk::ButtonEnter %W.. }.. bind Radiobutton <1> {...tk::ButtonDown %W.. }.. bind Radiobutton <ButtonRelease-1> {...tk::ButtonUp %W.. }.. bind Checkbutton <Enter> {...tk::ButtonEnter %W

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\choosedir.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9960
Entropy (8bit):	4.802555950168837
Encrypted:	false
SSDEEP:	192:HKOdkMpU9YUp8UIhMYYicln9Die0luVZat3pIp5Y3sF1P8Bg8p6trIOzvKsOiCLU:HyMm9J8wPx70luex4C8Fygq6tohef+0J
MD5:	818E4F0112931F12B4FAC4CAD262814C
SHA1:	AC7060DF952F9DB52C3687B8F5E6AA4ADF06992E
SHA-256:	35B208E8570B0D1E0CA1C911D4FE02EE3B0CFE5667CF1BDEC006CF9D043122BA
SHA-512:	0C535B6621BC83412B7A64CB6AC2BA526B8E49BB5F6BC5EBEDA41D223D68DEB031DB9C8A31F8671BC5F327D720942E7FDAE3328334B0B550AC991191F96909D6
Malicious:	false
Preview:	# choosedir.tcl --..#..#.Choose directory dialog implementation for Unix/Mac...#..# Copyright (c) 1998-2000 by Scriptics Corporation...# All rights reserved.....# Make sure the tk::dialog namespace, in which all dialogs should live, exists..namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}....# Make the chooseDir namespace inside the dialog namespace..namespace eval ::tk::dialog::file::chooseDir {.. namespace import -force ::tk::msgcat::*..}....# ::tk::dialog::file::chooseDir:: --..#..#.Implements the TK directory selection dialog...#..# Arguments:..#.args..Options parsed by the procedure...#..proc ::tk::dialog::file::chooseDir:: {args} {.. variable ::tk::Priv.. set dataName __tk_choosedir.. upvar ::tk::dialog::file::$dataName data.. Config $dataName $args.... if {$data(-parent) eq "."} {.. set w .$dataName.. } else {.. set w $data(-parent).$dataName.. }.... # (re)create the dialog box if necessary.. #.. if {![winfo exis

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\clrpick.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	22112
Entropy (8bit):	5.032169196169179
Encrypted:	false
SSDEEP:	384:lJGidpe3JQDUd6hgp6EQstzQf+a9DPbJ43/H//cO802UeeVnZmM6BA0kyVJv9Qpu:Gep6JCwQDPbWPaRCzTdMAe
MD5:	89C6CABEB68B1A5318D88DD8444C3DE3
SHA1:	C19C58EEC7FB5105A609C0896EDCC336C00E7F9E
SHA-256:	E7AA73828A731DCC9541308AA53FF3CF550A0952FD42C4D86D831F87FB47CDCF
SHA-512:	A49A96A2BFC0D1A8E4003526E7836B9968DAF2B4DA727B23B7E180B5472DD187AB409D2FDF233F2557BD0DC2B4FE57AA2DD57BC2BDCE90DD2B603F4BB74CF22D
Malicious:	false
Preview:	# clrpick.tcl --..#..#.Color selection dialog for platforms that do not support a..#.standard color selection dialog...#..# Copyright (c) 1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#..# ToDo:..#..#.(1): Find out how many free colors are left in the colormap and..#. don't allocate too many colors...#.(2): Implement HSV color selection...#....# Make sure namespaces exist..namespace eval ::tk {}..namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::color {.. namespace import ::tk::msgcat::*..}....# ::tk::dialog::color:: --..#..#.Create a color dialog and let the user choose a color. This function..#.should not be called directly. It is called by the tk_chooseColor..#.function when a native color selector widget does not exist..#..proc ::tk::dialog::color:: {args} {.. variable ::tk::Priv.. set dataName __tk__color.. upvar ::tk::dialog::color::$da

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\comdlg.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8690
Entropy (8bit):	5.098389551322902
Encrypted:	false
SSDEEP:	192:u4R7+/gFw/MEN55fO7eyjt4bjC+gR8e3vwLln/+LVtUw0tXK4jA:u4l+/gFeMI55Xyjt4bjC+gOe3Ih/+LV1
MD5:	ABF277E4F62423F4345B6AD65640B8C2
SHA1:	E66A4E37D51C7827C9ACA449A42E0966AACBC8C8
SHA-256:	C7DA292CCF5F413E599C3491C331FFD58CF273F8477FACB097E6F36CF1F32A08
SHA-512:	AA9F75D7C5C915B5FCD2F454856D080D186AB9BA149DC139FEAF7F4AC3DC51E6769E138E3B1BE45B3FEC3AE744189DE44DB2B748F0628FF13E4E733B9CD68BD5
Malicious:	false
Preview:	# comdlg.tcl --..#..#.Some functions needed for the common dialog boxes. Probably need to go..#.in a different file...#..# Copyright (c) 1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# tclParseConfigSpec --..#..#.Parses a list of "-option value" pairs. If all options and..#.values are legal, the values are stored in..#.$data($option). Otherwise an error message is returned. When..#.an error happens, the data() array may have been partially..#.modified, but all the modified members of the data(0 array are..#.guaranteed to have valid values. This is different than..#.Tk_ConfigureWidget() which does not modify the value of a..#.widget record if any error occurs...#..# Arguments:..#..# w = widget record to modify. Must be the pathname of a widget...#..# specs = {..# {-commandlineswitch resourceName ResourceClass defaultValue verifier}..# {....}..# }..#..# flags

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\console.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	33942
Entropy (8bit):	4.953820376776617
Encrypted:	false
SSDEEP:	384:jMpwGUC0zCLemVueuR3fS8X4rqU9ykVBjG+FUHyOnmTTRV+po2mBh6S5mDjbHqzG:jMpdUFzCLpCrI3vVBhjnD2jVfV/
MD5:	B927A17A86D5E43606C93CC6F90A5A4A
SHA1:	03C1005EA8FABA9055591D095674D85F64E5C154
SHA-256:	9D023DBF3B0FCD25E13502B34F8BE63F64DA592FA612EBD31C08AF4AC27338D6
SHA-512:	B4443C72A28A172B0E113089085EC5D663A84384EB31B56BE23E507B285065E8D8EAB4A1306352A01843C13D1B5B15FF05D7956B89BCF693363D68C5B8B48864
Malicious:	false
Preview:	# console.tcl --..#..# This code constructs the console window for an application. It..# can be used by non-unix systems that do not have built-in support..# for shells...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...# Copyright (c) 2007-2008 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# TODO: history - remember partially written command....namespace eval ::tk::console {.. variable blinkTime 500 ; # msecs to blink braced range for.. variable blinkRange 1 ; # enable blinking of the entire braced range.. variable magicKeys 1 ; # enable brace matching and proc/var recognition.. variable maxLines 600 ; # maximum # of lines buffered in console.. variable showMatches 1 ; # show multiple expand matches.. variable useFontchooser [llength [info command ::tk::fontchooser]

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\dialog.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5988
Entropy (8bit):	4.829498876074983
Encrypted:	false
SSDEEP:	96:qFR55woFFEciKwKClFEOTIhDHWyzaoj9zza7v0J7:qL55jiKwKCzTIhDbzaojhSG7
MD5:	B2B3AA971D42FDBF92F13B45111EE1D3
SHA1:	A74F2C2707463D6E209D0E0C96D75083AC6920A5
SHA-256:	1C977052C1D8293CC5FE4198A538BECA9BC821AF85E76E4EEFBFB75B33CE8BED
SHA-512:	146F658DA3E6E9176FA51C9836D7C1DCFC14E148A26B224155F6493C195A7FB20C2DC4EE21994E5A193B8DA8561C75374E830304F94F0C844E52AD829F6810D5
Malicious:	false
Preview:	# dialog.tcl --..#..# This file defines the procedure tk_dialog, which creates a dialog..# box containing a bitmap, a message, and one or more buttons...#..# Copyright (c) 1992-1993 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#..# ::tk_dialog:..#..# This procedure displays a dialog box, waits for a button in the dialog..# to be invoked, then returns the index of the selected button. If the..# dialog somehow gets destroyed, -1 is returned...#..# Arguments:..# w -..Window to use for dialog top-level...# title -.Title to display in dialog's decorative frame...# text -.Message to display in dialog...# bitmap -.Bitmap to display in dialog (empty string means none)...# default -.Index of button that is to display the default ring..#..(-1 means none)...# args -.One or more strings to display in buttons

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\entry.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	18401
Entropy (8bit):	4.982139840696722
Encrypted:	false
SSDEEP:	384:mDfyRIlBk3yrt8qLjtpa+qh+rA4rsWRWrrMUtCPnkKYNlPp64ZnCD:mDfyRIlBk3yJ8mtpaplcp6o
MD5:	F109865C52D1FD602E2D53E559E56C22
SHA1:	5884A3BB701C27BA1BF35C6ADD7852E84D73D81F
SHA-256:	AF1DE90270693273B52FC735DA6B5CD5CA794F5AFD4CF03FFD95147161098048
SHA-512:	B2F92B0AC03351CDB785D3F7EF107B61252398540B5F05F0CC9802B4D28B882BA6795601A68E88D3ABC53F216B38F07FCC03660AB6404CF6685F6D80CC4357FC
Malicious:	false
Preview:	# entry.tcl --..#..# This file defines the default bindings for Tk entry widgets and provides..# procedures that help in implementing those bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#...start dragging out a selection)...# pressX -..X-coordinate at which the mouse button was pressed...# selectMode -..The style of selection currently underway:..#...char, word

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\focus.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5035
Entropy (8bit):	4.819523401259934
Encrypted:	false
SSDEEP:	96:J3MRZZ7HWb/6OgRKjtS6Mn9GRZZ7HWb2Y6aO6R5nh76SMoB2kd82KtTpsi2D0DSn:CRZdPul1RZdFaRf0XoB2gZKZpsi2pn
MD5:	63B219BE9AFF1DE7DE2BAF0E941CAE38
SHA1:	A2FEBB31380E12FF01E6F641FE8B4F815941462F
SHA-256:	8872F236D7E824AEC0ACD4BACC00FDD7EC9BC5534814ECF2160610C10647B7C5
SHA-512:	057700F8FDE4B7C3D7AB7CEFD6C531060BF2B1B3B727CAD6A37ECD42EBC557765D94B83ADD438BD5AFA1F6F919D80AE755A8D98918981167B871F31AD42FDF5E
Malicious:	false
Preview:	# focus.tcl --..#..# This file defines several procedures for managing the input..# focus...#..# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_focusNext --..# This procedure returns the name of the next window after "w" in..# "focus order" (the window that should receive the focus next if..# Tab is typed in w). "Next" is defined by a pre-order search..# of a top-level and its non-top-level descendants, with the stacking..# order determining the order of siblings. The "-takefocus" options..# on windows determine whether or not they should be skipped...#..# Arguments:..# w -..Name of a window.....proc ::tk_focusNext w {.. set cur $w.. while {1} {.....# Descend to just before the first child of the current widget......set parent $cur...set children [winfo children $cur]...set i -1.....# Look for the next sibling that isn't a top-leve

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\fontchooser.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16467
Entropy (8bit):	4.795270290870865
Encrypted:	false
SSDEEP:	384:aUcEQ2Mq56jP/oVR6EcW0i9cWHKVo8q5F2Zsb9M:aUcEQ2Mq56jP/oVR6Ec5i9hKSxFC
MD5:	A11F7D5F858E28D67F5391454401CAE8
SHA1:	8ACAE04BE25249A3B7524B2C4AC03BF9FCF081D7
SHA-256:	48C6D9EABB028A57291C009E1B02756D1EA6A18F9ACA7066C59BC3C5D881D3A6
SHA-512:	E8D9B11208642C62166C62AF605341EC7BEEF4E178DD3FCC9E72E4436BE1F4E5D1952B78C5FA206D85D61693922FE26ACAF9267725387F2A7A56EE2D95A6D69A
Malicious:	false
Preview:	# fontchooser.tcl -..#..#.A themeable Tk font selection dialog. See TIP #324...#..# Copyright (C) 2008 Keith Vetter..# Copyright (C) 2008 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::fontchooser {.. variable S.... set S(W) .__tk__fontchooser.. set S(fonts) [lsort -dictionary [font families]].. set S(styles) [list \...[::msgcat::mc "Regular"] \...[::msgcat::mc "Italic"] \...[::msgcat::mc "Bold"] \...[::msgcat::mc "Bold Italic"] \.. ].... set S(sizes) {8 9 10 11 12 14 16 18 20 22 24 26 28 36 48 72}.. set S(strike) 0.. set S(under) 0.. set S(first) 1.. set S(sampletext) [::msgcat::mc "AaBbYyZz01"].. set S(-parent) ... set S(-title) [::msgcat::mc "Font"].. set S(-command) "".. set S(-font) TkDefaultFont..}....proc ::tk::fontchooser::Setup {} {.. variable S.... # Canonical versions of f

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\iconlist.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17421
Entropy (8bit):	4.954921304048498
Encrypted:	false
SSDEEP:	384:FNP8nO9Wo8k5NfQH8EsOy8WMVbcfNCvJshPOw7jW:FNf8uNfQH89Z8WMVY15DW
MD5:	4FDE770E3DFF8B95295FB887F510534B
SHA1:	5356BA885D61910A34756188D676FACD0353ED8A
SHA-256:	C8B4B2130C6AD658331C59F41D8BDBAB44E0011781214A0B0BE78C4920536B2E
SHA-512:	30BF50137F18643FC3622EAA195EC7E0F21B77980C16DB54CCA1B7AEFA17CA4CE8E6F82D6C8F4A0DFB6DD78D4F115D3A5D8DA7573A928AF9C1A92727BD4F0691
Malicious:	false
Preview:	# iconlist.tcl..#..#.Implements the icon-list megawidget used in the "Tk" standard file..#.selection dialog boxes...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...# Copyright (c) 2009 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#..# API Summary:..#.tk::IconList <path> ?<option> <value>? .....#.<path> add <imageName> <itemList>..#.<path> cget <option>..#.<path> configure ?<option>? ?<value>? .....#.<path> deleteall..#.<path> destroy..#.<path> get <itemIndex>..#.<path> index <index>..#.<path> invoke..#.<path> see <index>..#.<path> selection anchor ?<int>?..#.<path> selection clear <first> ?<last>?..#.<path> selection get..#.<path> selection includes <item>..#.<path> selection set <first> ?<last>?.....package require Tk....::tk::Megawidget create ::tk::IconList ::tk::FocusableWidget {.. variable w canvas sbar accel accelCB fill font index \...itemList itemsPerColumn list

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\icons.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11037
Entropy (8bit):	6.048349526382653
Encrypted:	false
SSDEEP:	192:0nEPytJLl1S47T3YqN5/vkJpnhXqBB4aw2rqZiygTtYTpOq/pc75Mk:xqLz7F5KTqBBLuZ1gTSsqhk
MD5:	995A0A8F7D0861C268AEAD5FC95A42EA
SHA1:	21E121CF85E1C4984454237A646E58EC3C725A72
SHA-256:	1264940E62B9A37967925418E9D0DC0BEFD369E8C181B9BAB3D1607E3CC14B85
SHA-512:	DB7F5E0BC7D5C5F750E396E645F50A3E0CDE61C9E687ADD0A40D0C1AA304DDFBCEEB9F33AD201560C6E2B051F2EDED07B41C43D00F14EE435CDEEE73B56B93C7
Malicious:	false
Preview:	# icons.tcl --..#..#.A set of stock icons for use in Tk dialogs. The icons used here..#.were provided by the Tango Desktop project which provides a..#.unified set of high quality icons licensed under the..#.Creative Commons Attribution Share-Alike license..#.(https://creativecommons.org/licenses/by-sa/3.0/)..#..#.See http://tango.freedesktop.org/Tango_Desktop_Project..#..# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>....namespace eval ::tk::icons {}....image create photo ::tk::icons::warning -data {.. iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAABSZJREFU.. WIXll1toVEcYgL+Zc87u2Yu7MYmrWRuTJuvdiMuqiJd4yYKXgMQKVkSjFR80kFIVJfWCWlvpg4h9.. 8sXGWGof8iKNICYSo6JgkCBEJRG8ImYThNrNxmaTeM7pQ5IlJkabi0/9YZhhZv7///4z/8zPgf+7.. KCNRLgdlJijXwRyuDTlcxV9hbzv8nQmxMjg+XDtiOEplkG9PSfkztGmTgmFQd+FCVzwa3fYN/PHZ.. AcpBaReicW5xcbb64IEQqko8Lc26d/58cxS+/BY6hmJvyEfQBoUpwWCmW1FErKaGWHU13uRk4QkE.. UtxQNFR7QwIoB4eiKD9PWbVKbb10CZmaCqmpxCormRYO26QQx85B0mcD+AeK0

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\README

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.3973643486226655
Encrypted:	false
SSDEEP:	6:nVxpJFBmHdeA1xNZgk0dIf3Ju4dFi6/XWrWhr3W7FxmVFraazmVAJFKyVQR7icr8:nj5Bqf1fZgp6A4FDG6dm7FUGAJVVMRmn
MD5:	921245A21F7E783997DC7B859AF1B65B
SHA1:	2EFE3C8F70CF18621006890BF21CC097770D140D
SHA-256:	C6DB098EBD8A622164D37D4AB0A8C205DB1A83AC3065D5CDE3CB5FB61925D283
SHA-512:	CAD823FF3D13A64C00825961E75B5133690556FB1F622834F8B1DF316A9E75BABB63B9F5148DAE7B1391123B4C8D55B4B8B2EB6F8E6E1DA9DE02A5BD7AC0FD6F
Malicious:	false
Preview:	README - images directory....This directory includes images for the Tcl Logo and the Tcl Powered..Logo. Please feel free to use the Tcl Powered Logo on any of your..products that employ the use of Tcl or Tk. The Tcl logo may also be..used to promote Tcl in your product documentation, web site or other..places you so desire...

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\logo.eps

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	34991
Entropy (8bit):	5.248845410801251
Encrypted:	false
SSDEEP:	768:0YrY6a0v4uIqYMEKjodQKOfRXMLcSqDGpfTKFVm3AsanMEDzzBHWzaw7XUbTJjoB:0YrY6aeIqYMEKjouzfRXMLcSqDGpfTKo
MD5:	23C4EDED40DEC065F99E6653AEE1BB31
SHA1:	3175E261BE198731DEDB07264CCB84C8DEDF7967
SHA-256:	76207D8DFDE189A29DC0E76ADB7EAAA606B96BC6C1C831F34D1C85B1C5B51DD3
SHA-512:	BA139A64BE72BB681040924C4294E2726BA5AB243E805E60A854D2D23E154705E2431D1AB2DE732BFA393747FD30D8A5C913895CBE1463DBF50CC23CAE5B0454
Malicious:	false
Preview:	%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL/TK LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:58 PM)..%%BoundingBox: 251 331 371 512..%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%DocumentCustomColors: (TCL RED)..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe Illustrator

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\logo100.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2341
Entropy (8bit):	6.9734417899888665
Encrypted:	false
SSDEEP:	48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
MD5:	FF04B357B7AB0A8B573C10C6DA945D6A
SHA1:	BCB73D8AF2628463A1B955581999C77F09F805B8
SHA-256:	72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
SHA-512:	10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
Malicious:	false
Preview:	GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\logo64.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	6.326462043862671
Encrypted:	false
SSDEEP:	48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
MD5:	B226CC3DA70AAB2EBB8DFFD0C953933D
SHA1:	EA52219A37A140FD98AEA66EA54685DD8158D9B1
SHA-256:	138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
SHA-512:	3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
Malicious:	false
Preview:	GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\logoLarge.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11000
Entropy (8bit):	7.88559092427108
Encrypted:	false
SSDEEP:	192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
MD5:	45D9B00C4CF82CC53723B00D876B5E7E
SHA1:	DDD10E798AF209EFCE022E97448E5EE11CEB5621
SHA-256:	0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
SHA-512:	6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
Malicious:	false
Preview:	GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.^.x.....J.L.!.'........=+eZ..i..ynF.8...].y\|..m.

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\logoMed.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3889
Entropy (8bit):	7.425138719078912
Encrypted:	false
SSDEEP:	48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
MD5:	BD12B645A9B0036A9C24298CD7A81E5A
SHA1:	13488E4F28676F1E0CE383F80D13510F07198B99
SHA-256:	4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
SHA-512:	F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
Malicious:	false
Preview:	GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\pwrdLogo.eps

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	29706
Entropy (8bit):	5.33387357427899
Encrypted:	false
SSDEEP:	768:0warY6a0v4uIqYMEKjodQKOfRtMLcSqDGpf88KFVmlhEtOI/eE7U0a1:03rY6aeIqYMEKjouzfRtMLcSqDGpfbKc
MD5:	4AE11820D4D592D02CDE458E6F8CE518
SHA1:	A2E8D3D6191B336D43E48A65C3AE6485B07D93C6
SHA-256:	87FD9E46DBB5F2BF1529AFB411182C9FB9C58E23D830C66A233AF0C256BB8EFF
SHA-512:	E0AD4ED570D414BF00931B0F5BBB61FEF981ABDB22ECC42F8E9841905D38874CDFE38F22EDB17ACD0F7539B2932F9C4A865FA73A49BB1458CE05EE10A78BE357
Malicious:	false
Preview:	%!PS-Adobe-3.0 EPSF-3.0..%%Creator: Adobe Illustrator(TM) 5.5..%%For: (Bud Northern) (Mark Anderson Design)..%%Title: (TCL PWRD LOGO.ILLUS)..%%CreationDate: (8/1/96) (4:59 PM)..%%BoundingBox: 242 302 377 513..%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323..%%DocumentProcessColors: Cyan Magenta Yellow..%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0..%%+ procset Adobe_IllustratorA_AI5 1.0 0..%AI5_FileFormat 1.2..%AI3_ColorUsage: Color..%%CMYKCustomColor: 0 0.45 1 0 (Orange)..%%+ 0 0.25 1 0 (Orange Yellow)..%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV)..%%+ 0 0.79 0.91 0 (TCL RED)..%AI3_TemplateBox: 306 396 306 396..%AI3_TileBox: 12 12 600 780..%AI3_DocumentPreview: Macintosh_ColorPic..%AI5_ArtSize: 612 792..%AI5_RulerUnits: 0..%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0..%AI5_TargetResolution: 800..%AI5_NumLayers: 1..%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40..%AI5_OpenViewLayers: 7..%%EndComments..%%BeginProlog..%%BeginResource: procset Adobe_level2_AI5 1.0 0..%%Title: (Adobe I

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\pwrdLogo100.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1615
Entropy (8bit):	7.461273815456419
Encrypted:	false
SSDEEP:	48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
MD5:	DBFAE61191B9FADD4041F4637963D84F
SHA1:	BD971E71AE805C2C2E51DD544D006E92363B6C0C
SHA-256:	BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
SHA-512:	ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
Malicious:	false
Preview:	GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v\|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......\|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8OZ.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.\|..pf!..&.......8.#.8.......J>. .t..h6(........#..0.A...!..)...x..u.Z....%..H............`......\|.....1.......&.....T...f.l...

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\pwrdLogo150.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	7.708754027741608
Encrypted:	false
SSDEEP:	48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
MD5:	711F4E22670FC5798E4F84250C0D0EAA
SHA1:	1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
SHA-256:	5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
SHA-512:	220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
Malicious:	false
Preview:	GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>\|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\pwrdLogo175.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	7.758793907956808
Encrypted:	false
SSDEEP:	48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
MD5:	DA5FB10F4215E9A1F4B162257972F9F3
SHA1:	8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
SHA-256:	62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
SHA-512:	990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
Malicious:	false
Preview:	GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....0p}..KP?c.\@KW.S(..M..B.....-q...S2....,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.4..(..........F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\pwrdLogo200.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3491
Entropy (8bit):	7.790611381196208
Encrypted:	false
SSDEEP:	96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
MD5:	A5E4284D75C457F7A33587E7CE0D1D99
SHA1:	FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
SHA-256:	BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
SHA-512:	4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
Malicious:	false
Preview:	GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R......J.p.A.t...$A...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y135.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. .....Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'\|..M9..."...,.......

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\pwrdLogo75.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.289201491091023
Encrypted:	false
SSDEEP:	24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
MD5:	7013CFC23ED23BFF3BDA4952266FA7F4
SHA1:	E5B1DED49095332236439538ECD9DD0B1FD4934B
SHA-256:	462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
SHA-512:	A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
Malicious:	false
Preview:	GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .\|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N\|...f..J.x... P&.\|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..\|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\images\tai-ku.gif

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5473
Entropy (8bit):	7.754239979431754
Encrypted:	false
SSDEEP:	96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
MD5:	048AFE69735F6974D2CA7384B879820C
SHA1:	267A9520C4390221DCE50177E789A4EBD590F484
SHA-256:	E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
SHA-512:	201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
Malicious:	false
Preview:	GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa.....p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..\|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......EfY3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\license.terms

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2307
Entropy (8bit):	5.135743409565932
Encrypted:	false
SSDEEP:	48:XU/zAcKT6yOCaDBfsHLk32s3J5w83KDyP1BXy3JQz7yuC:XNc+92sg3A8uyDXy3JQnDC
MD5:	F090D9B312C16489289FD39813412164
SHA1:	1BEC6668F6549771DADC67D153B89B8F77DCD4B9
SHA-256:	0D1E4405F6273F091732764ED89B57066BE63CE64869BE6C71EA337DC4F2F9B5
SHA-512:	57B323589C5A8D9CBB224416731D8CE65C4B94146DF15CE30885DF63B1D0B3F709093B65390A911F84F20B7C5DE3C0AF9B4D7D531742BE046EDA6E8C3432EF6E
Malicious:	false
Preview:	This software is copyrighted by the Regents of the University of..California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState..Corporation, Apple Inc. and other parties. The following terms apply to..all files associated with the software unless explicitly disclaimed in..individual files.....The authors hereby grant permission to use, copy, modify, distribute,..and license this software and its documentation for any purpose, provided..that existing copyright notices are retained in all copies and that this..notice is included verbatim in any distributions. No written agreement,..license, or royalty fee is required for any of the authorized uses...Modifications to this software may be copyrighted by their authors..and need not follow the licensing terms described here, provided that..the new terms are clearly indicated on the first page of each file where..they apply.....IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY..FOR DIRECT, INDIRECT, SPECIAL, INCI

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\listbox.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15255
Entropy (8bit):	4.9510475386072095
Encrypted:	false
SSDEEP:	384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
MD5:	804E6DCE549B2E541986C0CE9E75E2D1
SHA1:	C44EE09421F127CF7F4070A9508F22709D06D043
SHA-256:	47C75F9F8348BF8F2C086C57B97B73741218100CA38D10B8ABDF2051C95B9801
SHA-512:	029426C4F659848772E6BB1D8182EB03D2B43ADF68FCFCC1EA1C2CC7C883685DEDA3FFFDA7E071912B9BDA616AD7AF2E1CB48CE359700C1A22E1E53E81CAE34B
Malicious:	false
Preview:	# listbox.tcl --..#..# This file defines the default bindings for Tk listbox widgets..# and provides procedures that help in implementing those bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....#--------------------------------------------------------------------------..# tk::Priv elements used in this file:..#..# afterId -..Token returned by "after" for autoscanning...# listboxPrev -.The last element to be selected or deselected..#...during a selection operation...# listboxSelection -.All of the items that were selected before the..#...current selection operation (such as a mouse..#...drag) started; used to cancel an operation...#--------------------------------------------------------------------------....#--------------

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\megawidget.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	4.786615174847384
Encrypted:	false
SSDEEP:	192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
MD5:	D83ED6AC2912900040530528A0237AB3
SHA1:	2D18E42A8B96C3D71C1C6701010FDF75C1E6D5D8
SHA-256:	848258B946C002E2696CA3815A1589C8120AF5CC41FBC11BBD9A3F5754CC21AF
SHA-512:	00B4CD0D58029FC37820C163A4AE1DEAD22FB5C767BDC118659EACE26D449C362189611DFB3FAB1AC129FABFEC2CE853EA2C10D418FAE5AEB91DDC9330FF782D
Malicious:	false
Preview:	# megawidget.tcl..#..#.Basic megawidget support classes. Experimental for any use other than..#.the ::tk::IconList megawdget, which is itself only designed for use in..#.the Unix file dialogs...#..# Copyright (c) 2009-2010 Donal K. Fellows..#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES...#....package require Tk.....::oo::class create ::tk::Megawidget {.. superclass ::oo::class.. method unknown {w args} {...if {[string match .* $w]} {... [self] create $w {}$args... return $w...}...next $w {}$args.. }.. unexport new unknown.. self method create {name superclasses body} {...next $name [list \....superclass ::tk::MegawidgetClass {*}$superclasses]\;$body.. }..}....::oo::class create ::tk::MegawidgetClass {.. variable w hull options IdleCallbacks.. constructor args {...# Extract the "widget name" from the object name...set w [namespace tail [self]].....# Configure things...

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\menu.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	39499
Entropy (8bit):	4.928671503514817
Encrypted:	false
SSDEEP:	768:NKJsO5OhIzOQjJwxzire5pKVjriecYyq4Cp5Zn2:NKJsO5LOQizire54lriecYf4V
MD5:	078782CD05209012A84817AC6EF11450
SHA1:	DBA04F7A6CF34C54A961F25E024B6A772C2B751D
SHA-256:	D1283F67E435AAB0BDBE9FDAA540A162043F8D652C02FE79F3843A451F123D89
SHA-512:	79A031F7732AEE6E284CD41991049F1BB715233E011562061CD3405E5988197F6A7FB5C2BBDDD1FB9B7024047F6003A2BF161FC0EC04876EFF5335C3710D9562
Malicious:	false
Preview:	# menu.tcl --..#..# This file defines the default bindings for Tk menus and menubuttons...# It also implements keyboard traversal of menus and implements a few..# other utility procedures related to menus...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998-1999 Scriptics Corporation...# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# cursor -..Saves the -cursor option for the posted menubutton...# focus -..Saves the focus during a menu selection operation...#...Focus gets restored here when the menu is unposted...# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if..#...tk::Priv(oldGrab) is non

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\mkpsenc.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	30840
Entropy (8bit):	5.142909056222569
Encrypted:	false
SSDEEP:	768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
MD5:	983C7B78F1A0EBACAB8006D391A01FCD
SHA1:	7EA37474EA039ED7A37BFDD7D76EAE673E666283
SHA-256:	C5BDCA3ABA671F03DC4624AB5FD260490F5002491D6C619142CCF5A1A744528A
SHA-512:	A006EF9B7213E572F6FC540D1512A52C52FEC44E3A07846DE09662AE32B7191C5CF639798531847B39E4076BF9DD6314B6F5373065C04F4FEF221185B39C3117
Malicious:	false
Preview:	# mkpsenc.tcl --..#..# This file generates the postscript prolog used by Tk.....namespace eval ::tk {.. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically.. # handle any 8-bit encoding, but Tk never generates characters outside.. # ASCII)... #.. proc CreatePostscriptEncoding {} {...variable psglyphs...# Now check for known. Even if it is known, it can be other than we...# need. GhostScript seems to be happy with such approach...set result "\[\n"...for {set i 0} {$i<256} {incr i 8} {... for {set j 0} {$j<8} {incr j} {....set enc [encoding convertfrom "iso8859-1" \.....[format %c [expr {$i+$j}]]]....catch {.... set hexcode {}.... set hexcode [format %04X [scan $enc %c]]....}....if {[info exists psglyphs($hexcode)]} {.... append result "/$psglyphs($hexcode)"....} else {.... append result "/space"....}... }... append result "\n"...}...append result "\]"...return $result.. }.... # List of adobe glyph names. Converted from glyph

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgbox.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16786
Entropy (8bit):	4.717927930017041
Encrypted:	false
SSDEEP:	192:+haZOxBpK8uxGe4V88/wxY3Fxqipz4zz4zxxFzxT4OcErDxqdRRZeuC/Vj2CoopC:+hRWRG3FFjvsfCoopwITHzLHFHHAABs
MD5:	217087AB6B2A8F9D7252E311D69C3769
SHA1:	09AEB2BC5B7C7F4AB3DE4211D786C519AE0970F6
SHA-256:	A07E3A3809CED3C6C9C1E171DCA5AD1F28357734CD41B2B9DD9F58085B3D2842
SHA-512:	6E57633C924BFC16D380C014C20DD24D5727E70D4843FCEC4D7995B4DB21941EA8F2A5FD6E5386DF3364B6905D4D66B2B9595DC8FC70CFF40A2D49A92A1B6FBA
Malicious:	false
Preview:	# msgbox.tcl --..#..#.Implements messageboxes for platforms that do not have native..#.messagebox support...#..# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# Ensure existence of ::tk::dialog namespace..#..namespace eval ::tk::dialog {}....image create bitmap ::tk::dialog::b1 -foreground black \..-data "#define b1_width 32\n#define b1_height 32..static unsigned char q1_bits[] = {.. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,.. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,.. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,.. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,.. 0x04, 0x00,

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\cs.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	4.789130604359491
Encrypted:	false
SSDEEP:	48:nlw9Twd+j3gLhokqwX+hTnJgNanPNcgRhgP+5QPwJJENL:nlw9TjjwI3hTnJgNaRhgP75L
MD5:	5A8B46B85DCCBF74E2B5B820E1A7B9D1
SHA1:	980F4FC5BABA82BA0FE02F9BD03A23DF6D565BB1
SHA-256:	4DFFBEEDBF0D66D84B13088016D1A782CEAAD4DED27BE1E38842F8969C0E533F
SHA-512:	2D81FC06CF3C20E4F6314BD13AF81FDE38A9B06510584C84C6A0C8C36314F980F77D02BD8056E7EE5DE599A0620E0C0349124147334B9C141145270046B19D90
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it".. ::msgcat::mcset cs "&About..." "&O programu...".. ::msgcat::mcset cs "All Files" "V\u0161echny soubory".. ::msgcat::mcset cs "Application Error" "Chyba programu".. ::msgcat::mcset cs "Bold Italic".. ::msgcat::mcset cs "&Blue" "&Modr\341".. ::msgcat::mcset cs "Cancel" "Zru\u0161it".. ::msgcat::mcset cs "&Cancel" "&Zru\u0161it".. ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.".. ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e".. ::msgcat::mcset cs "Cl&ear" "Sma&zat".. ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu".. ::msgcat::mcset cs "Color" "Barva".. ::msgcat::mcset cs "Console" "Konzole".. ::msgcat::mcset cs "&Copy" "&Kop\355rovat".. ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout".. ::msgcat::mcset cs "&

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\da.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3987
Entropy (8bit):	4.651948695787255
Encrypted:	false
SSDEEP:	48:nRZ2uDMr05sIEzs2KkrT+XuTKN0FjDDP9:nRZzDy4kBKkrT+QpP9
MD5:	227B0F255F854460E8E5146ED7A17B85
SHA1:	99A080CAD631F21963C51A5B254BDAD3724DC866
SHA-256:	FEEF8F8AD33BB3362C845A25D6ED273C398051047D899B31790474614C7AFD2D
SHA-512:	36A4B48831316CC29686CC76DA00110EB078EC56F55A960D11AE427AA3D913C340C1E3805BF2AD40C1A8A92FC6587DA5D2C245E7501289FC3E228BE14FE49598
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset da "&Abort" "&Afbryd".. ::msgcat::mcset da "&About..." "&Om...".. ::msgcat::mcset da "All Files" "Alle filer".. ::msgcat::mcset da "Application Error" "Programfejl".. ::msgcat::mcset da "&Blue" "&Bl\u00E5".. ::msgcat::mcset da "Cancel" "Annuller".. ::msgcat::mcset da "&Cancel" "&Annuller".. ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.".. ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog".. ::msgcat::mcset da "Cl&ear" "&Ryd".. ::msgcat::mcset da "&Clear Console" "&Ryd konsolen".. ::msgcat::mcset da "Color" "Farve".. ::msgcat::mcset da "Console" "Konsol".. ::msgcat::mcset da "&Copy" "&Kopier".. ::msgcat::mcset da "Cu&t" "Kli&p".. ::msgcat::mcset da "&Delete" "&Slet".. ::msgcat::mcset da "Details >>" "Detailer".. ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" finde

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\de.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4914
Entropy (8bit):	4.6221938909259475
Encrypted:	false
SSDEEP:	96:nxLEpatioUqGBLbz4ME/XKKVN9R7S/0oYr9:epY3MkXKKxRu2r9
MD5:	2203F65BCDA61BC15AEAC4F868C6D94A
SHA1:	C4CC3975679D23892406E4E8971359A0775B1B86
SHA-256:	C0F574B14068A049E93421C73873D750C98DE28B7B77AA42FE72CBE0270A4186
SHA-512:	79F134FDAD3B12524D43BF9F59D3C04CAE30A95F591A51B82C8DF7CC8563BEA5D464AEECC457D9F60C04365E30459C447ED537AFC832BA25E1815DE06C2B81E5
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset de "&Abort" "&Abbruch".. ::msgcat::mcset de "&About..." "&\u00dcber...".. ::msgcat::mcset de "All Files" "Alle Dateien".. ::msgcat::mcset de "Application Error" "Applikationsfehler".. ::msgcat::mcset de "&Apply" "&Anwenden".. ::msgcat::mcset de "Bold" "Fett".. ::msgcat::mcset de "Bold Italic" "Fett kursiv".. ::msgcat::mcset de "&Blue" "&Blau".. ::msgcat::mcset de "Cancel" "Abbruch".. ::msgcat::mcset de "&Cancel" "&Abbruch".. ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.".. ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis".. ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen".. ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen".. ::msgcat::mcset de "Color" "Farbe".. ::msgcat::mcset de "Console" "Konsole".. ::msgcat::mcset de "&Copy" "&Kopieren".. ::msgcat::mcset de "

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\el.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8784
Entropy (8bit):	4.334043617395095
Encrypted:	false
SSDEEP:	48:tVj/F+oxBHbkI8+xTqFt2zPJ0k63fRGIUvPXrfBNnzc+zIF7meUOT7GC8MO07S0g:fj9+AHlLoozHn7fBFrMVmehCAGb
MD5:	780F863903BBDAA6C371EC0D3C7E6D59
SHA1:	DF5D435E132BEE4C076A7FC577C8C275A8B68CD5
SHA-256:	3F6F155864FE59A341BFD869735E54DD21CEE21BBD038433D9B271AD77BA3F7E
SHA-512:	091965EE912513AE1943BE840A2E757188FBA6F760F7C47BE80D06313D59B051F183E3A29D4B1CEDE1F9E54CA3CA23D75FF2C3A3672A4E71FB56F0FA76F7FA0D
Malicious:	false
Preview:	## Messages for the Greek (Hellenic - "el") language...## Please report any changes/suggestions to:..## petasis@iit.demokritos.gr....namespace eval ::tk {.. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2".. ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...".. ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1".. ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2".. ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5".. ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7".. ::msgcat::mcset el \.."Cannot change to the directory \"%1\$s\".\nPermission denied." \.."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\en.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3377
Entropy (8bit):	4.279601088621442
Encrypted:	false
SSDEEP:	24:sQ7dw5bO0V3gqmCNyoKJ6iwp/uvENv4SKEcET2hsHFjr:n7dwNOc3RmOKJQcvEl4SK1ET2hYFjr
MD5:	D48CFC9EC779085E8F6AAA7B1C40C89A
SHA1:	0CF6253BFF39F40CA0991F9B06D3394BFEA21ED2
SHA-256:	4A33B44B2E220E28EAAE7FAC407CAFE43D97C270DA58FA5F3B699A1760BFB2A4
SHA-512:	C00EC0CFB48ABE621EF625C51952BCF177CE3BC7F0DEC5276EF84C9A97C7E014806B106EA8DEE202C43F8DD54ED7261A8D899E3EE12E3F37A90C387D864463AE
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset en "&Abort".. ::msgcat::mcset en "&About...".. ::msgcat::mcset en "All Files".. ::msgcat::mcset en "Application Error".. ::msgcat::mcset en "&Apply".. ::msgcat::mcset en "Bold".. ::msgcat::mcset en "Bold Italic".. ::msgcat::mcset en "&Blue".. ::msgcat::mcset en "Cancel".. ::msgcat::mcset en "&Cancel".. ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.".. ::msgcat::mcset en "Choose Directory".. ::msgcat::mcset en "Cl&ear".. ::msgcat::mcset en "&Clear Console".. ::msgcat::mcset en "Color".. ::msgcat::mcset en "Console".. ::msgcat::mcset en "&Copy".. ::msgcat::mcset en "Cu&t".. ::msgcat::mcset en "&Delete".. ::msgcat::mcset en "Details >>".. ::msgcat::mcset en "Directory \"%1\$s\" does not exist.".. ::msgcat::mcset en "&Directory:".. ::msgcat::mcset en "&Edit".. ::msgcat::mcset en "Effects".. ::msgcat::mcset en "Error: %1\$s".. ::msgcat::mcs

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\en_gb.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.262228832346611
Encrypted:	false
SSDEEP:	3:fEGp6fRyv//mGoW8vMKEQXyVn:sooyv//xoQOOn
MD5:	3D41FC47CD9936F817EF9645D73A77ED
SHA1:	E62BBE094B71CAF4A389DE3ECD84D2EEFBA33827
SHA-256:	01238293356E82F1D298896491F8B299BB7DC9C34F299C9E756254C736DA612B
SHA-512:	B92582C32C4D7CD9DE6571CBB6B93DD693A8B5A80645468E2D02B80C339BE2B95D5B4878A0DA9AFFE9E2F98A6C38AAE9CC1FF2440146D0ED128FE8C9A92EECDB
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset en_gb Color Colour..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\eo.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3991
Entropy (8bit):	4.605712650627941
Encrypted:	false
SSDEEP:	48:n680lhrzes/QEkFH+nl0WXqQ+pISIKU/ujHMytuXcFSpxvy:n680XeqfkFelPXqVpISIKUWgRTy
MD5:	E44F82EAF651D065CA1A2D5FA3C91C25
SHA1:	F0EA1C39DED47232B21D0DCDD5179071C5717C55
SHA-256:	37FC66686349A955935CB24B0BD524E91823D2A631E63D54FDF17733C7502CBE
SHA-512:	A2ECA0A1C06406158CA8D2066639C0C6B582969D5F01C0559838E93A3AEFFFC50EB54B26328DAA81742016650FC790B1F81841E40EFE4F885626902D82989DD7
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset eo "&Abort" "&\u0108esigo".. ::msgcat::mcset eo "&About..." "Pri...".. ::msgcat::mcset eo "All Files" "\u0108ioj dosieroj".. ::msgcat::mcset eo "Application Error" "Aplikoerraro".. ::msgcat::mcset eo "&Blue" "&Blua".. ::msgcat::mcset eo "Cancel" "Rezignu".. ::msgcat::mcset eo "&Cancel" "&Rezignu".. ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u0109angi al dosierulon \"%1\$s\".\nVi ne rajtas tion.".. ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujo".. ::msgcat::mcset eo "Cl&ear" "&Klaru".. ::msgcat::mcset eo "&Clear Console" "&Klaru konzolon".. ::msgcat::mcset eo "Color" "Farbo".. ::msgcat::mcset eo "Console" "Konzolo".. ::msgcat::mcset eo "&Copy" "&Kopiu".. ::msgcat::mcset eo "Cu&t" "&Enpo\u015digu".. ::msgcat::mcset eo "&Delete" "&Forprenu".. ::msgcat::mcset eo "Details >>" "Detaloj >>".. ::msgcat::mcset eo "Directory \"%1\$s\" does not ex

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\es.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4024
Entropy (8bit):	4.536517819515934
Encrypted:	false
SSDEEP:	48:nN0T1Lt8ZYSih/aiik148aFscyTzoixccUTqjcg60Dx/H5:nN0BLSQUXy/o8re055
MD5:	4765F3C055742530E4644771EBC6C69F
SHA1:	8BEA722AC00522DEAA5B380AEEF4CA57D7A271BD
SHA-256:	D2842B80F1B521EFF2D2656A69274B5F2A8F4F5831AF2E8EE73E3C37389F981F
SHA-512:	9CA247F22797A1A1FCA42B5CDABF58262ED95EECDDD321CEB1440A60A4375923E0F511238F360D159EB5EED6F82CBBE0B8907A07CC77DB831BF97082932CD0FD
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset es "&Abort" "&Abortar".. ::msgcat::mcset es "&About..." "&Acerca de ...".. ::msgcat::mcset es "All Files" "Todos los archivos".. ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n".. ::msgcat::mcset es "&Blue" "&Azul".. ::msgcat::mcset es "Cancel" "Cancelar".. ::msgcat::mcset es "&Cancel" "&Cancelar".. ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.".. ::msgcat::mcset es "Choose Directory" "Elegir directorio".. ::msgcat::mcset es "Cl&ear" "&Borrar".. ::msgcat::mcset es "&Clear Console" "&Borrar consola".. ::msgcat::mcset es "Color".. ::msgcat::mcset es "Console" "Consola".. ::msgcat::mcset es "&Copy" "&Copiar".. ::msgcat::mcset es "Cu&t" "Cor&tar".. ::msgcat::mcset es "&Delete" "&Borrar".. ::msgcat::mcset es "Details >>" "Detalles >>".. ::msgcat::mcset es "Directory \"%1\$s\"

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\fr.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3877
Entropy (8bit):	4.630737553723335
Encrypted:	false
SSDEEP:	48:nByEWs/3lHFB9FamsIfSAzZ2eaISAxh0BRc3jC:nByEWaRNzsSSWonMAv
MD5:	E279E5FFF03E1B8E9063ABC8A499A6BD
SHA1:	80910911F6B4830BA4DCBA9A9EAD12C9F802DDC9
SHA-256:	3F2CEB4A33695AB6B56E27F61A4C60C029935BB026497D99CB2C246BCB4A63C4
SHA-512:	8333388E421AC3F342317BEBE352809B0B190EF8B044A0BAE2FE4051974D86008BAFDCB7098E9DC39A8D9E1E08FB87F54B9D3388AF2D0185FF913DB6788C5AB5
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset fr "&Abort" "&Annuler".. ::msgcat::mcset fr "About..." "\u00c0 propos...".. ::msgcat::mcset fr "All Files" "Tous les fichiers".. ::msgcat::mcset fr "Application Error" "Erreur d'application".. ::msgcat::mcset fr "&Blue" "&Bleu".. ::msgcat::mcset fr "Cancel" "Annuler".. ::msgcat::mcset fr "&Cancel" "&Annuler".. ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.".. ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire".. ::msgcat::mcset fr "Cl&ear" "Effacer".. ::msgcat::mcset fr "Color" "Couleur".. ::msgcat::mcset fr "Console".. ::msgcat::mcset fr "Copy" "Copier".. ::msgcat::mcset fr "Cu&t" "Couper".. ::msgcat::mcset fr "Delete" "Effacer".. ::msgcat::mcset fr "Details >>" "D\u00e9tails >>".. ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\"

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\hu.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.7955991577265245
Encrypted:	false
SSDEEP:	96:nkCEz2TTrKmA17fzq/Hj+pUva+fQR/a5a/Thn5kU:kTqM17u/8NiMrhb
MD5:	4F1610E0C73DAE668E3F9D9235631152
SHA1:	63EE54A6C1A69B798C65C999D5F80A7AB252B6D8
SHA-256:	E063AD7CA93F37728A65E4CD7C0433950F22607D307949F6CB056446AFEAA4FE
SHA-512:	37F4B8A9CD020A77591C09AF40FBC2FA82107B2596D31B5F30CE6ECAA225417CF7A5C62FB7A93539B0D7E930D0A44F9BF2EE6BE113F831B0A72B229444672AFD
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s".. ::msgcat::mcset hu "&About..." "N\u00e9vjegy...".. ::msgcat::mcset hu "All Files" "Minden f\u00e1jl".. ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba".. ::msgcat::mcset hu "&Blue" "&K\u00e9k".. ::msgcat::mcset hu "Cancel" "M\u00e9gsem".. ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem".. ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.".. ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa".. ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s".. ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol".. ::msgcat::mcset hu "Color" "Sz\u00edn".. ::msgcat::mcset hu "Console" "Konzol".. ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s".. ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s".. ::ms

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\it.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3765
Entropy (8bit):	4.49679862548805
Encrypted:	false
SSDEEP:	48:nmU4xnonTjwUE5Xs6ZrT8BpXAg+Wr+u92C8t7mU9nUSs:nZ4FonFE58HBpXjr+fBJs
MD5:	B74C54666A5A431A782DB691B4CA3315
SHA1:	2BC63982C14BBA8A4C451CE31540181F40CE2216
SHA-256:	806930F283FD097195C7850E3486B3815D1564529B4F8E5FA6D26F3175183BC1
SHA-512:	8120E2FFD14E0A992E254796ADDC0DC995C921BE31688C0995D7A36FE82609D78791FEF73EAF5B14E2F0D40AD256AB8DAAA07C18E6950362B28E40B71E47C0B6
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset it "&Abort" "&Interrompi".. ::msgcat::mcset it "&About..." "Informazioni...".. ::msgcat::mcset it "All Files" "Tutti i file".. ::msgcat::mcset it "Application Error" "Errore dell' applicazione".. ::msgcat::mcset it "&Blue" "&Blu".. ::msgcat::mcset it "Cancel" "Annulla".. ::msgcat::mcset it "&Cancel" "&Annulla".. ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.".. ::msgcat::mcset it "Choose Directory" "Scegli una directory".. ::msgcat::mcset it "Cl&ear" "Azzera".. ::msgcat::mcset it "&Clear Console" "Azzera Console".. ::msgcat::mcset it "Color" "Colore".. ::msgcat::mcset it "Console".. ::msgcat::mcset it "&Copy" "Copia".. ::msgcat::mcset it "Cu&t" "Taglia".. ::msgcat::mcset it "Delete" "Cancella".. ::msgcat::mcset it "Details >>" "Dettagli >>".. ::msgcat::mcset it "Directory \"%1\$s\" does not ex

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\nl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	4.524344068436489
Encrypted:	false
SSDEEP:	48:nucQswBju0x0M4U2z9KSSOzZL5KhWTqGGIrlxXvhYbL/ZO5NT+T4kiLzzdDf1SDM:nLGa0x0Mp2KSHKSv2bL/ZO5u6nRfAXU9
MD5:	E56229BAC5A8ABB90C4DD8EE3F9FF9F8
SHA1:	7527D6C3C6C84BFF0E683FFA86A21C58458EB55D
SHA-256:	0914FBA42361227D14FA281E8A9CBF57C16200B4DA1E61CC3402EF0113A512C7
SHA-512:	13649DDB06DB4BA9E39BEAF828211086A519444DA9AB5CBDD1B88B29208388189A5141F75AD94B56A348EDDE534FFADE8B19B557CB988EA4ECC9A84B135D36C1
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset nl "&Abort" "&Afbreken".. ::msgcat::mcset nl "&About..." "Over...".. ::msgcat::mcset nl "All Files" "Alle Bestanden".. ::msgcat::mcset nl "Application Error" "Toepassingsfout".. ::msgcat::mcset nl "&Apply" "Toepassen".. ::msgcat::mcset nl "Bold" "Vet".. ::msgcat::mcset nl "Bold Italic" "Vet Cursief".. ::msgcat::mcset nl "&Blue" "&Blauw".. ::msgcat::mcset nl "Cancel" "Annuleren".. ::msgcat::mcset nl "&Cancel" "&Annuleren".. ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.".. ::msgcat::mcset nl "Choose Directory" "Kies map".. ::msgcat::mcset nl "Cl&ear" "Wissen".. ::msgcat::mcset nl "&Clear Console" "&Wis Console".. ::msgcat::mcset nl "Color" "Kleur".. ::msgcat::mcset nl "Console".. ::msgcat::mcset nl "&Copy" "Kopi\u00ebren".. ::msgcat::mcset nl "Cu&t" "Knippen".. ::msgcat::mcset nl "&Dele

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\pl.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	4.799369674927008
Encrypted:	false
SSDEEP:	48:nXra9E310fwNCeVsvSmy6MZv8lWBTDGdZ3tojTyrEQmAUCIx4wBxZ:n7a9Q0fyw5MQWgP3uoZChB3
MD5:	8CFA2E38822303FDCB55AE3277F0B81B
SHA1:	447F28A5064FCEA019C60B3F9B6D50CD43C2D0E3
SHA-256:	EACEB1F08DE0863CCF726881E07FE5B135EA09646C5253E0CBF7DDB987EB0D92
SHA-512:	E38BA9059AFF55C2B22A4AE24D6A76149C76DBA8BF8646AE81D6E07D7ED490D0605034B29D9AC848E6685C8EC26A3DBE5B2EAF462B14D96376E80076FBE7082A
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset pl "&Abort" "&Przerwij".. ::msgcat::mcset pl "&About..." "O programie...".. ::msgcat::mcset pl "All Files" "Wszystkie pliki".. ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie".. ::msgcat::mcset pl "&Apply" "Zastosuj".. ::msgcat::mcset pl "Bold" "Pogrubienie".. ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa".. ::msgcat::mcset pl "&Blue" "&Niebieski".. ::msgcat::mcset pl "Cancel" "Anuluj".. ::msgcat::mcset pl "&Cancel" "&Anuluj".. ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.".. ::msgcat::mcset pl "Choose Directory" "Wybierz katalog".. ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107".. ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119".. ::msgcat::mcset pl "Color" "Kolor".. ::msgcat::mcset pl "Console" "Konsola".. ::msgcat::mcset pl "&Copy" "&Kopiu

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\pt.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3987
Entropy (8bit):	4.63232183429232
Encrypted:	false
SSDEEP:	48:nHOT1mM5qHHxiBHb3joTjtcp2UqMxweo6VvilCMKKXx9vjM:nHOT1mMQnwB/otcUUpGX6VPVoLjM
MD5:	4018686F2A8E299D86BDB1478BC97896
SHA1:	0EECE3D57F2EA5EECE8157B06F3AFB97E1F2551A
SHA-256:	D687F71F0432BB0D02EFDF576E526D2C19D4136F76C41A3224A2F034168F3F34
SHA-512:	4D730068B2A21E1D6004205B10A9D0D5EE9683FEB03B6FB673E8B9B94ED6BE468086A52DFE97C4DBF35A07CBB2C5E276DF0952A06C78E029D53D796CB6FCC8DF
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset pt "&Abort" "&Abortar".. ::msgcat::mcset pt "About..." "Sobre ...".. ::msgcat::mcset pt "All Files" "Todos os arquivos".. ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o".. ::msgcat::mcset pt "&Blue" "&Azul".. ::msgcat::mcset pt "Cancel" "Cancelar".. ::msgcat::mcset pt "&Cancel" "&Cancelar".. ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.".. ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio".. ::msgcat::mcset pt "Cl&ear" "Apagar".. ::msgcat::mcset pt "&Clear Console" "Apagar Console".. ::msgcat::mcset pt "Color" "Cor".. ::msgcat::mcset pt "Console".. ::msgcat::mcset pt "&Copy" "Copiar".. ::msgcat::mcset pt "Cu&t" "Recortar".. ::msgcat::mcset pt "&Delete" "Excluir".. ::msgcat::mcset pt "Details >>" "Detalhes >>".. ::msgcat::mcset pt "D

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\ru.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7289
Entropy (8bit):	4.396417984959623
Encrypted:	false
SSDEEP:	96:n9MEBG2T4YHCIxqEMk0Y2xX6wKl9zFAWS2yuV9cDcPRjnHQuNFNfz5hVV9aWTRcD:dreFqN1T+oRR/F1RHR6
MD5:	803E0F9930828B103B03B55EDA173CB8
SHA1:	429A30A7546123B1895C4317C65A97EBCBD16F35
SHA-256:	8715E9927BA925AE8099EDF71A3D701FE396FC0E4DF039CEA7DC84120E101F47
SHA-512:	379739A2C84E35C1AC70EFA9F704D3D1455741FEB60F4A1D9B0E0FD6CC3279F66A0C63C0FADFD861498D3FE13AB9E633F2C1BB05E76B3206DECEA253FFB8E33C
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c".. ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...".. ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b".. ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435".. ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439".. ::msgcat::mcset ru "Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430".. ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \....."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \"%1\$s\".\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\msgs\sv.msg

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3908
Entropy (8bit):	4.658068191079967
Encrypted:	false
SSDEEP:	48:nT8A5cbwKmtI1sE9xt6BDyepTr2iiK/yGqXZlBp9:nD5cb2extDepTCnVpJ9
MD5:	1D085A672A6FCDECEF5D7D876E4C74A3
SHA1:	1A40C03F15A6926359CA3E5C0A809485CAD28AEE
SHA-256:	A6821A13D34FB31F1827294B82C4BF9586BB255CA14F78C3ACE11181F42EF211
SHA-512:	981EDEEF5E4C915BB8F10044096B412D1855CAD08F98A448C6C0A49A54222945EBD102DDCB9525535E0FB19313C319155FA59384605B2C36CC8B4A58693D57E7
Malicious:	false
Preview:	namespace eval ::tk {.. ::msgcat::mcset sv "&Abort" "&Avsluta".. ::msgcat::mcset sv "&About..." "&Om...".. ::msgcat::mcset sv "All Files" "Samtliga filer".. ::msgcat::mcset sv "Application Error" "Programfel".. ::msgcat::mcset sv "&Blue" "&Bl\u00e5".. ::msgcat::mcset sv "Cancel" "Avbryt".. ::msgcat::mcset sv "&Cancel" "&Avbryt".. ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.".. ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp".. ::msgcat::mcset sv "Cl&ear" "&Radera".. ::msgcat::mcset sv "&Clear Console" "&Radera konsollen".. ::msgcat::mcset sv "Color" "F\u00e4rg".. ::msgcat::mcset sv "Console" "Konsoll".. ::msgcat::mcset sv "&Copy" "&Kopiera".. ::msgcat::mcset sv "Cu&t" "Klipp u&t".. ::msgcat::mcset sv "&Delete" "&Radera".. ::msgcat::mcset sv "Details >>" "Detaljer >>".. ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mapp

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\obsolete.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5772
Entropy (8bit):	5.038729016734604
Encrypted:	false
SSDEEP:	96:onzxtm7EMgdMjwPqeuAmz9LD1kFIQETZqoIK/RLf7w:ozxtm7qUwi79l0sZqoBJLDw
MD5:	FC9E03823BEB08DAF7681C09D106DF7D
SHA1:	7D06FC8F98140E0FFAA2571BD522FC772E58DE54
SHA-256:	540EEECBA17207A56290BAFFDAE882BBD4F88364791204AD5D14C7BEDD022CCC
SHA-512:	2B5BAD311A703A0FE2ED67ACE311BAD4C767BCD23DFC3D9ABDF5C3604146A6A15D6BD13A14BDEFCDB2B602C708AACFAB404E96FCBA7C546AD0DAECD4BE2EB34A
Malicious:	false
Preview:	# obsolete.tcl --..#..# This file contains obsolete procedures that people really shouldn't..# be using anymore, but which are kept around for backward compatibility...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# The procedures below are here strictly for backward compatibility with..# Tk version 3.6 and earlier. The procedures are no longer needed, so..# they are no-ops. You should not use these procedures anymore, since..# they may be removed in some future release.....proc tk_menuBar args {}..proc tk_bindForTraversal args {}....# ::tk::classic::restore --..#..# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic..# Tk widgets...#..# The value following an 'option add' call is the new 8.5 value...#..namespace eval ::tk::classic {.. # This may need t

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\optMenu.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1629
Entropy (8bit):	4.784780799273752
Encrypted:	false
SSDEEP:	48:g2hBuOrlkBytcqYXRE5fvvXq1EhJPqOj6Wf0cVlN:gQ6q4E5HCqhBqOhcaD
MD5:	9B7A8FD2C6B538FF31BDC380452C6DE3
SHA1:	3F915BFE85CED9F6C7E9A352718770E9F14F098E
SHA-256:	40CA505C9784B0767D4854485C5C311829594A4FCBDFD7251E60E6BB7EA74FD1
SHA-512:	43937152B844BE1E597E99DA1270E54AB1D572AE89CB759E6D41C18C9C8044CCC15A6925F9C5AF617AE9EC1404E78C2733231F4D5C6CFE4D23C546387B1FC328
Malicious:	false
Preview:	# optMenu.tcl --..#..# This file defines the procedure tk_optionMenu, which creates..# an option button and its associated menu...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_optionMenu --..# This procedure creates an option button named $w and an associated..# menu. Together they provide the functionality of Motif option menus:..# they can be used to select one of many values, and the current value..# appears in the global variable varName, as well as in the text of..# the option menubutton. The name of the menu is returned as the..# procedure's result, so that the caller can use it to change configuration..# options on the menu or otherwise manipulate it...#..# Arguments:..# w -...The name to use for the menubutton...# varName -..Global variable to hold the currently

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\palette.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8418
Entropy (8bit):	4.964814946573677
Encrypted:	false
SSDEEP:	192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
MD5:	4CE08A10CD9AE941654B8C679DF669F3
SHA1:	F1288BABCA698FD18C3BD221E6AE6C02F2975AAE
SHA-256:	849B4C57E4644E51BEAEAEB3AE59B7FF067E582ECD10F1B2CAF6B6E72F11F506
SHA-512:	0F37539DA3540E9B1DA7B0377E3BBB359B71DB4271D63BC9501E95931B4E609E8CB91DC2F7B08A6452598D4A0D58C6A2034049A215000EEF0F93A9963D003632
Malicious:	false
Preview:	# palette.tcl --..#..# This file contains procedures that change the color palette used..# by Tk...#..# Copyright (c) 1995-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk_setPalette --..# Changes the default color scheme for a Tk application by setting..# default colors in the option database and by modifying all of the..# color options for existing widgets that have the default value...#..# Arguments:..# The arguments consist of either a single color name, which..# will be used as the new background color (all other colors will..# be computed from this) or an even number of values consisting of..# option names and values. The name for an option is the one used..# for the option database, such as activeForeground, not -activeforeground.....proc ::tk_setPalette {args} {.. if {[winfo depth .] == 1} {...# Just return on monochrome displays, otherwise errors

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\panedwindow.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5370
Entropy (8bit):	4.979530133775421
Encrypted:	false
SSDEEP:	96:ssAXzkTQ9w5fLQYkJLZkRXKUXfwyZTq2sz8j2Em3YKhrYK:jAXgE0DQpJLGR6UXfpqnzG3m3YKhrYK
MD5:	286C01A1B12261BC47F5659FD1627ABD
SHA1:	4CA36795CAB6DFE0BBBA30BB88A2AB71A0896642
SHA-256:	AA4F87E41AC8297F51150F2A9F787607690D01793456B93F0939C54D394731F9
SHA-512:	D54D5A89B7408A9724A1CA1387F6473BDAD33885194B2EC5A524C7853A297FD65CE2A57F571C51DB718F6A00DCE845DE8CF5F51698F926E54ED72CDC81BCFE54
Malicious:	false
Preview:	# panedwindow.tcl --..#..# This file defines the default bindings for Tk panedwindow widgets and..# provides procedures that help in implementing those bindings.....bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }..bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }....bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }..bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }....bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}..bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}....bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }....bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }....# Initialize namespace..namespace eval ::tk::panedwindow {}....# ::tk::panedwindow::MarkSash --..#..# Handle marking the correct sash for possible dragging..#..# Arguments:..# w..the widget..# x..widget local x coord..# y..widget local y coord..# proxy.

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\pkgIndex.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.040809246948068
Encrypted:	false
SSDEEP:	6:CsUgabAOgjDnzJNBc6ynID/cL4RpncleXN17MQ9PQqBIQ08hof7MQ9PQqBIQei:lGbyntNO6LYZliPBIUhkPBIFi
MD5:	3367CE12A4BA9BAAF7C5127D7412AA6A
SHA1:	865C775BB8F56C3C5DFC8C71BFAF9EF58386161D
SHA-256:	3F2539E85E2A9017913E61FE2600B499315E1A6F249A4FF90E0B530A1EEB8898
SHA-512:	F5D858F17FE358762E8FDBBF3D78108DBA49BE5C5ED84B964143C0ADCE76C140D904CD353646EC0831FF57CD0A0AF864D1833F3946A235725FFF7A45C96872EB
Malicious:	false
Preview:	if {![package vsatisfies [package provide Tcl] 8.6.0]} return..if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]...\|\| ([info exists ::argv] && ("-display" in $::argv)))} {.. package ifneeded Tk 8.6.12 [list load [file join $dir .. .. bin libtk8.6.dll]]..} else {.. package ifneeded Tk 8.6.12 [list load [file join $dir .. .. bin tk86t.dll]]..}..

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\safetk.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	4.891666209090638
Encrypted:	false
SSDEEP:	192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
MD5:	21A3AC11146EC26784C0E729D8D644D0
SHA1:	C7E0918E8692C42C1D1DD1BBCBFFF22A85979B69
SHA-256:	579701605669AADFFBCDB7E3545C68442495428EE6E93C2D3A3133583BCD3D33
SHA-512:	724ED83B989AD9033BEC4211EE50E4C9E85B51054C518CDF7E02D0ED0416F636B9F38C0B0D29F8F4F7F465B77C7D2E01D0918D2C2C3FEC4C7739EA982302FA2E
Malicious:	false
Preview:	# safetk.tcl --..#..# Support procs to use Tk in safe interpreters...#..# Copyright (c) 1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# see safetk.n for documentation....#..#..# Note: It is now ok to let untrusted code being executed..# between the creation of the interp and the actual loading..# of Tk in that interp because the C side Tk_Init will..# now look up the parent interp and ask its safe::TkInit..# for the actual parameters to use for it's initialization (if allowed),..# not relying on the child state...#....# We use opt (optional arguments parsing)..package require opt 0.4.1;....namespace eval ::safe {.... # counter for safe toplevels.. variable tkSafeId 0..}....#..# tkInterpInit : prepare the child interpreter for tk loading..# most of the real job is done by loadTk..# returns the child name (tkInterpInit

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\scale.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8056
Entropy (8bit):	4.979589163397994
Encrypted:	false
SSDEEP:	96:GSusE8YOdpO4aDtao+QYa6t2jooB6ajpaqa5xQz9MUKOC9dLrVx:KsbYQO48t+QYa+NkFjpaQz5KX9dLrVx
MD5:	857ADD6060A986063B0ED594F6B0CD26
SHA1:	B1981D33DDEA81CFFFA838E5AC80E592D9062E43
SHA-256:	0DA2DC955FFD71062A21C3B747D9D59D66A5B09A907B9ED220BE1B2342205A05
SHA-512:	7D9829565EFC8CDBF9249913DA95B02D8DADFDB3F455FD3C10C5952B5454FE6E54D95C07C94C1E0D7568C9742CAA56182B3656E234452AEC555F0FCB76A59FB1
Malicious:	false
Preview:	# scale.tcl --..#..# This file defines the default bindings for Tk scale widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1995 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for entries...#-------------------------------------------------------------------------....# Standard Motif bindings:....bind Scale <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. tk::ScaleActivate %W %x %y..}..bind Scale <Motion> {.. tk::ScaleActivate %W %x %y..}..bind Scale <Leave> {.. if {$tk_strictMotif} {...%W configure -activebackground

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\scrlbar.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13188
Entropy (8bit):	5.063842571848725
Encrypted:	false
SSDEEP:	192:Gf7RV8ei32PHKT8H2wwucyRlXn+kl1nBKp4nu5FCyK:2mei3qHKT8WPurnXn+I1nBg4nu5MyK
MD5:	5249CD1E97E48E3D6DEC15E70B9D7792
SHA1:	612E021BA25B5E512A0DFD48B6E77FC72894A6B9
SHA-256:	EEC90404F702D3CFBFAEC0F13BF5ED1EBEB736BEE12D7E69770181A25401C61F
SHA-512:	E4E0AB15EB9B3118C30CD2FF8E5AF87C549EAA9B640FFD809A928D96B4ADDEFB9D25EFDD1090FBD0019129CDF355BB2F277BC7194001BA1D2ED4A581110CEAFC
Malicious:	false
Preview:	# scrlbar.tcl --..#..# This file defines the default bindings for Tk scrollbar widgets...# It also provides procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for scrollbars...#-------------------------------------------------------------------------....# Standard Motif bindings:..if {[tk windowingsystem] eq "x11" \|\| [tk windowingsystem] eq "aqua"} {....bind Scrollbar <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. %W activate [%W identify %x %y]..}..bind Scrollbar <Motion> {.. %W activate [%

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\spinbox.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16526
Entropy (8bit):	5.033807343600737
Encrypted:	false
SSDEEP:	384:IMpfy/Ku9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfy/Ku9Tx8WODTp2zPP
MD5:	77DFE1BACCD165A0C7B35CDEAA2D1A8C
SHA1:	426BA77FC568D4D3A6E928532E5BEB95388F36A0
SHA-256:	2FF791A44406DC8339C7DA6116E6EC92289BEE5FC1367D378F48094F4ABEA277
SHA-512:	E56DB85296C8661AB2EA0A56D9810F1A4631A9F9B41337560CBE38CCDF7DD590A3E65C22B435CE315EFF55EE5B8E49317D4E1B7577E25FC3619558015DD758EB
Malicious:	false
Preview:	# spinbox.tcl --..#..# This file defines the default bindings for Tk spinbox widgets and provides..# procedures that help in implementing those bindings. The spinbox builds..# off the entry widget, so it can reuse Entry bindings and procedures...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1999-2000 Jeffrey Hobbs..# Copyright (c) 2000 Ajuba Solutions..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#.

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\tclIndex

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	20523
Entropy (8bit):	4.786929402401609
Encrypted:	false
SSDEEP:	384:eeVL0UI9Ms++J7VT/hc+ISyNsATbOan/uW/UFQ1gs1gxtKZufe2SvdJcmq/YbhEB:eeF0UI9Ms++J7VT/hc+ISyCATbOan2W+
MD5:	9378397DD3DCA9DFB181F6F512B15631
SHA1:	4F95DD6B658B6A912725DC7D6226F8414020D6C7
SHA-256:	B04B1A675572E6FCD12C5FE82C4FD0930395548436FF93D848BF340AE202E7E3
SHA-512:	D28CC3C8F3D0B1B2371CBD9EE29AC6881BABD8A07C762FF8F3284449998EE44FA44752CC8AB0DE47A3492776CE1D13BC8EA18CFDBDF710639D2D62D02CB917A9
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]]..set auto_index(::tk::ButtonAutoInvoke) [list sou

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\tearoff.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5309
Entropy (8bit):	4.74935501162253
Encrypted:	false
SSDEEP:	96:wfQXIqAv6iEwYtKVlPBnXWASbvMsDjXKpQQkK2tTsSZQ7Fowqm2K5r:wf+IqI6iU43PJYbvMsDjXKpsK2tISyZV
MD5:	5F042DE8AD8941C7B9EF6D7BE06C86E4
SHA1:	A4DFCEA2ACCAC2E85EAAA186DC765086D1E3AA3C
SHA-256:	A4A8568633F827B54326640E6D1C3FDE4978EDC9E9FA1FB1D7B58F189DF1B1DC
SHA-512:	E92A00028696A1557666CAB1C25AE6B63F25D75A9811BFAC56DFC069ECC769CC751B71CC81FA85C9CDE8F7FB6D7121EB64B58548CEE8AFE3F6C4A5C243507216
Malicious:	false
Preview:	# tearoff.tcl --..#..# This file contains procedures that implement tear-off menus...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk::TearoffMenu --..# Given the name of a menu, this procedure creates a torn-off menu..# that is identical to the given menu (including nested submenus)...# The new torn-off menu exists as a toplevel window managed by the..# window manager. The return value is the name of the new menu...# The window is created at the point specified by x and y..#..# Arguments:..# w -...The menu to be torn-off (duplicated)...# x -...x coordinate where window is created..# y -...y coordinate where window is created....proc ::tk::TearOffMenu {w {x 0} {y 0}} {.. # Find a unique name to use for the torn-off menu. Find the first.. # ancestor of w that is a

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\text.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	34961
Entropy (8bit):	4.958000555615616
Encrypted:	false
SSDEEP:	768:Rp4LaQDlJrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:R/K8aymTGs1b0xncn6KR
MD5:	7C2AC370DE0B941AE13572152419C642
SHA1:	7598CC20952FA590E32DA063BF5C0F46B0E89B15
SHA-256:	4A42AD370E0CD93D4133B49788C0B0E1C7CD78383E88BACB51CB751E8BFDA15E
SHA-512:	8325A33BFD99F0FCE4F14ED5DC6E03302F6FFABCE9D1ABFEFC24D16A09AB3439A4B753CBF06B28D8C95E4DDABFB9082C9B030619E8955A7E656BD6C61B9256C3
Malicious:	false
Preview:	# text.tcl --..#..# This file defines the default bindings for Tk text widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of ::tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# char -..Character position on the line; kept in order..#...to allow moving up or down past short lines while..#...still remembering the desired position...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button we

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\tk.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24266
Entropy (8bit):	5.1375522500072925
Encrypted:	false
SSDEEP:	384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
MD5:	338184E46BD23E508DAEDBB11A4F0950
SHA1:	437DB31D487C352472212E8791C8252A1412CB0E
SHA-256:	0F617D96CBF213296D7A5F7FCFFBB4AE1149840D7D045211EF932E8DD66683E9
SHA-512:	8FB8A353EECD0D19638943F0A9068DCCEBF3FB66D495EA845A99A89229D61A77C85B530F597FD214411202055C1FAA9229B6571C591C9F4630490E1EB30B9CD3
Malicious:	false
Preview:	# tk.tcl --..#..# Initialization script normally executed in the interpreter for each Tk-based..# application. Arranges class bindings for widgets...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....# Verify that we have Tk binary and script components from the same release..package require -exact Tk 8.6.12.....# Create a ::tk namespace..namespace eval ::tk {.. # Set up the msgcat commands.. namespace eval msgcat {...namespace export mc mcmax.. if {[interp issafe] \|\| [catch {package require msgcat}]} {.. # The msgcat package is not available. Supply our own.. # minimal replacement... proc mc {src args} {.. return [format $src {*}$args].. }.. proc mc

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\tkfbox.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	39613
Entropy (8bit):	5.1830399016984146
Encrypted:	false
SSDEEP:	768:+oj+AqE9cn9eJNgDN0/vsKulXgx65Eh6pSb:+6+ZM/gAEdix65Ehpb
MD5:	47635811AAA1CEB26EDA3930D91C8855
SHA1:	F071757BED525AF8CA21BFA0FCA89EC3F95AA278
SHA-256:	595A0B05EB2CBD4CF489E57624B509FC3B4885E6410CA6416E7521D23694373D
SHA-512:	A374126EC28E70C89EE247A591C2168DF55E110F260664F46F470C53CDA3A2411C3775391FC8FD575CEE69CD1768512E68CDDCB335204D00B9EB81906AC79344
Malicious:	false
Preview:	# tkfbox.tcl --..#..#.Implements the "TK" standard file selection dialog box. This dialog..#.box is used on the Unix platforms whenever the tk_strictMotif flag is..#.not set...#..#.The "TK" standard file selection dialog box is similar to the file..#.selection dialog box on Win95(TM). The user can navigate the..#.directories by clicking on the folder icons or by selecting the..#."Directory" option menu. The user can select files by clicking on the..#.file icons or by entering a filename in the "Filename:" entry...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {.. namespace import -force ::tk::msgcat::*.. variable showHiddenBtn 0.. variable showHiddenVar 1.... # Create the images if they did not already exist... if {![info exists ::tk::Priv(updirImage)]} {...s

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\altTheme.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3713
Entropy (8bit):	4.915055696129498
Encrypted:	false
SSDEEP:	48:InrWdo3L7Fe5qusQGdrMNnQbfIxEOxE0kFgG0FgGouox9FrGVuwg3kNcT+z5UlEr:UWdsOBn/1i+pqxwNjKs
MD5:	01F28512E10ACBDDF93AE2BB29E343BC
SHA1:	C9CF23D6315218B464061F011E4A9DC8516C8F1F
SHA-256:	AE0437FB4E0EBD31322E4EACA626C12ABDE602DA483BB39D0C5EE1BC00AB0AF4
SHA-512:	FE3BAE36DDB67F6D7A90B7A91B6EC1A009CF26C0167C46635E5A9CEAEC9083E59DDF74447BF6F60399657EE9604A2314B170F78A921CF948B2985DDF02A89DA6
Malicious:	false
Preview:	#..# Ttk widget set: Alternate theme..#....namespace eval ttk::theme::alt {.... variable colors.. array set colors {...-frame .."#d9d9d9"...-window.."#ffffff"...-darker ."#c3c3c3"...-border.."#414141"...-activebg ."#ececec"...-disabledfg."#a3a3a3"...-selectbg."#4a6984"...-selectfg."#ffffff"...-altindicator."#aaaaaa".. }.... ttk::style theme settings alt {.....ttk::style configure "." \... -background .$colors(-frame) \... -foreground .black \... -troughcolor.$colors(-darker) \... -bordercolor.$colors(-border) \... -selectbackground .$colors(-selectbg) \... -selectforeground .$colors(-selectfg) \... -font ..TkDefaultFont \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)] ;...ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -padding "1 1" \... -reli

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\aquaTheme.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	4.940737732832436
Encrypted:	false
SSDEEP:	48:WdbclJFvlyLi+8OWXgQahpvAdNutdHrFBlCFBK2tdHkFBlhKgY1geAWUWeFVvtdp:C8EQPNeWgFeqdXj
MD5:	F07A3A86362E9E253BE91F59714FE134
SHA1:	84DE1AB2EAE62E4B114F0E613BD94955AFA9E6C7
SHA-256:	E199CC9C429B35A09721D0A22543C3729E2B8462E68DFA158C0CEC9C70A0D79D
SHA-512:	324EAF9F857076CA4FECB26D8DF76F8BB1D3F15EAE55D6B6C9689BF1682B306AC7A3592B6A518D23F9FE4DC21EFB6ACF1ECA948F889FA1ADFFA0E12C0BEAB57F
Malicious:	false
Preview:	#..# Aqua theme (OSX native look and feel)..#....namespace eval ttk::theme::aqua {.. ttk::style theme settings aqua {.....ttk::style configure . \... -font TkDefaultFont \... -background systemWindowBackgroundColor \... -foreground systemLabelColor \... -selectbackground systemSelectedTextBackgroundColor \... -selectforeground systemSelectedTextColor \... -selectborderwidth 0 \... -insertwidth 1.....ttk::style map . \... -foreground {....disabled systemDisabledControlTextColor....background systemLabelColor} \... -selectbackground {....background systemSelectedTextBackgroundColor....!focus systemSelectedTextBackgroundColor} \... -selectforeground {....background systemSelectedTextColor....!focus systemSelectedTextColor}.....# Button...ttk::style configure TButton -anchor center -width -6 \... -foreground systemControlTextColor...ttk::style map TButton \... -foreground {....pressed white... {alternate !pressed !background} white}...ttk::styl

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\button.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	4.917794267131833
Encrypted:	false
SSDEEP:	48:A5N+EqJWR1eTC01cG61ELLgrDgk1JgQ6TQGvhV5giT6TUP+3JWMHTeJ:kN+RQfccG61ooDgQ6dNT6TUP+PHO
MD5:	D4BF1AF5DCDD85E3BD11DBF52EB2C146
SHA1:	B1691578041319E671D31473A1DD404855D2038B
SHA-256:	E38A9D1F437981AA6BF0BDD074D57B769A4140C0F7D9AFF51743FE4ECC6DFDDF
SHA-512:	25834B4B231F4FF1A88EEF67E1A102D1D0546EC3B0D46856258A6BE6BBC4B381389C28E2EB60A01FF895DF24D6450CD16CA449C71F82BA53BA438A4867A47DCD
Malicious:	false
Preview:	#..# Bindings for Buttons, Checkbuttons, and Radiobuttons...#..# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed"..# state; widgets remain "active" if the pointer is dragged out...# This doesn't seem to be conventional, but it's a nice way..# to provide extra feedback while the grab is active...# (If the button is released off the widget, the grab deactivates and..# we get a <Leave> event then, which turns off the "active" state)..#..# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are..# delivered to the widget which received the initial <Button>..# event. However, Tk [grab]s (#1223103) and menu interactions..# (#1222605) can interfere with this. To guard against spurious..# <Button1-Enter> events, the <Button1-Enter> binding only sets..# the pressed state if the button is currently active...#....namespace eval ttk::button {}....bind TButton <Enter> ..{ %W instate !disabled {%W state active} }..bind TButton <Leave>..{ %W state !active }..bind TButton <s

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\clamTheme.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4809
Entropy (8bit):	4.905115353394083
Encrypted:	false
SSDEEP:	48:KrS4se/XhW03cC7TxPp/uo1ZUb0WZvSoetCgV+tMWG3xT3xgNB4x76FAuoxVYuIJ:oS4sSjWwFAGkhiP3xT3xL6B2bbe
MD5:	2B20E7B2E6BDDBEB14F5F63BF38DBF24
SHA1:	43DB48094C4BD7DE3B76AFBC051D887FEFE9887E
SHA-256:	CFFC59931FDD1683AD23895E92522CF49B099128753FCDFF34374024E42CF995
SHA-512:	1EB5EA78D26D18EAD6563AFBF1798F71723001DCC945E7DB3E4368564D0563029BE3565876AD8CB97331CFE34B2A0A313FA1BF252B87049160FE5DCD65434775
Malicious:	false
Preview:	#..# "Clam" theme...#..# Inspired by the XFCE family of Gnome themes...#....namespace eval ttk::theme::clam {.. variable colors.. array set colors {...-disabledfg.."#999999"...-frame .."#dcdad5"...-window .."#ffffff"...-dark..."#cfcdc8"...-darker .."#bab5ab"...-darkest.."#9e9a91"...-lighter.."#eeebe7"...-lightest .."#ffffff"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-altindicator.."#5895bc"...-disabledaltindicator."#a0a0a0".. }.... ttk::style theme settings clam {.....ttk::style configure "." \... -background $colors(-frame) \... -foreground black \... -bordercolor $colors(-darkest) \... -darkcolor $colors(-dark) \... -lightcolor $colors(-lighter) \... -troughcolor $colors(-darker) \... -selectbackground $colors(-selectbg) \... -selectforeground $colors(-selectfg) \... -selectborderwidth 0 \... -font TkDefaultFont \... ;.....ttk::style map "." \... -background [list disabled $colors(-frame) \..... active $colors(-lighter)] \..

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\classicTheme.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3864
Entropy (8bit):	4.935603001745302
Encrypted:	false
SSDEEP:	48:zcJZjdWs+WVB4ULsMF7tnvnuSuqo5DKxiFgG0FgGHx9FrGTtu/3Kt+iW2PbuAk38:zcJZEstB4UoituSm+VtYErY
MD5:	0205663142775F4EF2EB104661D30979
SHA1:	452A0D613288A1CC8A1181C3CC1167E02AA69A73
SHA-256:	424BBA4FB6836FEEBE34F6C176ED666DCE51D2FBA9A8D7AA756ABCBBAD3FC1E3
SHA-512:	FB4D212A73A6F5A8D2774F43D310328B029B52B35BEE133584D8326363B385AB7AA4AE25E98126324CC716962888321E0006E5F6EF8563919A1D719019B2D117
Malicious:	false
Preview:	#..# "classic" Tk theme...#..# Implements Tk's traditional Motif-like look and feel...#....namespace eval ttk::theme::classic {.... variable colors; array set colors {...-frame.."#d9d9d9"...-window.."#ffffff"...-activebg."#ececec"...-troughbg."#c3c3c3"...-selectbg."#c3c3c3"...-selectfg."#000000"...-disabledfg."#a3a3a3"...-indicator."#b03060"...-altindicator."#b05e5e".. }.... ttk::style theme settings classic {...ttk::style configure "." \... -font..TkDefaultFont \... -background..$colors(-frame) \... -foreground..black \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -troughcolor.$colors(-troughbg) \... -indicatorcolor.$colors(-frame) \... -highlightcolor.$colors(-frame) \... -highlightthickness.1 \... -selectborderwidth.1 \... -insertwidth.2 \... ;.....# To match pre-Xft X11 appearance, use:...#.ttk::style configure . -font {Helvetica 12 bold}.....ttk::style map "." -background \... [list disabled

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\combobox.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12718
Entropy (8bit):	5.063548300335668
Encrypted:	false
SSDEEP:	192:otLzBJ9SfinaXUBLPYXlk7fKiLH+AzIoJdJwGknmyLsxoVEQGITse8g5sarkT32e:wB5aXmLPYXmrKxLL7A
MD5:	F7065D345A4BFB3127C3689BF1947C30
SHA1:	9631C05365B0F5A36E4CA5CBA83628CCD7FCBDE1
SHA-256:	68EED4AF6D2EC5B3EA24B1122A704B040366CBE2F458103137479352FFA1475A
SHA-512:	74B99B9E326680150DD5EC7263192691BCD8A71B2A4EE7F3177DEDDD43E924A7925085C6D372731A70570F96B3924450255B2F54CA3B9C44D1160CA37E715B00
Malicious:	false
Preview:	#..# Combobox bindings...#..# <<NOTE-WM-TRANSIENT>>:..#..#.Need to set [wm transient] just before mapping the popdown..#.instead of when it's created, in case a containing frame..#.has been reparented [#1818441]...#..#.On Windows: setting [wm transient] prevents the parent..#.toplevel from becoming inactive when the popdown is posted..#.(Tk 8.4.8+)..#..#.On X11: WM_TRANSIENT_FOR on override-redirect windows..#.may be used by compositing managers and by EWMH-aware..#.window managers (even though the older ICCCM spec says..#.it's meaningless)...#..#.On OSX: [wm transient] does utterly the wrong thing...#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]...#.The "noActivates" attribute prevents the parent toplevel..#.from deactivating when the popdown is posted, and is also..#.necessary for "help" windows to receive mouse events...#."hideOnSuspend" makes the popdown disappear (resp. reappear)..#.when the parent toplevel is deactivated (resp. reactivated)...#.(see [#18147

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\cursors.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4827
Entropy (8bit):	4.843146795750702
Encrypted:	false
SSDEEP:	96:DRYEqfLDxGmxGUz4GUtaPT6t6brv0q3O4Uu0:DWEqTDbxdWaPqe5PUr
MD5:	18EC3E60B8DD199697A41887BE6CE8C2
SHA1:	13FF8CE95289B802A5247B1FD9DEA90D2875CB5D
SHA-256:	7A2ED9D78FABCAFFF16694F2F4A2E36FF5AA313F912D6E93484F3BCD0466AD91
SHA-512:	4848044442EFE75BCF1F89D8450C8ECBD441F38A83949A3CD2A56D9000CACAA2EA440CA1B32C856AB79358ACE9C7E3F70DDF0EC54AA93866223D8FEF76930B19
Malicious:	false
Preview:	#..# Map symbolic cursor names to platform-appropriate cursors...#..# The following cursors are defined:..#..#.standard.-- default cursor for most controls..#.""..-- inherit cursor from parent window..#.none..-- no cursor..#..#.text..-- editable widgets (entry, text)..#.link..-- hyperlinks within text..#.crosshair.-- graphic selection, fine control..#.busy..-- operation in progress..#.forbidden.-- action not allowed..#..#.hresize..-- horizontal resizing..#.vresize..-- vertical resizing..#..# Also resize cursors for each of the compass points,..# {nw,n,ne,w,e,sw,s,se}resize...#..# Platform notes:..#..# Windows doesn't distinguish resizing at the 8 compass points,..# only horizontal, vertical, and the two diagonals...#..# OSX doesn't have resize cursors for nw, ne, sw, or se corners...# We use the Tk-defined X11 fallbacks for these...#..# X11 doesn't have a "forbidden" cursor (usually a slashed circle);..# "pirate" seems to be the conventional cursor for this purpose...#..# Windows has a

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\defaults.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	4.933885986949396
Encrypted:	false
SSDEEP:	96:lNl3u3lCFUeuMGN3xbVJU+N3xbVJh3IwxkxlBqatUrtY:zl3ZUe9GN3NVC+N3NVjqntUZY
MD5:	FC79F42761D63172163C08F0F5C94436
SHA1:	AABAB4061597D0D6DC371F46D14AAA1A859096DF
SHA-256:	49AE8FAF169165BDDAF01D50B52943EBAB3656E9468292B7890BE143D0FCBC91
SHA-512:	F619834A95C9DEB93F8184BCC437D701A961C77E24A831ADBD5C145556D26986BFDA2A6ACB9E8784F8B2380E122D12AC893EB1B6ACF03098922889497E1FF9EA
Malicious:	false
Preview:	#..# Settings for default theme...#....namespace eval ttk::theme::default {.. variable colors.. array set colors {...-frame..."#d9d9d9"...-foreground.."#000000"...-window..."#ffffff"...-text .."#000000"...-activebg.."#ececec"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-darker .."#c3c3c3"...-disabledfg.."#a3a3a3"...-indicator.."#4a6984"...-disabledindicator."#a3a3a3"...-altindicator.."#9fbdd8"...-disabledaltindicator."#c0c0c0".. }.... ttk::style theme settings default {.....ttk::style configure "." \... -borderwidth .1 \... -background .$colors(-frame) \... -foreground .$colors(-foreground) \... -troughcolor .$colors(-darker) \... -font ..TkDefaultFont \... -selectborderwidth.1 \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -insertwidth .1 \... -indicatordiameter.10 \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)]...ttk::style map "."

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\entry.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17617
Entropy (8bit):	5.025882547402842
Encrypted:	false
SSDEEP:	384:sca9JzOyzf6yzwO+v+iPT3vKof8q3YIuR13a:sT9JzOy76wiV3YNa
MD5:	89089172393C551CD1668B9C19B88290
SHA1:	0B8667217A4A14289E9F6C1B384DEF5479BCA089
SHA-256:	830CC3009A735E92DB70D53210C4928DD35CAAB5051ED14DEC67E06AE25CBE28
SHA-512:	ABBBE6AA937AAB392BC7DCB8BBFBBEC9EE5ED2C9F10ED982D77258BD98F27EE95AC47FD7CB6761B814885EF0878E1F1557D034C9F4163D9D85B388F2B837683F
Malicious:	false
Preview:	#..# DERIVED FROM: tk/library/entry.tcl r1.22..#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 2004, Joe English..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ttk {.. namespace eval entry {...variable State.....set State(x) 0...set State(selectMode) none...set State(anchor) 0...set State(scanX) 0...set State(scanIndex) 0...set State(scanMoved) 0.....# Button-2 scan speed is (scanNum/scanDen) characters...# per pixel of mouse movement....# The standard Tk entry widget uses the equivalent of...# scanNum = 10, scanDen = average character width....# I don't know why that was chosen....#...set State(scanNum) 1...set State(scanDen) 1...set State(deadband) 3.;# #pixels for mouse-moved deadband... }..}....### Option database settings...#..option add *TEntry.cursor [ttk::cursor text] widg

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\fonts.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5732
Entropy (8bit):	5.001928619185109
Encrypted:	false
SSDEEP:	96:NzEh94ntnVU8Z/1LkAKgW22SeLMQR8hzcksejmOF4ytZm:Sh9ahV3ZWAKgWDfktm
MD5:	80331FCBE4C049FF1A0D0B879CB208DE
SHA1:	4EB3EFDFE3731BD1AE9FD52CE32B1359241F13CF
SHA-256:	B94C319E5A557A5665B1676D602B6495C0887C5BACF7FA5B776200112978BB7B
SHA-512:	A4BD2D91801C121A880225F1F3D0C4E30BF127190CF375F6F7A49EB4239A35C49C44F453D6D3610DF0D6A7B3CB15F4E79BD9C129025CC496CEB856FCC4B6DE87
Malicious:	false
Preview:	#..# Font specifications...#..# This file, [source]d at initialization time, sets up the following..# symbolic fonts based on the current platform:..#..# TkDefaultFont.-- default for GUI items not otherwise specified..# TkTextFont.-- font for user text (entry, listbox, others)..# TkFixedFont.-- standard fixed width font..# TkHeadingFont.-- headings (column headings, etc)..# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.)..# TkTooltipFont.-- font to use for tooltip windows..# TkIconFont.-- font to use for icon captions..# TkMenuFont.-- used to use for menu items..#..# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation..# (On Windows and Mac OS X as of Oct 2007)...#..# +++ Platform notes:..#..# Windows:..#.The default system font changed from "MS Sans Serif" to "Tahoma"..# .in Windows XP/Windows 2000...#..#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,..#.although many MS programs still use "MS Sans Serif 8"..#..#.Should use

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\menubutton.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6641
Entropy (8bit):	4.923865616450888
Encrypted:	false
SSDEEP:	192:toMcJQkmcE6fNuLyiCpYSmFSRwgppdT3kXdpK3dpKkNf2tOTjvAG:tRc6kFbcz2pyXz+zZ2y
MD5:	4C8D90257D073F263B258F00B2A518C2
SHA1:	7B58859E9B70FB37F53809CD3FFD7CF69AB310D8
SHA-256:	972B13854D0E9B84DE338D6753F0F11F3A8534E7D0E51838796DAE5A1E2E3085
SHA-512:	ED67F41578EE834EE8DB1FDED8AA069C0045E7058E338C451FA8E1ADE52907BED0C95631C21B8E88461571903B3DA2698A29E47F990B7A0F0DD3073E7A1BCADC
Malicious:	false
Preview:	#..# Bindings for Menubuttons...#..# Menubuttons have three interaction modes:..#..# Pulldown: Press menubutton, drag over menu, release to activate menu entry..# Popdown: Click menubutton to post menu..# Keyboard: <space> or accelerator key to post menu..#..# (In addition, when menu system is active, "dropdown" -- menu posts..# on mouse-over. Ttk menubuttons don't implement this)...#..# For keyboard and popdown mode, we hand off to tk_popup and let..# the built-in Tk bindings handle the rest of the interaction...#..# ON X11:..#..# Standard Tk menubuttons use a global grab on the menubutton...# This won't work for Ttk menubuttons in pulldown mode,..# since we need to process the final <ButtonRelease> event,..# and this might be delivered to the menu. So instead we..# rely on the passive grab that occurs on <Button> events,..# and transition to popdown mode when the mouse is released..# or dragged outside the menubutton...#..# ON WINDOWS:..#..# I'm not sure what the hell is going on h

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\notebook.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5825
Entropy (8bit):	4.96378772387536
Encrypted:	false
SSDEEP:	96:RErUhyi5JeUQBWdz6eP8ClR6/u6AsBmPNNiREUkheLY1EVL23sN2JJjQdD:6uyiyDQBP8q6/u6AUREUsNEVq3y2jkdD
MD5:	F811F3E46A4EFA73292F40D1CDDD265D
SHA1:	7FC70A1984555672653A0840499954B854F27920
SHA-256:	22264D8D138E2C0E9A950305B4F08557C5A73F054F8215C0D8CE03854042BE76
SHA-512:	4424B7C687EB9B1804ED3B1C685F19D4D349753B374D9046240F937785C9713E8A760ADA46CB628C15F9C7983CE4A7987691C968330478C9C1A9B74E953E40AC
Malicious:	false
Preview:	#..# Bindings for TNotebook widget..#....namespace eval ttk::notebook {.. variable TLNotebooks ;# See enableTraversal..}....bind TNotebook <Button-1>..{ ttk::notebook::Press %W %x %y }..bind TNotebook <Right>...{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Left>...{ ttk::notebook::CycleTab %W -1; break }..bind TNotebook <Control-Tab>..{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Control-Shift-Tab>.{ ttk::notebook::CycleTab %W -1; break }..catch {..bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }..}..bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }....# ActivateTab $nb $tab --..#.Select the specified tab and set focus...#..# Desired behavior:..#.+ take focus when reselecting the currently-selected tab;..#.+ keep focus if the notebook already has it;..#.+ otherwise set focus to the first traversable widget..#. in the newly-selected tab;..#.+ do not leave the focus in a deselected tab...#..proc ttk::notebook::ActivateTab {

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\panedwindow.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2290
Entropy (8bit):	4.948496148661722
Encrypted:	false
SSDEEP:	48:zVAqE3ZF8b4rXzsqALAXsmCLFeNqkFeNXLz:zLeU4bzNs1h
MD5:	619D8F54EE73AD8A373AB272FBDB94A6
SHA1:	973626B5396B7E786DEDD8159D10E66B4465F9E0
SHA-256:	4D08A7E29EEF731876951EF01DFA51654B6275FA3DAADB1F48FF4BBEAC238EB5
SHA-512:	0D913C7DC9DAEE2B4A2A46663A07B3139D6B8F30D2F942642817504535E85616835EAA7D468851A83723A3DD711B65761376F3DF96A59A933A74EF096E13ACE9
Malicious:	false
Preview:	#..# Bindings for ttk::panedwindow widget...#....namespace eval ttk::panedwindow {.. variable State.. array set State {...pressed 0.. .pressX.-...pressY.-...sash .-...sashPos -.. }..}....## Bindings:..#..bind TPanedwindow <Button-1> ..{ ttk::panedwindow::Press %W %x %y }..bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }..bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }....bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }..# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>..bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }....## Sash movement:..#..proc ttk::panedwindow::Press {w x y} {.. variable State.... set sash [$w identify $x $y].. if {$sash eq ""} {.. .set State(pressed) 0...return.. }.. set State(pressed) .1.. set State(pressX) .$x.. set

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\progress.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1138
Entropy (8bit):	4.763501917862434
Encrypted:	false
SSDEEP:	24:nJ8v3O0NSiio0pNFVkIks0ImxlnINgDImSgGINSyWghT:JFqS/o03fkxs0Rn+gD4v+S2F
MD5:	DBF3BF0E8F04E9435E9561F740DFC700
SHA1:	C7619A05A834EFB901C57DCFEC2C9E625F42428F
SHA-256:	697CC0A75AE31FE9C2D85FB25DCA0AFA5D0DF9C523A2DFAD2E4A36893BE75FBA
SHA-512:	D3B323DFB3EAC4A78DA2381405925C131A99C6806AF6FD8041102162A44E48BF166982A4AE4AA142A14601736716F1A628D9587E292FA8E4842BE984374CC192
Malicious:	false
Preview:	#..# Ttk widget set: progress bar utilities...#....namespace eval ttk::progressbar {.. variable Timers.;# Map: widget name -> after ID..}....# Autoincrement --..#.Periodic callback procedure for autoincrement mode..#..proc ttk::progressbar::Autoincrement {pb steptime stepsize} {.. variable Timers.... if {![winfo exists $pb]} {.. .# widget has been destroyed -- cancel timer...unset -nocomplain Timers($pb)...return.. }.... set Timers($pb) [after $steptime \.. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].... $pb step $stepsize..}....# ttk::progressbar::start --..#.Start autoincrement mode. Invoked by [$pb start] widget code...#..proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {.. variable Timers.. if {![info exists Timers($pb)]} {...Autoincrement $pb $steptime $stepsize.. }..}....# ttk::progressbar::stop --..#.Cancel autoincrement mode. Invoked by [$pb stop] widget code...#..proc ttk::progressbar::stop {pb} {.. variabl

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\scale.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2787
Entropy (8bit):	4.795451191784129
Encrypted:	false
SSDEEP:	48:IKADAzizZIcAlRqucObmn4AzyVN2AJyhAzukPNP:IHIBRqupmLSZkklP
MD5:	F1C33CC2D47115BBECD2E7C2FCB631A7
SHA1:	0123A961242ED8049B37C77C726DB8DBD94C1023
SHA-256:	B909ADD0B87FA8EE08FD731041907212A8A0939D37D2FF9B2F600CD67DABD4BB
SHA-512:	96587A8C3555DA1D810010C10C516CE5CCAB071557A3C8D9BD65C647C7D4AD0E35CBED0788F1D72BAFAC8C84C7E2703FC747F70D9C95F720745A1FC4A701C544
Malicious:	false
Preview:	# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# Bindings for the TScale widget....namespace eval ttk::scale {.. variable State.. array set State {...dragging 0.. }..}....bind TScale <Button-1> { ttk::scale::Press %W %x %y }..bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }....bind TScale <Button-2> { ttk::scale::Jump %W %x %y }..bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }....bind TScale <Button-3> { ttk::scale::Jump %W %x %y }..bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }....## Keyboard navigation bindings:..#..bind TScale <<LineStart>> { %W set [%W cget -from] }..bind TScale <<LineEnd>> { %W set [%W cget -to] }....bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }..bin

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\scrollbar.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3285
Entropy (8bit):	4.979174619784594
Encrypted:	false
SSDEEP:	48:tyASEji8RYQ8FGD7BDos9Q1TBfvq/HKTh9lkHv8T/mAezeLEAAFULxZh4x:eIi8qFu2d11XlhfkPcczeLS4Zm
MD5:	3FB31A225CEC64B720B8E579582F2749
SHA1:	9C0151D9E2543C217CF8699FF5D4299A72E8F13C
SHA-256:	6EAA336B13815A7FC18BCD6B9ADF722E794DA2888D053C229044784C8C8E9DE8
SHA-512:	E6865655585E3D2D6839B56811F3FD86B454E8CD44E258BB1AC576AD245FF8A4D49FBB7F43458BA8A6C9DAAC8DFA923A176F0DD8A9976A11BEA09E6E2D17BF45
Malicious:	false
Preview:	#..# Bindings for TScrollbar widget..#....namespace eval ttk::scrollbar {.. variable State.. # State(xPress).--.. # State(yPress).-- initial position of mouse at start of drag... # State(first).-- value of -first at start of drag...}....bind TScrollbar <Button-1> ..{ ttk::scrollbar::Press %W %x %y }..bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }....bind TScrollbar <Button-2> ..{ ttk::scrollbar::Jump %W %x %y }..bind TScrollbar <B2-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-2>.{ ttk::scrollbar::Release %W %x %y }....# Redirect scrollwheel bindings to the scrollbar widget..#..# The shift-bindings scroll left/right (not up/down)..# if a widget has both possibilities..set eventList [list <MouseWheel> <Shift-MouseWheel>]..switch [tk windowingsystem] {.. aqua {.. lappend eventList <Option-MouseWheel> <Shift-Option-MouseWheel>.. }.. x11 {..

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\sizegrip.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2503
Entropy (8bit):	4.830288003879418
Encrypted:	false
SSDEEP:	48:naLvMnAqeYQWYh7FvBrrbnMCfY/aVAbAigWAuFM0PfWAX20:nWQapprPnJY/8A8iRFdPtj
MD5:	DD6A1737B14D3F7B2A0B4F8BE99C30AF
SHA1:	E6B06895317E73CD3DC78234DD74C74F3DB8C105
SHA-256:	E92D77B5CDCA2206376DB2129E87E3D744B3D5E31FDE6C0BBD44A494A6845CE1
SHA-512:	B74AE92EDD53652F8A3DB0D84C18F9CE9069805BCAB0D3C2DBB537D7C241AA2681DA69B699D88A10029798D7B5BC015682F64699BA475AE6A379EEF23B48DAAF
Malicious:	false
Preview:	#..# Sizegrip widget bindings...#..# Dragging a sizegrip widget resizes the containing toplevel...#..# NOTE: the sizegrip widget must be in the lower right hand corner...#....switch -- [tk windowingsystem] {.. x11 -.. win32 {...option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault.. }.. aqua {.. .# Aqua sizegrips use default Arrow cursor... }..}....namespace eval ttk::sizegrip {.. variable State.. array set State {...pressed .0...pressX ..0...pressY ..0...width ..0...height ..0...widthInc.1...heightInc.1.. resizeX 1.. resizeY 1...toplevel .{}.. }..}....bind TSizegrip <Button-1> ..{ ttk::sizegrip::Press.%W %X %Y }..bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }..bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }....proc ttk::sizegrip::Press {W X Y} {.. variable State.... if {[$W instate disabled]} { return }.... set top [winfo toplevel $W].... # If the toplevel is not resi

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\spinbox.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5003
Entropy (8bit):	5.055050310142795
Encrypted:	false
SSDEEP:	96:1qg/+yrjqA/K5ytxm1J1Ve6J1yQLUAzz/S76hrwxGGe2F:N/+yr2Gk1J1Ve6fxUAzDS76hrwxs2F
MD5:	9C2833FAA9248F09BC2E6AB1BA326D59
SHA1:	F13CF048FD706BBB1581DC80E33D1AAD910D93E8
SHA-256:	DF286BB59F471AA1E19DF39AF0EF7AA84DF9F04DC4A439A747DD8BA43C300150
SHA-512:	5FF3BE1E3D651C145950C3FC5B8C2E842211C937D1042173964383D4D59ECF5DD0EC39FF7771D029716F2D895F0B1A72591EF3BF7947FE64D4D6DB5F0B8ABFFB
Malicious:	false
Preview:	#..# ttk::spinbox bindings..#....namespace eval ttk::spinbox { }....### Spinbox bindings...#..# Duplicate the Entry bindings, override if needed:..#....ttk::copyBindings TEntry TSpinbox....bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }..bind TSpinbox <Button-1> ..{ ttk::spinbox::Press %W %x %y }..bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }..bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }..bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click....bind TSpinbox <Up>...{ event generate %W <<Increment>> }..bind TSpinbox <Down> ...{ event generate %W <<Decrement>> }....bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }..bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }....ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]....## Motion --..#.Sets cursor...#..proc ttk::spinbox::Motion {w x y} {.. variable State.. ttk::saveCursor $w State(userConfCursor) [ttk::cursor text].. if { [$w ide

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\treeview.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10180
Entropy (8bit):	4.886259798213254
Encrypted:	false
SSDEEP:	96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
MD5:	F705B3A292D02061DA0ABB4A8DD24077
SHA1:	FD75C2250F6F66435444F7DEEF383C6397ED2368
SHA-256:	C88B60FFB0F72E095F6FC9786930ADD7F9ED049EABC713F889F9A7DA516E188C
SHA-512:	09817638DD3D3D5C57FA630C7EDF2F19C3956C9BD264DBF07627FA14A03AECD22D5A5319806E49EF1030204FADEF17C57CE8EAE4378A319AD2093321D9151C8F
Malicious:	false
Preview:	#..# ttk::treeview widget bindings and utilities...#....namespace eval ttk::treeview {.. variable State.... # Enter/Leave/Motion.. #.. set State(activeWidget) .{}.. set State(activeHeading) .{}.... # Press/drag/release:.. #.. set State(pressMode) .none.. set State(pressX)..0.... # For pressMode == "resize".. set State(resizeColumn).#0.... # For pressmode == "heading".. set State(heading) .{}..}....### Widget bindings...#....bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }..bind Treeview.<B1-Leave>..{ #nothing }..bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}..bind Treeview.<Button-1> ..{ ttk::treeview::Press %W %x %y }..bind Treeview.<Double-Button-1> .{ ttk::treeview::DoubleClick %W %x %y }..bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }..bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }..bind Treeview .<Up> ..{ ttk::treeview::Keynav %W up }..bind Treeview .<Down> ..{ ttk::treeview

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\ttk.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4993
Entropy (8bit):	4.954034141173847
Encrypted:	false
SSDEEP:	96:lfxukTy5jPTq8LIgF2diyNTNR6nkrn4ijSSvNigyJ5612HtZG835MSvWOTRsHWU:BM+y5jrq8G/2nkEijSSvNigyJ5612Htw
MD5:	AF45B2C8B43596D1BDECA5233126BD14
SHA1:	A99E75D299C4579E10FCDD59389B98C662281A26
SHA-256:	2C48343B1A47F472D1A6B9EE8D670CE7FB428DB0DB7244DC323FF4C7A8B4F64B
SHA-512:	C8A8D01C61774321778AB149F6CA8DDA68DB69133CB5BA7C91938E4FD564160ECDCEC473222AFFB241304A9ACC73A36B134B3A602FD3587C711F2ADBB64AFA80
Malicious:	false
Preview:	#..# Ttk widget set initialization script...#....### Source library scripts...#....namespace eval ::ttk {.. variable library.. if {![info exists library]} {...set library [file dirname [info script]].. }..}....source -encoding utf-8 [file join $::ttk::library fonts.tcl]..source -encoding utf-8 [file join $::ttk::library cursors.tcl]..source -encoding utf-8 [file join $::ttk::library utils.tcl]....## ttk::deprecated $old $new --..#.Define $old command as a deprecated alias for $new command..#.$old and $new must be fully namespace-qualified...#..proc ttk::deprecated {old new} {.. interp alias {} $old {} ttk::do'deprecate $old $new..}..## do'deprecate --..#.Implementation procedure for deprecated commands --..#.issue a warning (once), then re-alias old to new...#..proc ttk::do'deprecate {old new args} {.. deprecated'warning $old $new.. interp alias {} $old {} $new.. uplevel 1 [linsert $args 0 $new]..}....## deprecated'warning --..#.Gripe about use of deprecated comman

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\utils.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	5.001791071900077
Encrypted:	false
SSDEEP:	192:e0ebpSp+IZwnmTmpx8xzaHfw8K7LVJWQl8p7M+R5:rw0+WmpWxa/w9nVJHu
MD5:	D98EDC491DA631510F124CD3934F535F
SHA1:	33037A966067C9F5C9074AE5532FF3B51B4082D4
SHA-256:	D58610A34301BB6E61A60BEC69A7CECF4C45C6A034A9FC123977174B586278BE
SHA-512:	23FAED8298E561F490997FE44AB61CD8CCB9F1F63D48BB4CF51FC9E591E463FF9297973622180D6A599CABB541C82B8FE33BF38A82C5D5905BBFA52CA0341399
Malicious:	false
Preview:	#..# Utilities for widget implementations...#....### Focus management...#..# See also: #1516479..#....## ttk::takefocus --..#.This is the default value of the "-takefocus" option..#.for ttk::* widgets that participate in keyboard navigation...#..# NOTES:..#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable]..#.if -takefocus is 1, empty, or missing; but not if it's a..#.script prefix, so we have to check that here as well...#..#..proc ttk::takefocus {w} {.. expr {[$w instate !disabled] && [winfo viewable $w]}..}....## ttk::GuessTakeFocus --..#.This routine is called as a fallback for widgets..#.with a missing or empty -takefocus option...#..#.It implements the same heuristics as tk::FocusOK...#..proc ttk::GuessTakeFocus {w} {.. # Don't traverse to widgets with '-state disabled':.. #.. if {![catch {$w cget -state} state] && $state eq "disabled"} {...return 0.. }.... # Allow traversal to widgets with explicit key or focus bindings:.. #.. if {[regexp {Key\|F

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\vistaTheme.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9710
Entropy (8bit):	4.6639701588183895
Encrypted:	false
SSDEEP:	192:BktY1F+qXd95WSZaHFHRE3GRKFh2oaoT/ezKpqvYMHab:V1F+cd95WSZuhRE34KbPmKmY2ab
MD5:	0AA7F8B43C3E07F3A4DA07FC6DF9A1B0
SHA1:	153AFB735B10BBA16CFBE161777232F983845D90
SHA-256:	EC5F203C69DF390E9B99944CF3526D6E77DC6F68E9B1A029F326A41AFED1EF81
SHA-512:	5406553211CD6714C98EF7765ABD46424CCB013343EFF693FDD3AE6E0AAE9B5983446E0E1CC706D6B2C285084BF83D397306D3D52028CBBCFB8F369857C5B69C
Malicious:	false
Preview:	#..# Settings for Microsoft Windows Vista and Server 2008..#....# The Vista theme can only be defined on Windows Vista and above. The theme..# is created in C due to the need to assign a theme-enabled function for..# detecting when themeing is disabled. On systems that cannot support the..# Vista theme, there will be no such theme created and we must not..# evaluate this script.....if {"vista" ni [ttk::style theme names]} {.. return..}....namespace eval ttk::theme::vista {.... ttk::style theme settings vista {.... .ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\winTheme.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2865
Entropy (8bit):	4.917847108902527
Encrypted:	false
SSDEEP:	48:b69VhW2gL5FPVWRzQsVqrEuF3yYrf7rfJF8xUqBgLt6g3ktO5jo4+iZ6O2htYtCW:bbXl+CEqZNNSxU0Ht2MR7W
MD5:	769C0719A4044F91E7D132A25291E473
SHA1:	6FB07B0C887D443A43FB15D5728920B578171219
SHA-256:	AE82BCCCE708FF9C303CBCB3D4CC3FF5577A60D5B23822EA79E3E07CCE3CBBD1
SHA-512:	47FED061DDC6B4EB63EF77901D0094FF2EBB1BAFACB3F44FBF13FB59DEA1EC83985B2862086ECF1A7957819A88A0FAA144B35F16BEA9356BBD9775070D42E636
Malicious:	false
Preview:	#..# Settings for 'winnative' theme...#....namespace eval ttk::theme::winnative {.. ttk::style theme settings winnative {.....ttk::style configure "." \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -fieldbackground SystemWindow \... -insertcolor SystemWindowText \... -troughcolor SystemScrollbar \... -font TkDefaultFont \... ;.....ttk::style map "." -foreground [list disabled SystemGrayText] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -relief raised -shiftrelief 1...ttk::style configure TCheckbutton -padding "2 4"...ttk::style configure TRadiobutton -padding "2 4"...ttk::style configure TMenubutton \... -padding "8 4" -arrowsize 3 -relief raised.....ttk::style map TButton -relief {{!disabled pressed} sunken}.....ttk::style configure TEntry \... -padding 2 -select

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\ttk\xpTheme.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2103
Entropy (8bit):	4.9805308941424355
Encrypted:	false
SSDEEP:	48:aaiIu89VhW2gLRWJyO514rf+rfzxTrf/MW+iZ6O2htYtCp:XoXAk21nxQ7p
MD5:	162F30D2716438C75EA16B57E6F63088
SHA1:	3F626FF0496BB16B27106BED7E38D1C72D1E3E27
SHA-256:	AEDB21C6B2909A4BB4686837D2126E521A8CC2B38414A4540387B801EBD75466
SHA-512:	6EBF9648F1381D04F351BB469B6E3A38F3D002189C92EAF80A18D65632037FF37D34EC8814BBF7FAE34553645BFC13985212F24684EE8C4E205729B975C88C97
Malicious:	false
Preview:	#..# Settings for 'xpnative' theme..#....namespace eval ttk::theme::xpnative {.... ttk::style theme settings xpnative {.....ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::style configure TCheckbutton -padding 2...ttk::style configure TMenubutton -padding {8 4}.....ttk::style configure TNotebook -tabmargins {2 2 2 0}...ttk::style map TNotebook.Tab \... -expand [list selected {2 2 2 2}].....ttk::style configure TLabelframe.Label -foreground "#0046d5".....# OR: -padding {3 3 3 6}, which some apps seem to use....ttk::style configure TEntry -padding {2 2 2 4}...ttk::

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\unsupported.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10521
Entropy (8bit):	5.0647027375963996
Encrypted:	false
SSDEEP:	192:1Y3uWEXm/swEePmJhRAXd1hTHsHG2ML/9Lm2daM0Hu:8hodMiM0Hu
MD5:	508F7E258C04970FAE526990168CB773
SHA1:	33785204B18C0E0F5CDCB5B49399B5907351FDB8
SHA-256:	B463B366F139DDF7FED31F34C6D2341F9F27845A1A358011DFC801E1333B1828
SHA-512:	A12985B58DD1D46297119CED47B7F44EF4139CED6C36FD028E66DD657E5ED0663B744C679A5BF7A39B39D17A32E1280D2945F6B9AD59AEF20436F68040F6070C
Malicious:	false
Preview:	# unsupported.tcl --..#..# Commands provided by Tk without official support. Use them at your..# own risk. They may change or go away without notice...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# ----------------------------------------------------------------------..# Unsupported compatibility interface for folks accessing Tk's private..# commands and variable against recommended usage...# ----------------------------------------------------------------------....namespace eval ::tk::unsupported {.... # Map from the old global names of Tk private commands to their.. # new namespace-encapsulated names..... variable PrivateCommands.. array set PrivateCommands {...tkButtonAutoInvoke..::tk::ButtonAutoInvoke...tkButtonDown...::tk::ButtonDown...tkButtonEnter...::tk::ButtonEnter...tkButtonInvoke...::tk::ButtonInvoke...tkButtonLeave...::tk::ButtonLeave...tkButtonUp...::tk::ButtonUp...tk

C:\Users\user\AppData\Local\Temp\_MEI12922\tk\xmfbox.tcl

Download File

Process:	C:\AccountChanger\AccountChanger.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27064
Entropy (8bit):	4.967626999005091
Encrypted:	false
SSDEEP:	384:0BLzjXhss64XP8FXm39QJ63nwFiHLgRIdNPCRE5phLtffsNP4XWdxWk+I5oy9jN7:0BvjXoivB3flLCRE5phLCP3xWV8veTod
MD5:	6DFD12DB27069F13957BC963EF5ACAAF
SHA1:	E492F0B60D73CE17C4FA7680BF0087DC5E0CC132
SHA-256:	1ED57E32CE9C419BCE36B483A91410DDF4C997CAF62D20E42048FC350F8C3F60
SHA-512:	32A3E205B4BC3B7D4D6F31E6FD26075EA3FAB7396F7392855D8BD4426CFEE9081482759EFF219038D64B074E2D3D864041E7C37DCA134F2A0C3140AA04D757C2
Malicious:	false
Preview:	# xmfbox.tcl --..#..#.Implements the "Motif" style file selection dialog for the..#.Unix platform. This implementation is used only if the..#."::tk_strictMotif" flag is set...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Scriptics Corporation..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}......# ::tk::MotifFDialog --..#..#.Implements a file dialog similar to the standard Motif file..#.selection box...#..# Arguments:..#.type.."open" or "save"..#.args..Options parsed by the procedure...#..# Results:..#.When -multiple is set to 0, this returns the absolute pathname..#.of the selected file. (NOTE: This is not the same as a single..#.element list.)..#..#.When -multiple is set to > 0, this returns a Tcl list of absolute..# pathnames. The argument for -multiple is ignored, but for consistency..#

C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:	48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: L1QnAwXT7U.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.9294.28999.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CtEeMS3H62.exe, Detection: malicious, Browse Filename: LIRR4A0xzv.exe, Detection: malicious, Browse Filename: 6BE4950D9A919F5D0150D19552B340E9B5EF1959A18FD.exe, Detection: malicious, Browse Filename: 5i7hafPPeN.exe, Detection: malicious, Browse Filename: kZmq9FlFbC.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-E53OT.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp

Download File

Process:	C:\Users\user\Desktop\AccoutChangersetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	739840
Entropy (8bit):	6.319138241575343
Encrypted:	false
SSDEEP:	12288:bTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5rRx9vd:/PcYn5c/rPx37/zHBA6pFptZ1CEQqrRB
MD5:	71182B40469A9CAD1F21E451D7CF31BF
SHA1:	49397FAF695F1C50CFC03480A2CF6F9BD6F60028
SHA-256:	336208A3CB4F2FF70173843FF06C13B21FDC44B572194699266866BA06D4CC07
SHA-512:	D8BEA41300173B100800967DDB72429339374D8DCAB067EE7EBE6B7A7A83E139A13A9441A8F9688BA62482BFC6398A3230561CF5352DEEADB34BF3E01D721C23
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..........................@...................@...............................%.......................... ......................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc..............................@..P.....................T..............@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999061405069758
TrID:	Win32 Executable (generic) a (10002005/4) 98.73% Inno Setup installer (109748/4) 1.08% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	AccoutChangersetup.exe
File size:	18'495'052 bytes
MD5:	307639b090b992ebc59cf20903918d90
SHA1:	f88d0d80e62d3947c7c3dd5faeddb5eb18fc7cd8
SHA256:	fb489711e58eaa124bd751b53049964ba7e647e449c05feea4311feb77b2aacd
SHA512:	f97672603c535c97fdb33789fe696e06095414674652ee3bd98af3db9e11095e65d4d6b563e6fa198645721c69bc781dfb007096c8c4882555d758389002d4a3
SSDEEP:	393216:5OEzisPIpS9qfaUKwfsWHHKisksFZeR9FPDO6U28DgZ:ubssFUkyedS280Z
TLSH:	B8173313856590BCD0B624FAD90DC23238E99CA51E212742B3EC7DFBB455A836F5D2F8
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	32332d585d2d33b2

Static PE Info

General

Entrypoint:	0x40a5f8
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F73E8805373h
call 00007F73E880657Ah
call 00007F73E8806809h
call 00007F73E88068ACh
call 00007F73E880884Bh
call 00007F73E880B1B6h
call 00007F73E880B31Dh
xor eax, eax
push ebp
push 0040ACC9h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040AC92h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F73E880BDCBh
call 00007F73E880B9B6h
cmp byte ptr [0040B234h], 00000000h
je 00007F73E880C8AEh
call 00007F73E880BEC8h
xor eax, eax
call 00007F73E8806069h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F73E8808E5Bh
mov edx, dword ptr [ebp-10h]
mov eax, 0040CE28h
call 00007F73E880540Ah
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CE28h]
mov dl, 01h
mov eax, 0040738Ch
call 00007F73E88096EAh
mov dword ptr [0040CE2Ch], eax
xor edx, edx
push ebp
push 0040AC4Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F73E880BE26h
mov dword ptr [0040CE34h], eax
mov eax, dword ptr [0040CE34h]
cmp dword ptr [eax+0Ch], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0xace0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9d30	0x9e00	c3bd95c4b1a8e5199981e0d9b45fd18c	False	0.6052709651898734	data	6.631765876950794	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x250	0x400	1ee71d84f1c77af85f1f5c278f880572	False	0.306640625	data	2.751820662285145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe8c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8c4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0xace0	0xae00	5a8fb515fd695d2b659dbcee8d23ea5f	False	0.07327586206896551	data	1.4011337177292107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x112c4	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 2835 x 2835 px/m	English	United States	0.026907714946394788
RT_STRING	0x1a76c	0x2f2	data			0.35543766578249336
RT_STRING	0x1aa60	0x30c	data			0.3871794871794872
RT_STRING	0x1ad6c	0x2ce	data			0.42618384401114207
RT_STRING	0x1b03c	0x68	data			0.75
RT_STRING	0x1b0a4	0xb4	data			0.6277777777777778
RT_STRING	0x1b158	0xae	data			0.5344827586206896
RT_RCDATA	0x1b208	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x1b234	0x14	data	English	United States	1.15
RT_VERSION	0x1b248	0x4f4	data	English	United States	0.27287066246056785
RT_MANIFEST	0x1b73c	0x5a4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.42590027700831024

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	18:58:56
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\AccoutChangersetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AccoutChangersetup.exe"
Imagebase:	0x400000
File size:	18'495'052 bytes
MD5 hash:	307639B090B992EBC59CF20903918D90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:58:56
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-M482R.tmp\AccoutChangersetup.tmp" /SL5="$20470,18246292,90112,C:\Users\user\Desktop\AccoutChangersetup.exe"
Imagebase:	0x400000
File size:	739'840 bytes
MD5 hash:	71182B40469A9CAD1F21E451D7CF31BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:59:27
Start date:	24/04/2024
Path:	C:\AccountChanger\AccountChanger.exe
Wow64 process (32bit):	false
Commandline:	"C:\AccountChanger\AccountChanger.exe"
Imagebase:	0x7ff758970000
File size:	18'565'178 bytes
MD5 hash:	874D9918AC068743FF1D236347FFA120
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:59:38
Start date:	24/04/2024
Path:	C:\AccountChanger\AccountChanger.exe
Wow64 process (32bit):	false
Commandline:	"C:\AccountChanger\AccountChanger.exe"
Imagebase:	0x7ff758970000
File size:	18'565'178 bytes
MD5 hash:	874D9918AC068743FF1D236347FFA120
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:59:39
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff69eef0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:59:39
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1471
Total number of Limit Nodes:	21

Executed Functions

Function 00409B78 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B8A
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B95
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BD6
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409C08
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409C18

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction ID: 4a1d84bb43d4a47cf168f169447d483ed62c711ee8ccb48f5bfbfd053dbeaed9
Opcode Fuzzy Hash: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction Fuzzy Hash: D421A1B16043006BDA309AA99C85E57B7E8AF45360F144C2BFA99E72C3D239FC40C669

Uniqueness

Uniqueness Score: -1.00%

Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040A618), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0040A618), ref: 004045C6

Strings

SetSearchPathMode, xrefs: 0040459F
kernel32.dll, xrefs: 0040457D
SetProcessDEPPolicy, xrefs: 004045B5
SetDllDirectoryW, xrefs: 00404589

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAB4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040AAC1

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,0213337C), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(00020470,000000FC,00409960), ref: 0040AB15
RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020470,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

STATIC, xrefs: 0040AAF7
InnoSetupLdrWindow, xrefs: 0040AAF2
/SL5="$%x,%d,%d,, xrefs: 0040AB55

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
Instruction ID: 81987b3bab642c92fe87a7372e0454594c4b8fe140ce311e0f93b1eeebf6ab37
Opcode Fuzzy Hash: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
Instruction Fuzzy Hash: 25412E70604204DBDB10EBA9EE89B9E37A5EB44304F10467FF510B72E2D7B89855CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

Wow64DisableWow64FsRedirection, xrefs: 004090BA
Wow64RevertWow64FsRedirection, xrefs: 004090D4
kernel32.dll, xrefs: 004090BF, 004090D9
shell32.dll, xrefs: 00409110

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction ID: 214dda5481ef482ebe311b1329301f35405b1013d97e3062c17ffb2c8286d57d
Opcode Fuzzy Hash: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction Fuzzy Hash: 21017C70748342AEFB00BB76DD4AB163A68E785704F60457BF640BA2D3DABD4C04D66E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAA2 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(00020470,000000FC,00409960), ref: 0040AB15

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040AB86,?), ref: 00406B94

Part of subcall function 004099EC: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,0213337C,00409AD8,00000000,00409ABF), ref: 00409A5C
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,0213337C,00409AD8,00000000), ref: 00409A70
Part of subcall function 004099EC: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
Part of subcall function 004099EC: GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,0213337C,00409AD8), ref: 00409AA4

RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020470,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

STATIC, xrefs: 0040AAF7
InnoSetupLdrWindow, xrefs: 0040AAF2
/SL5="$%x,%d,%d,, xrefs: 0040AB55

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
Instruction ID: d3376fcde1141b4290a3dca450fc2844fa47922897975e075ebf06e3b6db64eb
Opcode Fuzzy Hash: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
Instruction Fuzzy Hash: 77411A71604204DFD714EBA9EE85B5A37B5EB48304F20427BF500BB2E1D7B8A855CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004099EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,0213337C,00409AD8,00000000,00409ABF), ref: 00409A5C
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,0213337C,00409AD8,00000000), ref: 00409A70
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,0213337C,00409AD8), ref: 00409AA4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,0213337C), ref: 0040966C

Strings

D, xrefs: 00409A36

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
Instruction ID: b58d0f6e2b8975977e6c7b71aada5392bea55c03070ce9fad3dcef5aa6d4018a
Opcode Fuzzy Hash: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
Instruction Fuzzy Hash: EE1142B16402486EDB00EBE6CC42F9EB7ACEF49714F50013BB604F72C6DA785D048A69

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(Function_0000C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(Function_0000C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(Function_0000C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A814 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

y@, xrefs: 0040A981
.tmp, xrefs: 0040A8BE

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
Instruction ID: 5e9257013af3d55ef2b6e359c41f87f67318ae2a4e6dbf07461b5d8c6de74657
Opcode Fuzzy Hash: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
Instruction Fuzzy Hash: 3B41C030704200CFD311EF25DED1A1A77A5EB49304B214A3AF804B73E1CAB9AC11CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040A82F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

y@, xrefs: 0040A981
.tmp, xrefs: 0040A8BE

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
Instruction ID: 95bba075cf9db07042691c1556ef0613dbe482a65a3614fff4d0ead14828e6f7
Opcode Fuzzy Hash: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
Instruction Fuzzy Hash: E341BE30700200DFC711EF65DED2A1A77A5EB49304B104A3AF804B73E2CAB9AC01CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction ID: b240cf9bc22f775501a2d99da134be40bb2f76fb21a7d6e050461713caae6e8b
Opcode Fuzzy Hash: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction Fuzzy Hash: 9E216774A00208ABDB05EFA1C8429DFB7B8EF88304F50457BE901B73C2DA3C9E058A65

Uniqueness

Uniqueness Score: -1.00%

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

Uniqueness

Uniqueness Score: -1.00%

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00408FBC Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FF3
GetLastError.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FFB

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
Instruction ID: 1f0403e6899a51d1d5356f81b6020870d4ad1054c4e625117792cee712869c3b
Opcode Fuzzy Hash: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
Instruction Fuzzy Hash: 16F0C871A04704ABCB01DF759D4159DB3E8DB8831475045BBF814F3682EA385E108599

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC4F Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020470,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Part of subcall function 004094D8: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
String ID:
API String ID: 2192421792-0
Opcode ID: 2c973cdf999bbb1192929a8364406a109d64bb88cfdea17aa602a860d5632052
Instruction ID: be585450a05658aa0cbbe96fcd01bcdb7ec8c3c433658d061b63fb0e61c88a9e
Opcode Fuzzy Hash: 2c973cdf999bbb1192929a8364406a109d64bb88cfdea17aa602a860d5632052
Instruction Fuzzy Hash: 24F03170244200DBD724EB69EEC9B1632A5A784305F10423BF500B72F1C7FC98A1CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Uniqueness

Uniqueness Score: -1.00%

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021303AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Uniqueness

Uniqueness Score: -1.00%

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Uniqueness

Uniqueness Score: -1.00%

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021303AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F

Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98

Uniqueness

Uniqueness Score: -1.00%

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Uniqueness

Uniqueness Score: -1.00%

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021303AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Uniqueness

Uniqueness Score: -1.00%

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Uniqueness

Uniqueness Score: -1.00%

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02148000,0040AA59,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021303AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Uniqueness

Uniqueness Score: -1.00%

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Uniqueness

Uniqueness Score: -1.00%

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Uniqueness

Uniqueness Score: -1.00%

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Uniqueness

Uniqueness Score: -1.00%

Function 00409C34 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409C3E
SizeofResource.KERNEL32(00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 00409C51
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000), ref: 00409C63
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92), ref: 00409C74

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction ID: 5c2a5118689e511edc0a9dde7e1b9e77d0383d271af581b44440e1e73e890ea9
Opcode Fuzzy Hash: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction Fuzzy Hash: B0E07E80B8874726FA6576FB08C7B6B008C4BA570EF00003BB700792C3DDBC8C04462E

Uniqueness

Uniqueness Score: -1.00%

Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,0040A622), ref: 00405D02

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040840C Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
Opcode Fuzzy Hash: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 004070A1

Strings

kernel32.dll, xrefs: 00407048
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0
Locale, xrefs: 00407090
GetUserDefaultUILanguage, xrefs: 00407043
.DEFAULT\Control Panel\International, xrefs: 00407078

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Strings

:mm:ss, xrefs: 004055DA
m/d/yy, xrefs: 004054AD
mmmm d, yyyy, xrefs: 004054CF
AMPM, xrefs: 004055A9
:mm, xrefs: 004055C0

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,00409918,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99

Uniqueness

Uniqueness Score: -1.00%

Function 00409C88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 00409CBD

Strings

The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 00409CA1
Setup, xrefs: 00409CAD

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
API String ID: 2030045667-3271211647
Opcode ID: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction ID: b8b600ed6bdfe48e96a015bdf4867c85bc36f5512d0f27a60c0f94c744360238
Opcode Fuzzy Hash: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction Fuzzy Hash: 8EE0E5302482087EE311EA528C13F6A7BACE789B04F600477F900B15C3D6786E00A068

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040A60E), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,0040A60E), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2350441033.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2350423745.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350464207.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2350486125.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AccoutChangersetup.tmpPID: 6052, Parent PID: 4324COMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7%
Total number of Nodes:	2000
Total number of Limit Nodes:	84

Executed Functions

Function 004706A8 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 965COMMON

Download Yara Rule

Strings

Version of our file: (none), xrefs: 00470AFC
Dest filename: %s, xrefs: 00470894
Time stamp of our file: (failed to read), xrefs: 004709A7
Dest file exists., xrefs: 004709BB
Non-default bitness: 64-bit, xrefs: 004708AF
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470CD0
Skipping due to "onlyifdoesntexist" flag., xrefs: 004709CE
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470E96
Stripped read-only attribute., xrefs: 00470EC7
Will register the file (a type library) later., xrefs: 00471513
Time stamp of existing file: %s, xrefs: 00470A2B
, xrefs: 00470BCF, 00470DA0, 00470E1E
@, xrefs: 004707B0
Will register the file (a DLL/OCX) later., xrefs: 0047151F
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470CC4
Couldn't read time stamp. Skipping., xrefs: 00470D35
Installing into GAC, xrefs: 00471714
Existing file is a newer version. Skipping., xrefs: 00470C02
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470CB5
Failed to strip read-only attribute., xrefs: 00470ED3
Version of existing file: %u.%u.%u.%u, xrefs: 00470B7C
Time stamp of our file: %s, xrefs: 0047099B
Existing file is protected by Windows File Protection. Skipping., xrefs: 00470DEC
Dest file is protected by Windows File Protection., xrefs: 004708ED
Installing the file., xrefs: 00470F09
.tmp, xrefs: 00470FB7
-- File entry --, xrefs: 004706FB
Same time stamp. Skipping., xrefs: 00470D55
Version of existing file: (none), xrefs: 00470CFA
Existing file has a later time stamp. Skipping., xrefs: 00470DCF
Skipping due to "onlyifdestfileexists" flag., xrefs: 00470EFA
InUn, xrefs: 0047115F
Non-default bitness: 32-bit, xrefs: 004708BB
Time stamp of existing file: (failed to read), xrefs: 00470A37
Same version. Skipping., xrefs: 00470CE5
Incrementing shared file count (32-bit)., xrefs: 004715A5
Uninstaller requires administrator: %s, xrefs: 0047118F
User opted not to overwrite the existing file. Skipping., xrefs: 00470E4D
Version of our file: %u.%u.%u.%u, xrefs: 00470AF0
Incrementing shared file count (64-bit)., xrefs: 0047158C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-4021121268
Opcode ID: 7d5112d29c23288e0784ce7f81ed0286bf2e8deea8761e859134408c0673c294
Instruction ID: 04e5041402f80353ef90c659d92e8d378e84d4fed116f8838aecbbc27e5febe3
Opcode Fuzzy Hash: 7d5112d29c23288e0784ce7f81ed0286bf2e8deea8761e859134408c0673c294
Instruction Fuzzy Hash: 31927574A0424CDFDB21DFA9C445BDDBBB5AF05304F1480ABE848A7392D7789E49CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0042E09C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A

Strings

advapi32.dll, xrefs: 0042E107
CheckTokenMembership, xrefs: 0042E102

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: ddfde2249367763e4ec650b3d771d1987385f17006922e03e7cb49a40b8ec1f8
Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
Opcode Fuzzy Hash: ddfde2249367763e4ec650b3d771d1987385f17006922e03e7cb49a40b8ec1f8
Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79

Uniqueness

Uniqueness Score: -1.00%

Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00480B52), ref: 004502D3
LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480B52), ref: 004502EB
GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 00450309
GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 0045031E
GetProcAddress.KERNEL32(00000000,RmGetList), ref: 00450333
GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 00450348
GetProcAddress.KERNEL32(00000000,RmRestart), ref: 0045035D
GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 00450372

Strings

RmShutdown, xrefs: 0045033D
RmStartSession, xrefs: 004502FE
RmRestart, xrefs: 00450352
RmGetList, xrefs: 00450328
RmEndSession, xrefs: 00450367
RmRegisterResources, xrefs: 00450313
Rstrtmgr.dll, xrefs: 004502E6

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 1968650500-3419246398
Opcode ID: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
Opcode Fuzzy Hash: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C

Uniqueness

Uniqueness Score: -1.00%

Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f88a0fad56de9c729f2995427ba7f602706c1c2dd85511d5f0d29e6fe2ee61
Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
Opcode Fuzzy Hash: a8f88a0fad56de9c729f2995427ba7f602706c1c2dd85511d5f0d29e6fe2ee61
Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09

Uniqueness

Uniqueness Score: -1.00%

Function 0042285C Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 3fc7cefd77d309d2013a8afda780c24615e088d2c333d8c3c434309d64232e3f
Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
Opcode Fuzzy Hash: 3fc7cefd77d309d2013a8afda780c24615e088d2c333d8c3c434309d64232e3f
Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58

Uniqueness

Uniqueness Score: -1.00%

Function 004673A4 Relevance: 15.6, APIs: 4, Strings: 4, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004958CC: GetWindowRect.USER32(00000000), ref: 004958E2

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00467773

Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,0046778D), ref: 0041D6DB

Part of subcall function 00467180: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249
Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0

Part of subcall function 00466B40: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58

Part of subcall function 00495B50: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00495B5A

Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0049581C: GetDC.USER32(00000000), ref: 0049583E
Part of subcall function 0049581C: SelectObject.GDI32(?,00000000), ref: 00495864
Part of subcall function 0049581C: ReleaseDC.USER32(00000000,?), ref: 004958B5

Part of subcall function 00495B40: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00495B4A

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 004683FD
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0046840E
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00468426

Part of subcall function 0042A05C: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A072

Strings

STOPIMAGE, xrefs: 00467768
%H, xrefs: 0046766D, 00467681
, xrefs: 00467835
(Default), xrefs: 00468A0F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectReleaseSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE$%H
API String ID: 3231140908-2624782221
Opcode ID: 061c577f146de6d102eda1e26f425fafce425150d5b53e721a6d527fc500dab5
Instruction ID: 1a3196d4b4984e68f3522cc8585b165e0004af585c118fa25862355e2bbb38c0
Opcode Fuzzy Hash: 061c577f146de6d102eda1e26f425fafce425150d5b53e721a6d527fc500dab5
Instruction Fuzzy Hash: 95F2C6346005248FCB00EF69D9D9F9973F1BF49304F1582BAE5049B36ADB74AC46CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00455E0C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42
GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,00455F29,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E98

Strings

GetDiskFreeSpaceExA, xrefs: 00455E32
kernel32.dll, xrefs: 00455E37

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: 409835b603e199d4170178d82c1615a1651ba94ec2cafac24c158ef3a131e909
Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
Opcode Fuzzy Hash: 409835b603e199d4170178d82c1615a1651ba94ec2cafac24c158ef3a131e909
Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68

Uniqueness

Uniqueness Score: -1.00%

Function 00474F88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 00474FE1
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 004750BE
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 004750CC

Strings

unins, xrefs: 00475034
unins???.*, xrefs: 00474FCB

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 5694a42eb150251fb2d21d59745723ab77c8c508b9b74b4b7d8db0bece83f3a5
Instruction ID: 191fa049ef1442540897bd6b232d6b1da598bf4afdbbee48782243349675ce5a
Opcode Fuzzy Hash: 5694a42eb150251fb2d21d59745723ab77c8c508b9b74b4b7d8db0bece83f3a5
Instruction Fuzzy Hash: 95315074A00548ABCB10EB65CD81BDEB7A9DF45304F50C0B6E40CAB3A2DB789F418B59

Uniqueness

Uniqueness Score: -1.00%

Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 77a4f9a42a9b182eca9a30cb1eee9c943385d3d0e7805387745d9337962f8593
Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
Opcode Fuzzy Hash: 77a4f9a42a9b182eca9a30cb1eee9c943385d3d0e7805387745d9337962f8593
Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8

Uniqueness

Uniqueness Score: -1.00%

Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8

Uniqueness

Uniqueness Score: -1.00%

Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 88ecfa13f3ee270e805d5ccef1650ee506ec8760b8390f8b6ad1d401d880426f
Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
Opcode Fuzzy Hash: 88ecfa13f3ee270e805d5ccef1650ee506ec8760b8390f8b6ad1d401d880426f
Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90

Uniqueness

Uniqueness Score: -1.00%

Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 004555B2

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756

Uniqueness

Uniqueness Score: -1.00%

Function 0046F058 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046EE44: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,0047620E,?,0049C1E0,?,0046F15B,?,00000000,0046F6F6,?,_is1), ref: 0046EE67

Part of subcall function 0046EEB4: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F532,?,?,00000000,0046F6F6,?,_is1,?), ref: 0046EEC7

RegCloseKey.ADVAPI32(?,0046F6FD,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F748,?,?,0049C1E0,00000000), ref: 0046F6F0

Strings

NoModify, xrefs: 0046F520
Comments, xrefs: 0046F4EC
QuietUninstallString, xrefs: 0046F3E7
EstimatedSize, xrefs: 0046F66D
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046F0AE
Inno Setup: App Path, xrefs: 0046F17E
" /SILENT, xrefs: 0046F3DA
URLInfoAbout, xrefs: 0046F43E
NoRepair, xrefs: 0046F534
Inno Setup: User Info: Organization, xrefs: 0046F2BB
DisplayVersion, xrefs: 0046F404
_is1, xrefs: 0046F0B4
MajorVersion, xrefs: 0046F57F
MinorVersion, xrefs: 0046F591
InstallDate, xrefs: 0046F553
Inno Setup: No Icons, xrefs: 0046F1CB
Inno Setup: Setup Version, xrefs: 0046F149
DisplayIcon, xrefs: 0046F373
Contact, xrefs: 0046F4CF
Inno Setup: Language, xrefs: 0046F2F7
5.5.3 (a), xrefs: 0046F14E
Inno Setup: Selected Components, xrefs: 0046F228
Inno Setup: User Info: Name, xrefs: 0046F2A6
URLUpdateInfo, xrefs: 0046F495
Inno Setup: User, xrefs: 0046F1EA
Readme, xrefs: 0046F4B2
Inno Setup: Setup Type, xrefs: 0046F209
RegisterPreviousData, xrefs: 0046F6A6
DisplayName, xrefs: 0046F356
Inno Setup: User Info: Serial, xrefs: 0046F2D0
InstallLocation, xrefs: 0046F19E
UninstallString, xrefs: 0046F3AD
Publisher, xrefs: 0046F421
Inno Setup: Deselected Components, xrefs: 0046F247
Inno Setup: Icon Group, xrefs: 0046F1AD
HelpTelephone, xrefs: 0046F45B
ModifyPath, xrefs: 0046F50C
HelpLink, xrefs: 0046F478
Inno Setup: Deselected Tasks, xrefs: 0046F28E
Inno Setup: Selected Tasks, xrefs: 0046F26F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Value$Close
String ID: " /SILENT$5.5.3 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3391052094-3342197833
Opcode ID: 20177b5e09bda3d39b0f5a3b3099d0b20d53ab700288e26487c926a63f738ffb
Instruction ID: 0d1426ff9ce9a688a4d167ea33859b9e50b28094dc6fe7db73e07d6bdcf854ec
Opcode Fuzzy Hash: 20177b5e09bda3d39b0f5a3b3099d0b20d53ab700288e26487c926a63f738ffb
Instruction Fuzzy Hash: D1125935A001089BDB04EF95E881ADE73F5EB48304F24817BE8506B366EB79AD45CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00456638 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

76CCE550.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004569E3), ref: 0045667E
76CCE550.OLE32(00499764,00000000,00000001,00499774,?,00000000,004569E3), ref: 004566A4
SysFreeString.OLEAUT32(00000000), ref: 0045685B

Strings

IPersistFile::Save, xrefs: 00456962
IPropertyStore::Commit, xrefs: 004568E3
CoCreateInstance, xrefs: 004566AF
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00456840
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004567BD
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 00456904
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004567F1
{pf32}\, xrefs: 0045671E
%ProgramFiles(x86)%\, xrefs: 0045672E
IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 004568CA
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456892

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: E550$FreeString
String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
API String ID: 491012016-2363233914
Opcode ID: 26ac11ebc8d2bbba6934e2b7da4071208c956f88b3f37f3572524cf0602978ca
Instruction ID: 2d3acbfbfe5134b3b68b6dcde43dfe431d970b0eaffbfac770a5f5266a6492d0
Opcode Fuzzy Hash: 26ac11ebc8d2bbba6934e2b7da4071208c956f88b3f37f3572524cf0602978ca
Instruction Fuzzy Hash: 39B13170A00104AFDB50DFA9C845B9E7BF8AF09706F5540AAF804E7362DB78DD48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00483A7C Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483A8D
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483A9A
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483AA8
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483AB0
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483ABC
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483ADD
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483AF0
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483AF6
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483B0D

Strings

GetSystemWow64DirectoryA, xrefs: 00483AD7
GetNativeSystemInfo, xrefs: 00483A94
advapi32.dll, xrefs: 00483AEB
RegDeleteKeyExA, xrefs: 00483AE6
IsWow64Process, xrefs: 00483AAA
kernel32.dll, xrefs: 00483A88

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 7dca9948a1095c4364ab55fa8ed369d502b26d1142efbcbd424e95be4cda74f5
Instruction ID: d1db678d6bd555fecb25ccca0b477ef677e73c145b16f55f8d8b06b946339d0c
Opcode Fuzzy Hash: 7dca9948a1095c4364ab55fa8ed369d502b26d1142efbcbd424e95be4cda74f5
Instruction Fuzzy Hash: 7F1181C0204741A4DA00BFB94D45B6F65889B11F2AF040C7B6840AA287EABCEF44A76E

Uniqueness

Uniqueness Score: -1.00%

Function 00468D88 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00468FA2,?,?,00000001,00000000,00000000,00468FBD,?,00000000,00000000,?), ref: 00468F8B

Strings

Inno Setup: Deselected Tasks, xrefs: 00468F19
Inno Setup: User Info: Name, xrefs: 00468F47
Inno Setup: App Path, xrefs: 00468E4A
Inno Setup: No Icons, xrefs: 00468E73
%s\%s_is1, xrefs: 00468E05
Inno Setup: User Info: Organization, xrefs: 00468F5A
Inno Setup: Selected Tasks, xrefs: 00468EF7
Inno Setup: Icon Group, xrefs: 00468E66
Inno Setup: Setup Type, xrefs: 00468E9A
Inno Setup: Deselected Components, xrefs: 00468ECC
Inno Setup: User Info: Serial, xrefs: 00468F6D
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468DE7
Inno Setup: Selected Components, xrefs: 00468EAA

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: b9928a5b5c0cf6c1dc91f6627cbb06318d05b30c5d76f15ccadbaf9fdfcb7506
Instruction ID: 069c4cdb4b1287edb5c1b702bebeb6c44c7684ad2aa17a57d1fdfe9a2539746b
Opcode Fuzzy Hash: b9928a5b5c0cf6c1dc91f6627cbb06318d05b30c5d76f15ccadbaf9fdfcb7506
Instruction Fuzzy Hash: 6B51A330A006449BCB15DB65D881BDEB7F5EB48304F50857EE840AB391EB79AF01CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047C66C Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5), ref: 0042D8AB

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

SHGetKnownFolderPath.SHELL32(00499D30,00008000,00000000,?,00000000,0047C942), ref: 0047C846
76CF83B0.OLE32(?,0047C88B), ref: 0047C87E

Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233

Strings

SystemDrive, xrefs: 0047C6D3
ProgramFilesDir, xrefs: 0047C734, 0047C7BB
Failed to get path of 64-bit Program Files directory, xrefs: 0047C7DD
\Program Files, xrefs: 0047C75B
CommonFilesDir, xrefs: 0047C76E, 0047C7EA
Common Files, xrefs: 0047C7A5
cmd.exe, xrefs: 0047C8FC
COMMAND.COM, xrefs: 0047C91D
Failed to get path of 64-bit Common Files directory, xrefs: 0047C80C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Directory$AddressEnvironmentFolderHandleKnownModulePathProcSystemVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 356131955-544719455
Opcode ID: 23963da8b4b34a95ffd58041a931adf40c150fbdd8371ea61f0364dbdea36cdf
Instruction ID: 88e29a10730232d74bbdb0c5b7d00c3ea12cf2700f44d19641833b453bfd909d
Opcode Fuzzy Hash: 23963da8b4b34a95ffd58041a931adf40c150fbdd8371ea61f0364dbdea36cdf
Instruction Fuzzy Hash: 1461CF74A00204AFDB10EBA5D8C2A9E7B69EB44319F90C47FE404A7392DB3C9A44CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00472B48 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472D00
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472E07
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472E1D
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472E42

Strings

.url, xrefs: 00472C1A
Filename: %s, xrefs: 00472CA2
Desktop.ini, xrefs: 00472EC3
.pif, xrefs: 00472BF7, 00472D8B
{group}\, xrefs: 00472BA2
.lnk, xrefs: 00472BD4
target.lnk, xrefs: 00472E8C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 7a5ae740bf12d7c0914506075995ef9616c65b722964304fe64b2cd854615d78
Instruction ID: 7edda302242157afef40b0e7c7e05039b068dedd9e36cd510e855ba872eb221a
Opcode Fuzzy Hash: 7a5ae740bf12d7c0914506075995ef9616c65b722964304fe64b2cd854615d78
Instruction Fuzzy Hash: D0D14574A001489FDB11EFA9D981BDDBBF4AF08304F50816AF904B7392C778AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
RegisterClassA.USER32(00499630), ref: 004238B7
GetSystemMetrics.USER32(00000000), ref: 004238D9
GetSystemMetrics.USER32(00000001), ref: 004238E8
SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2

Strings

|6B, xrefs: 00423893, 00423914

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: |6B
API String ID: 183575631-3009739247
Opcode ID: 5571f2138a9ea83ce0d9c1dcd1b3cc51cb16f92404a0700befc21e2951ab6ca0
Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
Opcode Fuzzy Hash: 5571f2138a9ea83ce0d9c1dcd1b3cc51cb16f92404a0700befc21e2951ab6ca0
Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D

Uniqueness

Uniqueness Score: -1.00%

Function 0047CE78 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047CF7A

Strings

_isetup\_shfoldr.dll, xrefs: 0047CEAA
SHGetFolderPathA, xrefs: 0047CF6F
Failed to load DLL "%s", xrefs: 0047CF5D
]xI, xrefs: 0047CF58
Failed to get version numbers of _shfoldr.dll, xrefs: 0047CED0
SHFOLDERDLL, xrefs: 0047CEB7
shfolder.dll, xrefs: 0047CEDD, 0047CF16
Failed to get address of SHGetFolderPath function, xrefs: 0047CF8B
shell32.dll, xrefs: 0047CF25

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$]xI$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-256906917
Opcode ID: c4b8d3d93c7f37bb14fa31bc5bbe574b3393d33fbabbe9beac26f258e91ad005
Instruction ID: ec9c61b31d03a4d18d2fa5da2167344019e511a33ceb5cf80618cf604467b355
Opcode Fuzzy Hash: c4b8d3d93c7f37bb14fa31bc5bbe574b3393d33fbabbe9beac26f258e91ad005
Instruction Fuzzy Hash: 20311D30E001499BCB10EFA5D5D1ADEB7B5EF44308F50847BE504E7281D778AE458B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498BC0), ref: 00406322
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498BC0), ref: 00406366

Strings

SetSearchPathMode, xrefs: 0040633F
SetProcessDEPPolicy, xrefs: 00406355
SetDllDirectoryW, xrefs: 00406329
kernel32.dll, xrefs: 0040631D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD

Uniqueness

Uniqueness Score: -1.00%

Function 0041321B Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Strings

3A, xrefs: 0041343D
yA, xrefs: 004132DE

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: LongWindow$Prop
String ID: 3A$yA
API String ID: 3887896539-3278460822
Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A

Uniqueness

Uniqueness Score: -1.00%

Function 00481854 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00481A11
FreeLibrary.KERNEL32(00000000), ref: 00481A25
SendNotifyMessageA.USER32(00020470,00000496,00002710,00000000), ref: 00481A97

Strings

DeinitializeSetup, xrefs: 0048190D
Deinitializing Setup., xrefs: 00481872
Not restarting Windows because Setup is being run from the debugger., xrefs: 00481A46
GetCustomSetupExitCode, xrefs: 004818B1
Restarting Windows., xrefs: 00481A72

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 050724d5784164bcc6f320fb88d14c1ed674207e07551f10b43b093d89fd870c
Instruction ID: b122ee3e0244d1cffd13458a0655c780be2d4a3cdc4850abd58d30bc7702deed
Opcode Fuzzy Hash: 050724d5784164bcc6f320fb88d14c1ed674207e07551f10b43b093d89fd870c
Instruction Fuzzy Hash: C651BF347042409FD715EB69E9A5B6E7BE8EB19314F10887BE800C72B2DB389C46CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00467180 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249

Part of subcall function 004670C0: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00467158
Part of subcall function 004670C0: DestroyCursor.USER32(00000000), ref: 0046716E

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467301
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467327

Strings

c:\directory, xrefs: 0046721E
%H, xrefs: 0046718B
shell32.dll, xrefs: 00467284

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll$%H
API String ID: 3376378930-166502273
Opcode ID: d7a251f7ede599729126a20c6e5bc656e487c76ea0efebb03c6af550fa195c4c
Instruction ID: 732e1a1751fb8a235258c93266195bfa595ebd68417bad8a6af0601d960a2915
Opcode Fuzzy Hash: d7a251f7ede599729126a20c6e5bc656e487c76ea0efebb03c6af550fa195c4c
Instruction Fuzzy Hash: 8A516070604244AFD710DF65CD8AFDFB7A8EB48308F1081A6F80897351D6789E81DA59

Uniqueness

Uniqueness Score: -1.00%

Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F58F
GetFocus.USER32 ref: 0042F597
RegisterClassA.USER32(004997AC), ref: 0042F5B8
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,00458352,00000000,0049B628), ref: 0042F654

Strings

TWindowDisabler-Window, xrefs: 0042F5EF, 0042F635

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: 6457ecc35c2f1d364d6e716b0d71ec85e57c583cde0b886464f42e17a697c21b
Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
Opcode Fuzzy Hash: 6457ecc35c2f1d364d6e716b0d71ec85e57c583cde0b886464f42e17a697c21b
Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD

Uniqueness

Uniqueness Score: -1.00%

Function 004729F8 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000,?,00472D15,?,?,00000000,00472F84), ref: 00472A1C

Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000,?,00472D15), ref: 00472A93
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000), ref: 00472A99

Strings

.ShellClassInfo, xrefs: 00472A4B
target.lnk, xrefs: 00472A71
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 00472A55
desktop.ini, xrefs: 00472A30
CLSID2, xrefs: 00472A46

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: d8d5a0be0440fc7cb79ca7a1d8c05833802e09f0bac54326b854a3cb5eabaf25
Instruction ID: 1765d5ebfc4e6887f49e3816ac39c9d5a3c16910e93b0aec031ce55b1572895b
Opcode Fuzzy Hash: d8d5a0be0440fc7cb79ca7a1d8c05833802e09f0bac54326b854a3cb5eabaf25
Instruction Fuzzy Hash: 6711B2707005147BD721EAAA8D82B9F73ACDB49714F61C17BB404B72C2DBBCAE01861C

Uniqueness

Uniqueness Score: -1.00%

Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 00453210
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 0045322A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Strings

kernel32.dll, xrefs: 0045320B, 00453225
shell32.dll, xrefs: 0045325C
Wow64DisableWow64FsRedirection, xrefs: 00453206
Wow64RevertWow64FsRedirection, xrefs: 00453220

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: d7661fd9f0913dad122060e2c1ded37189c483bc636f4dff06c0b7ded89dfa78
Instruction ID: a781b9bdaab79611976bfea65fa4e072d6e85bd62b4b6e26dfe65079d72397a7
Opcode Fuzzy Hash: d7661fd9f0913dad122060e2c1ded37189c483bc636f4dff06c0b7ded89dfa78
Instruction Fuzzy Hash: EA01D470240B00FED301AF63AD12F663A58D7557ABF6044BBFC14965C2C77C4A088E6D

Uniqueness

Uniqueness Score: -1.00%

Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
GetCurrentThreadId.KERNEL32 ref: 00430971
GlobalAddAtomA.KERNEL32(00000000), ref: 00430992

Strings

WndProcPtr%.8X%.8X, xrefs: 00430983
commdlg_help, xrefs: 00430943
commdlg_FindReplace, xrefs: 00430952

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 00476C50 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00476CA9
SetWindowLongW.USER32(00000000,000000FC,00476C04), ref: 00476CD0
GetACP.KERNEL32(00000000,00476EE8,?,00000000,00476F12), ref: 00476D0D
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00476D53

Strings

COMBOBOX, xrefs: 00476CA2
Inno Setup: Language, xrefs: 00476DDB

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: 1db359e320ab2741222256d54ad499686456584f5ec697b8868a090b3fdd66eb
Instruction ID: b13fa11fcbd9abdf7db93726dac51e4442bd67f198c8610d2c1064f44be53319
Opcode Fuzzy Hash: 1db359e320ab2741222256d54ad499686456584f5ec697b8868a090b3fdd66eb
Instruction Fuzzy Hash: 46812C346006059FDB10DF69D985AEAB7F2FB09304F15C1BAE808EB762D778AD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00455010 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7

Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Strings

.cmd, xrefs: 004550BB
D, xrefs: 00455158
cmd.exe" /C ", xrefs: 004550ED
COMMAND.COM" /C , xrefs: 00455124
.bat, xrefs: 004550A0

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 33a21594b2f272348ca173e1bf8fbb29317a3fdaed0398a7107b4f02c3bab763
Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
Opcode Fuzzy Hash: 33a21594b2f272348ca173e1bf8fbb29317a3fdaed0398a7107b4f02c3bab763
Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
OemToCharA.USER32(?,?), ref: 0042375C
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Strings

MAINICON, xrefs: 00423711
2, xrefs: 004236EA

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
Opcode Fuzzy Hash: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
GetCurrentThreadId.KERNEL32 ref: 00418F79
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A

Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144

Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D

Strings

Delphi%.8X, xrefs: 00418F4F
ControlOfs%.8X%.8X, xrefs: 00418F8B

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F

Uniqueness

Uniqueness Score: -1.00%

Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE

Uniqueness

Uniqueness Score: -1.00%

Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5

Strings

PendingFileRenameOperations2, xrefs: 00455784
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738
WININIT.INI, xrefs: 004557E4
PendingFileRenameOperations, xrefs: 00455754

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 430bb035026106b65f85e2b07525b73901b650abba9068f13605831850c1f819
Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
Opcode Fuzzy Hash: 430bb035026106b65f85e2b07525b73901b650abba9068f13605831850c1f819
Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0047CB94 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047CCEA,?,?,00000000,0049B628,00000000,00000000,?,00498539,00000000,004986E2,?,00000000), ref: 0047CC27
GetLastError.KERNEL32(00000000,00000000,00000000,0047CCEA,?,?,00000000,0049B628,00000000,00000000,?,00498539,00000000,004986E2,?,00000000), ref: 0047CC30

Strings

Created temporary directory: , xrefs: 0047CBC9
_isetup, xrefs: 0047CC12
\_setup64.tmp, xrefs: 0047CCA2

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: 15246a7260a354d37efc87005b8c751c01ee3b74e4206f1c0260e9ccc9d04e3e
Instruction ID: e6577b7b61f0e0a35e690824fc442bae28cfcbc8f9cba78cd8161ab2dbd6b5d1
Opcode Fuzzy Hash: 15246a7260a354d37efc87005b8c751c01ee3b74e4206f1c0260e9ccc9d04e3e
Instruction Fuzzy Hash: E6412834A001099BDB11EFA5D882ADEB7B5EF45309F50843BE81577392DA38AE05CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00423A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A1C), ref: 00423AA8
GetWindow.USER32(?,00000003), ref: 00423ABD
GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

Strings

\AB, xrefs: 00423AF2, 00423AF6

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: \AB
API String ID: 4191631535-3948367934
Opcode ID: 1f387ac1e946b45dcea70a74dde1e3cf145931a60cd8f654a7309261af8d74ee
Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
Opcode Fuzzy Hash: 1f387ac1e946b45dcea70a74dde1e3cf145931a60cd8f654a7309261af8d74ee
Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042DE44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,0049785D), ref: 0042DE6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71

Strings

RegDeleteKeyExA, xrefs: 0042DE61
advapi32.dll, xrefs: 0042DE66

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D

Uniqueness

Uniqueness Score: -1.00%

Function 0046BB10 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

Need to restart Windows? %s, xrefs: 0046BE95
PrepareToInstall failed: %s, xrefs: 0046BE6E
NextButtonClick, xrefs: 0046BC4C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: 5d17874146d60b75ad460dbe0a65a057f1b706e416996ea922dce04c170435bc
Instruction ID: 9de4db1b3e70fdebeced0fe060001c857bcfdee1b2562a0b259a97201065334e
Opcode Fuzzy Hash: 5d17874146d60b75ad460dbe0a65a057f1b706e416996ea922dce04c170435bc
Instruction Fuzzy Hash: 46D12F34A00108DFCB14EB99D985AED77F5EF49304F5440BAE404EB362D778AE85CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00483084 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,004833D5), ref: 004831A8
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00483246

Strings

, xrefs: 00483303
Need to restart Windows? %s, xrefs: 00483283

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: f3164b8d1c7f9ae2aabe4aebf04c2bbf0d3651d11bf05fff97eb65ef8f772e24
Instruction ID: 855c298393525188f16043e43c8caa20abfdb27870bda8f6eb76b0fac02994d3
Opcode Fuzzy Hash: f3164b8d1c7f9ae2aabe4aebf04c2bbf0d3651d11bf05fff97eb65ef8f772e24
Instruction Fuzzy Hash: 7E918F34A042449FDB10EF69D8C6BAD77E0AF55708F5484BBE8009B362DB78AE05CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0046FADC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

GetLastError.KERNEL32(00000000,0046FCD9,?,?,0049C1E0,00000000), ref: 0046FBB6
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FC30
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FC55

Strings

Creating directory: %s, xrefs: 0046FB9E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: b081b5451f9253bf7df266bab53e6145b6a86aabad9903036a0d0a35cf4a9b86
Instruction ID: a145aa70eb484b5d007d33f2831cd5d1f219efd535f83afbcf26a903565c5eea
Opcode Fuzzy Hash: b081b5451f9253bf7df266bab53e6145b6a86aabad9903036a0d0a35cf4a9b86
Instruction Fuzzy Hash: 7D512F74E00248ABDB01DBA5D982ADEBBF4AF49304F50847AEC50B7382D7795E08CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC

Strings

SfcIsFileProtected, xrefs: 00454E7C
sfc.dll, xrefs: 00454E44

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: bb559eb6b427547f50ac361efa45694dce53a5facbc0d321e4ca2111cb35c873
Instruction ID: 709c5f55a6f5f8285c9c61fd8393730e8027effee09c5548c71846991cac34f0
Opcode Fuzzy Hash: bb559eb6b427547f50ac361efa45694dce53a5facbc0d321e4ca2111cb35c873
Instruction Fuzzy Hash: E8419671A04318DBEB20EF59DC85B9DB7B8AB4430DF5041B7A908A7293D7785F88CA1C

Uniqueness

Uniqueness Score: -1.00%

Function 00452510 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D31520.VERSION(00000000,?,?,?,00497900), ref: 00452530
74D31500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,00497900), ref: 0045255D
74D31540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,00497900), ref: 00452577

Strings

%E, xrefs: 004525BB, 00452583

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: D31500D31520D31540
String ID: %E
API String ID: 1003763464-175436132
Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765

Uniqueness

Uniqueness Score: -1.00%

Function 0044B38C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B401
SelectObject.GDI32(?,00000000), ref: 0044B424
ReleaseDC.USER32(00000000,?), ref: 0044B457

Strings

%H, xrefs: 0044B394

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID: %H
API String ID: 1831053106-1959103961
Opcode ID: 613a86eb96bd964688756472f8397141eb38d2c4caf6b0936a0a8cf616000036
Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
Opcode Fuzzy Hash: 613a86eb96bd964688756472f8397141eb38d2c4caf6b0936a0a8cf616000036
Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0044B0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,%H,?,?), ref: 0044B11E
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165

Strings

%H, xrefs: 0044B0C8

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID: %H
API String ID: 65125430-1959103961
Opcode ID: b9978a40832644be7eb99ff61e6ae739c3599586bb389d309c0d7579617ef2e1
Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
Opcode Fuzzy Hash: b9978a40832644be7eb99ff61e6ae739c3599586bb389d309c0d7579617ef2e1
Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669

Uniqueness

Uniqueness Score: -1.00%

Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8

Strings

SHAutoComplete, xrefs: 0042EDA2
shlwapi.dll, xrefs: 0042ED73

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: 42f9dcb05abbf77f41298dba7160eccf52289638d4fdae2cac913a0c4d077c72
Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
Opcode Fuzzy Hash: 42f9dcb05abbf77f41298dba7160eccf52289638d4fdae2cac913a0c4d077c72
Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D

Uniqueness

Uniqueness Score: -1.00%

Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E

Strings

PendingFileRenameOperations2, xrefs: 00455A4F
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C
PendingFileRenameOperations, xrefs: 00455A40

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 336a8554af3216e9fad4f98949cc8fac3f30a8fbf7097481dd1a9e766711aba3
Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
Opcode Fuzzy Hash: 336a8554af3216e9fad4f98949cc8fac3f30a8fbf7097481dd1a9e766711aba3
Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C

Uniqueness

Uniqueness Score: -1.00%

Function 00472154 Relevance: 6.3, APIs: 4, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00472325,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1), ref: 00472301
FindClose.KERNEL32(000000FF,0047232C,00472325,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1,?), ref: 0047231F
FindNextFileA.KERNEL32(000000FF,?,00000000,00472447,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1), ref: 00472423
FindClose.KERNEL32(000000FF,0047244E,00472447,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1,?), ref: 00472441

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 08bd6d4e838eca29b340db5d047226462d3a991f9a4c3a84c373a7e9e91fbb46
Instruction ID: ff38abb04fb96460afd2c3532f2e87b2ffc4f25b99c166b2ff4046d92e8ebf4f
Opcode Fuzzy Hash: 08bd6d4e838eca29b340db5d047226462d3a991f9a4c3a84c373a7e9e91fbb46
Instruction Fuzzy Hash: 3EC14C3490424D9FCF11DFA5C981ADEBBB8FF49304F5080AAE808B3251D7789A46CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0047FCF8 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?,?,00000000), ref: 0047FD9E
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?,?), ref: 0047FDAB
FindNextFileA.KERNEL32(000000FF,?,00000000,0047FEC4,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147), ref: 0047FEA0
FindClose.KERNEL32(000000FF,0047FECB,0047FEC4,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?), ref: 0047FEBE

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 5539f11817233cbc3e6ac1ccbdb4a9649e3e6c8b60d318a48af7793ecf422177
Instruction ID: 5570db9595827249690d4c596f970be035a6cb65fb6c4bc3b070d2a6e7e06d26
Opcode Fuzzy Hash: 5539f11817233cbc3e6ac1ccbdb4a9649e3e6c8b60d318a48af7793ecf422177
Instruction Fuzzy Hash: 34512D71A006499FCB21DF65CC45ADEB7B8EB88319F1084BAA818A7351D7389F89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421361
SetMenu.USER32(00000000,00000000), ref: 0042137E
SetMenu.USER32(00000000,00000000), ref: 004213B3
SetMenu.USER32(00000000,00000000), ref: 004213CF

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D

Uniqueness

Uniqueness Score: -1.00%

Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B84
SetTextColor.GDI32(?,00000000), ref: 00416B9E
SetBkColor.GDI32(?,00000000), ref: 00416BB8
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69

Uniqueness

Uniqueness Score: -1.00%

Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: e6feda7d3358a80d2693463bb1cb51aaf78648cef31b4280cf5022ab190105ae
Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
Opcode Fuzzy Hash: e6feda7d3358a80d2693463bb1cb51aaf78648cef31b4280cf5022ab190105ae
Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78

Uniqueness

Uniqueness Score: -1.00%

Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042311E
EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
ReleaseDC.USER32(00000000,00000000), ref: 00423144

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE

Uniqueness

Uniqueness Score: -1.00%

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
Opcode Fuzzy Hash: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0047CD48 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047CD69
GetLastError.KERNEL32 ref: 0047CD73
GetTickCount.KERNEL32 ref: 0047CD7D
Sleep.KERNEL32(00000032), ref: 0047CD8D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 81c97dbf5948de899416f6368447fdcf0451c727da6d5f131c1a33ac7977f59e
Instruction ID: 56d8cd0ebf6ab4a4d31aad6ab38b951dee0ff9c0bbbb70c30f4e079d31b44593
Opcode Fuzzy Hash: 81c97dbf5948de899416f6368447fdcf0451c727da6d5f131c1a33ac7977f59e
Instruction Fuzzy Hash: C6E0ED6A30921149863131AE98CA6AF4D48CBC2324B28853FE08CE6283C89C4C0A867E

Uniqueness

Uniqueness Score: -1.00%

Function 0045C264 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

FlushFileBuffers.KERNEL32(?), ref: 0045C499

Strings

NumRecs range exceeded, xrefs: 0045C396
EndOffset range exceeded, xrefs: 0045C3CD

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: a46ebc0c75e38cfc1d47e83880391ac29e35d2e9842f1f48ebdcfee3728b7fb6
Instruction ID: 69b4fe9c868b7cadc716880164946defc5db249b4b2908964217ac1dcc813941
Opcode Fuzzy Hash: a46ebc0c75e38cfc1d47e83880391ac29e35d2e9842f1f48ebdcfee3728b7fb6
Instruction Fuzzy Hash: 4F617334A002588FDB25DF25C891AD9B7B5AF49305F0084DAED88AB353D674AEC8CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0048358C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00483716,?,00000000,00483757,?,?,?,?,00000000,00000000,00000000,?,0046BD99), ref: 004835C5
SetActiveWindow.USER32(?,00000000,00483716,?,00000000,00483757,?,?,?,?,00000000,00000000,00000000,?,0046BD99), ref: 004835D7

Strings

Will not restart Windows automatically., xrefs: 004836F6

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: fd09d5a5f6cccbb829e281a43361b03d1ada35bfa693f2951a58170467c6de9f
Instruction ID: 4bdce942002d158aae482430f0c171f92fa141a3e9c551c877f01fd154286bbb
Opcode Fuzzy Hash: fd09d5a5f6cccbb829e281a43361b03d1ada35bfa693f2951a58170467c6de9f
Instruction Fuzzy Hash: 7F414870648240BFD321FF68DC92B6D3BE49718B09F6448B7E440573A2E37D9A059B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00498BA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498BB6), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498BB6), ref: 00403356

Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498BC0), ref: 00406322
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498BC0), ref: 00406366

Part of subcall function 004063C4: 6F561CD0.COMCTL32(00498BC5), ref: 004063C4

Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2

Part of subcall function 00419040: GetVersion.KERNEL32(00498BDE), ref: 00419040

Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498BF2), ref: 0044F77F
Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,00498BF7), ref: 0044FC1F

Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 00453210
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 0045322A
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Part of subcall function 004570B4: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8

Part of subcall function 004645F4: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498C1A), ref: 00464603
Part of subcall function 004645F4: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609

Part of subcall function 0046CDF0: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE05

Part of subcall function 00478C20: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498C24), ref: 00478C26
Part of subcall function 00478C20: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478C33
Part of subcall function 00478C20: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478C43

Part of subcall function 00483F88: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484077

Part of subcall function 00495BB4: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00495BCD

SetErrorMode.KERNEL32(00000001,00000000,00498C6C), ref: 00498C3E

Part of subcall function 00498968: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498C48,00000001,00000000,00498C6C), ref: 00498972
Part of subcall function 00498968: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498978

Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00498C6C), ref: 00498C9F

Part of subcall function 004825C8: SetActiveWindow.USER32(?), ref: 00482676

Strings

Setup, xrefs: 00498C85

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF561FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 629812316-3839654196
Opcode ID: b35466028edd7e3a1b236c6640422c08041f3fa3d34e6d3560873e5a4108b4d0
Instruction ID: b535e719d7157e93998cc10f536158ae488692691c8c4e2dacdcbf5c7207fd3e
Opcode Fuzzy Hash: b35466028edd7e3a1b236c6640422c08041f3fa3d34e6d3560873e5a4108b4d0
Instruction Fuzzy Hash: 873104312446409FD601BBBBFD5392D3B94EF8A728B91447FF80496693DE3C68508A7E

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC

Strings

$=H, xrefs: 0042DD2F, 0042DC88, 0042DC98, 0042DCF4, 0042DD18, 0042DD08, 0042DCDF

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: QueryValue
String ID: $=H
API String ID: 3660427363-3538597426
Opcode ID: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
Opcode Fuzzy Hash: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00453A24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73

Strings

.tmp, xrefs: 00453A53

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: ad15d04db016d8ec48b224cf88302df48740c9a9b896926c32662353b3187fec
Instruction ID: 2c169793aa1d4e8b0ae54453200dd0eeecd34c8d921a2c5b894f13e1de3ec917
Opcode Fuzzy Hash: ad15d04db016d8ec48b224cf88302df48740c9a9b896926c32662353b3187fec
Instruction Fuzzy Hash: BD213575A002089BDB01EFA5C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00483F88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00483A7C: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483A8D
Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483A9A
Part of subcall function 00483A7C: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483AA8
Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483AB0
Part of subcall function 00483A7C: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483ABC
Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483ADD
Part of subcall function 00483A7C: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483AF0
Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483AF6

Part of subcall function 00483DA8: GetVersionExA.KERNEL32(?,00483FBA,00000000,0048408F,?,?,?,?,?,00498C29), ref: 00483DB6
Part of subcall function 00483DA8: GetVersionExA.KERNEL32(0000009C,?,00483FBA,00000000,0048408F,?,?,?,?,?,00498C29), ref: 00483E08

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484077

Strings

shell32.dll, xrefs: 0048406C
SHGetKnownFolderPath, xrefs: 00484062

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 3869789854-2936008475
Opcode ID: 24bfbd8baf235fcbd7404033d7799f009542697b8823181e059981251f96c700
Instruction ID: 8066e8dcbdf9c94243579ba2519058cd674f052446347c20ec70bbddfecd8a90
Opcode Fuzzy Hash: 24bfbd8baf235fcbd7404033d7799f009542697b8823181e059981251f96c700
Instruction Fuzzy Hash: 1021F1B06103116AC700BFBE599611B3BA5EB9570C380893FF904DB391D77E68149B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00452908 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 0045293F
GetLastError.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 00452947

Strings

T$H, xrefs: 00452975

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: T$H
API String ID: 2018770650-488339322
Opcode ID: fbcc140a81a3acb9c96393828f2cc587f034b3ec3a8bc9b7824854e1d547cdb8
Instruction ID: a1d21d86fbcf93c7076efe682877c1f84c37cf58088428800e153654eea74c02
Opcode Fuzzy Hash: fbcc140a81a3acb9c96393828f2cc587f034b3ec3a8bc9b7824854e1d547cdb8
Instruction Fuzzy Hash: 05F0C2B2B04608ABDB01EFB59D414AEB7E8EB4E315B6045B7FC04E3742E6B85E148598

Uniqueness

Uniqueness Score: -1.00%

Function 00452E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E47
GetLastError.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E4F

Strings

T$H, xrefs: 00452E7D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID: T$H
API String ID: 377330604-488339322
Opcode ID: 8769a646033274a50feaa89106c60670f2dbad91017c501587ea10a2b48d2d14
Instruction ID: a8b2bafe79397aca91686f8656b478e2385adfe3b855dfce5f6cc0b9ba314abc
Opcode Fuzzy Hash: 8769a646033274a50feaa89106c60670f2dbad91017c501587ea10a2b48d2d14
Instruction Fuzzy Hash: 70F0FC71A04708AFCF01EF759D4249EB7E8DB4E31575049B7FC14E3642E7785E048598

Uniqueness

Uniqueness Score: -1.00%

Function 0047C5D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C92C,00000000,0047C942), ref: 0047C63A

Strings

RegisteredOrganization, xrefs: 0047C629
RegisteredOwner, xrefs: 0047C617

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: fe32ea5757c181cea0fad4739291adb7fe5cb56e5df920aee23c3361bee12acf
Instruction ID: 97ba07fcc0924f8d698b93a4c32f8f7a3ceb81663af41ec066a5e596666b9838
Opcode Fuzzy Hash: fe32ea5757c181cea0fad4739291adb7fe5cb56e5df920aee23c3361bee12acf
Instruction Fuzzy Hash: F5F09060700204ABEB00D6A8ACD2BAA3769D750304F60907FA1058F382C679EE019B5C

Uniqueness

Uniqueness Score: -1.00%

Function 0047524C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475483), ref: 00475271
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475483), ref: 00475288

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

CreateFile, xrefs: 0047527D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 2c7b4fae504844472e6a07c4f0bcfda842c0d735d71c8af9ff6e211e096a353b
Instruction ID: b0794b45f16520e4762b2717541816a935241bfc2e667b83be7f23d95be3de9d
Opcode Fuzzy Hash: 2c7b4fae504844472e6a07c4f0bcfda842c0d735d71c8af9ff6e211e096a353b
Instruction Fuzzy Hash: 99E06D702403447FEA10FA69CCC6F4A77989B04728F10C152BA48AF3E3C5B9FC808A58

Uniqueness

Uniqueness Score: -1.00%

Function 0042DE1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

Strings

;H, xrefs: 0042DE32, 0042DE35
System\CurrentControlSet\Control\Windows, xrefs: 0042DE36

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows$;H
API String ID: 71445658-2565060666
Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4

Uniqueness

Uniqueness Score: -1.00%

Function 004570B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00457044: CoInitialize.OLE32(00000000), ref: 0045704A

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8

Strings

shell32.dll, xrefs: 004570CD
SHCreateItemFromParsingName, xrefs: 004570C3

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 9d30f7af3022304e39d9007edb753d7b8512de14ad0f58a0e87bb64db50414c6
Instruction ID: 7fba65882f7194314ab185764ebfac318737a269d5660949bdaf7135ffc1064c
Opcode Fuzzy Hash: 9d30f7af3022304e39d9007edb753d7b8512de14ad0f58a0e87bb64db50414c6
Instruction Fuzzy Hash: ECC08CA074860093CB40B3FA344320E1841AB8071FB10C07F7A04A66C7DE3C88088B2E

Uniqueness

Uniqueness Score: -1.00%

Function 0046CDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE05

Strings

SHPathPrepareForWriteA, xrefs: 0046CDF0
shell32.dll, xrefs: 0046CDFA

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 4f35c33f472421c4948a2ce6cac4f72f28d005e98571f32e7a9733a845a9f857
Instruction ID: c0603f0a452a360a01ce82207306765f02b8a986224f2e77b24b084cc810d505
Opcode Fuzzy Hash: 4f35c33f472421c4948a2ce6cac4f72f28d005e98571f32e7a9733a845a9f857
Instruction Fuzzy Hash: 44B092A060074086DB40B7A298D262B28269740319B20843BB0CC9BA95EB3E88240B9F

Uniqueness

Uniqueness Score: -1.00%

Function 00481C7C Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00481DB4), ref: 00481D4C
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481D5D
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481D75

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 85f8085dd59925224ce994ed4abb72c3226e4b8b9fa082300e4d7a64be9e7d0b
Instruction ID: 44f8b16540ed1c6eecf525242fd074403e334eda66194076213ef08da8c10300
Opcode Fuzzy Hash: 85f8085dd59925224ce994ed4abb72c3226e4b8b9fa082300e4d7a64be9e7d0b
Instruction Fuzzy Hash: 3431D4307043441AD721FB769C82BAE3A989F15318F54483FF901AB2E3CA7CAD09879D

Uniqueness

Uniqueness Score: -1.00%

Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
TranslateMessage.USER32(?), ref: 0042448F
DispatchMessageA.USER32(?), ref: 00424499

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A

Uniqueness

Uniqueness Score: -1.00%

Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 0041666A
SetPropA.USER32(00000000,00000000), ref: 0041667F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 953367bc10487f5f00132df45b9f4bdc07709d3a3f88142737615a1cc8063318
Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
Opcode Fuzzy Hash: 953367bc10487f5f00132df45b9f4bdc07709d3a3f88142737615a1cc8063318
Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE64
IsWindowEnabled.USER32(?), ref: 0041EE6E
EnableWindow.USER32(?,00000000), ref: 0041EE94

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C

Uniqueness

Uniqueness Score: -1.00%

Function 0048341C Relevance: 4.5, APIs: 3, Instructions: 25threadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,?,?,00483481,?,00483566,?,?,00000000), ref: 00483422
GetWindowThreadProcessId.USER32(00000000,?), ref: 00483434
GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,00483481,?,00483566,?,?,00000000), ref: 0048343D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ProcessWindow$CurrentForegroundThread
String ID:
API String ID: 3477312055-0
Opcode ID: 30efa22169b90dc38136f66a6467a27c26b4f04e2e52f09e67eefe2d80cac6ea
Instruction ID: beb4f515369edaf5f7f8104bbb2c2e6743f65f25389461d3c194e507fd2f85f2
Opcode Fuzzy Hash: 30efa22169b90dc38136f66a6467a27c26b4f04e2e52f09e67eefe2d80cac6ea
Instruction Fuzzy Hash: 8AD01233506A2A7E6611F9E59D828AFB35CD900B58754057BF904A3241D72D9E0446BE

Uniqueness

Uniqueness Score: -1.00%

Function 00469F1C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0046A02D

Strings

PrepareToInstall, xrefs: 00469FD7, 0046A07E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: ce905d11a8887108f3ad14969444655d730b3b5d2faccfdd66681012e3d11b0c
Instruction ID: c614f106b7f0b4f176116dff63491c2ec041d81708a05a15fd0d1780f22877a3
Opcode Fuzzy Hash: ce905d11a8887108f3ad14969444655d730b3b5d2faccfdd66681012e3d11b0c
Instruction Fuzzy Hash: 97A14934A00109DFCB00EF99D986EDEB7F5AF48304F5540B6E404AB362D738AE45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0046C4BC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046C658, 0046C66F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: e5c60157bcf2278da473a52dbfa3e40327efacf8e8b2ac4b78b74c9d89147c88
Instruction ID: 6c3526c54916fe71946563460b5bd12015a165326d65a32731909bc5939f884d
Opcode Fuzzy Hash: e5c60157bcf2278da473a52dbfa3e40327efacf8e8b2ac4b78b74c9d89147c88
Instruction Fuzzy Hash: CF71C370A40215BADB10E766DCD2FEE7BA19F05308F148067F580BB292E779AD458B4E

Uniqueness

Uniqueness Score: -1.00%

Function 004825C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00482676

Strings

InitializeWizard, xrefs: 0048260F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 610dba628312dcddd63cee716be368e1ad8af3103a0d365a4a52240be508be69
Instruction ID: 0fabbc08dbff6a0894d12042e1c617afa12541eacf44f0b659f2bb150b55c2ae
Opcode Fuzzy Hash: 610dba628312dcddd63cee716be368e1ad8af3103a0d365a4a52240be508be69
Instruction Fuzzy Hash: 8311C130204200AFD700EB69EED6B1A37E4E764328F60057BE404D72A1EA796C41CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0047CD9C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047CDE6

Strings

Failed to remove temporary directory: , xrefs: 0047CDFF

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 45da43fd3ae20599d6e25ac9ed9d33e8d604a7859b1119de6f2a098991fc0130
Instruction ID: ec3213607a6b09ae82705bdd380353c192e2de6e0dbfdfb704aaf67811413441
Opcode Fuzzy Hash: 45da43fd3ae20599d6e25ac9ed9d33e8d604a7859b1119de6f2a098991fc0130
Instruction Fuzzy Hash: 0F01B930644604BADB21EB72ED87BDA7798DB45709F60847FB804A7192EA7CA904C95C

Uniqueness

Uniqueness Score: -1.00%

Function 0047C4F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C740,00000000,0047C942), ref: 0047C539

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047C509

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 058bbab7ea9ec86a0dd33160b35f36364f977485e0abef3b7f9f2bc760079b92
Instruction ID: acdf9366f140fa0c09696ff4b806567a5b27613a006b44f2785fa8682630d216
Opcode Fuzzy Hash: 058bbab7ea9ec86a0dd33160b35f36364f977485e0abef3b7f9f2bc760079b92
Instruction Fuzzy Hash: 6CF0823170052477DA00A65E6C82B9FA79D8B84758F60403FF508DB242EABAEE0243EC

Uniqueness

Uniqueness Score: -1.00%

Function 0046EE44 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,0047620E,?,0049C1E0,?,0046F15B,?,00000000,0046F6F6,?,_is1), ref: 0046EE67

Strings

Inno Setup: Setup Version, xrefs: 0046EE65

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: 80676ca53bf8d59feef104d4bc7cb567c816a54b460bafb4a4ed583678a3f251
Instruction ID: 37dbbd71146fd60ed96ba35b84ff74d599aeccd68d0f9eb37ee109455dfe34ad
Opcode Fuzzy Hash: 80676ca53bf8d59feef104d4bc7cb567c816a54b460bafb4a4ed583678a3f251
Instruction Fuzzy Hash: B1E06D753012043FE710AA2B9C85F5BBADCDF88365F10403AB908DB392D578DD0181A9

Uniqueness

Uniqueness Score: -1.00%

Function 0046EEB4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F532,?,?,00000000,0046F6F6,?,_is1,?), ref: 0046EEC7

Strings

NoModify, xrefs: 0046EEC5

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: f40bfeae81701b53243146576d0ffb0e6a468f93b3df03c8cd4f9f1e738a44cb
Instruction ID: 84621f748531697c6bb4a8e0450a59e651a2caf9945441e4ffcb8bd5fa838dfd
Opcode Fuzzy Hash: f40bfeae81701b53243146576d0ffb0e6a468f93b3df03c8cd4f9f1e738a44cb
Instruction Fuzzy Hash: F6E04FB4640308BFEB04DB55CD4AF6B77ECDB48714F10405ABA049B281E674FE00C669

Uniqueness

Uniqueness Score: -1.00%

Function 00454100 Relevance: 3.2, APIs: 2, Instructions: 200fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047CDFB,00000000,0047CD48,00000000), ref: 00454322
FindClose.KERNEL32(000000FF,0045434D,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047CDFB,00000000,0047CD48,00000000,00000000), ref: 00454340

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 010e7e3283e9a7c39cf665d04d89ca01eea1dfdb1bd9956b1f54dc3bbaa76d95
Instruction ID: 54d7d993b90550b5414970fc4389b15b7902a372ed294bc13edf2f45dfba5a61
Opcode Fuzzy Hash: 010e7e3283e9a7c39cf665d04d89ca01eea1dfdb1bd9956b1f54dc3bbaa76d95
Instruction Fuzzy Hash: BE817430A0424D9FCF11DFA5C8457EFBB74AF49309F1440A6EC546B3A2D3399A8ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0047E474 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047E753,?,-0000001A,00480609,-00000010,?,00000004,0000001B,00000000,00480956,?,0045DB68), ref: 0047E4EA

Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,004809BD,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E

SendNotifyMessageA.USER32(00020470,00000496,00002711,-00000001), ref: 0047E6BA

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: 7f479caed6d506e1fedd37a3e9b8fbc918d7d672324c4412b746d2e8a14c4527
Instruction ID: a62c935d52da393e7312112ce75ddb0898731394ffd2a16b1d4fc3e518f8127d
Opcode Fuzzy Hash: 7f479caed6d506e1fedd37a3e9b8fbc918d7d672324c4412b746d2e8a14c4527
Instruction Fuzzy Hash: 5B5195746001049BC710FF67E98169A37E5EB58308B90C67BA8049B3A6DB3CED45CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0047DD98 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047DF83,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047DF3D

Part of subcall function 0042CA00: GetSystemMetrics.USER32(0000002A), ref: 0042CA12

Strings

/G, xrefs: 0047DF6D, 0047DEE0, 0047DEF1, 0047DDD7, 0047DDE2, 0047DE01, 0047DE10

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ByteCharMetricsMultiSystemWide
String ID: /G
API String ID: 224039744-2088674125
Opcode ID: 9f8ad520ff63b3f089cafa147e7d8bbd1691bb3a433f158030b0d1014876a4d7
Instruction ID: 84c81a41a939c89cd5cf89585cf0d961f9543ff151f38a86aad590f5673b43e0
Opcode Fuzzy Hash: 9f8ad520ff63b3f089cafa147e7d8bbd1691bb3a433f158030b0d1014876a4d7
Instruction Fuzzy Hash: 53518070A04215AFDB21DF55D8C4FAA7BB8EF64318F118077E404AB3A1C778AE45CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
Instruction ID: 30adadd309813d1a6846ca6b4958dbaac508113c784b73a5bb8d11bfdb372a30
Opcode Fuzzy Hash: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
Instruction Fuzzy Hash: 3941E3B2E00304DFDB10CF69EE8521A77A4F7A8324B15417FD854A77E2D3789801DB88

Uniqueness

Uniqueness Score: -1.00%

Function 0042DEC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: 54e2847b2ed8cbec0c232d6556bf46b22f1e93997a90c035dd6b8310f6c19c74
Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
Opcode Fuzzy Hash: 54e2847b2ed8cbec0c232d6556bf46b22f1e93997a90c035dd6b8310f6c19c74
Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D

Uniqueness

Uniqueness Score: -1.00%

Function 004527E8 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
GetLastError.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: c95f5f81879e10580f0beb684fbefc560c00cfbc54ddd80bc382dcc14dc7984f
Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
Opcode Fuzzy Hash: c95f5f81879e10580f0beb684fbefc560c00cfbc54ddd80bc382dcc14dc7984f
Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 07387713778517d694c210176a4718dd0562bb365b6db4bb8115bda04798bcb6
Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
Opcode Fuzzy Hash: 07387713778517d694c210176a4718dd0562bb365b6db4bb8115bda04798bcb6
Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A

Uniqueness

Uniqueness Score: -1.00%

Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EEF3
EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18

Uniqueness

Uniqueness Score: -1.00%

Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: bd02338dff925e1bcf0a80027825a402961c9c10eaaecac7b210e684feb30c76
Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
Opcode Fuzzy Hash: bd02338dff925e1bcf0a80027825a402961c9c10eaaecac7b210e684feb30c76
Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558

Uniqueness

Uniqueness Score: -1.00%

Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 903dc6f46ae0353656b5ef1fe2250cc8cd8775a19ac3db80fd29e7e5856ea863
Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
Opcode Fuzzy Hash: 903dc6f46ae0353656b5ef1fe2250cc8cd8775a19ac3db80fd29e7e5856ea863
Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C

Uniqueness

Uniqueness Score: -1.00%

Function 00452AE0 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00452B3F,?,?,00000000), ref: 00452B19
GetLastError.KERNEL32(00000000,00000000,00452B3F,?,?,00000000), ref: 00452B21

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 06f3fd7b24f169495ce00ad5fbc4752c958642ba750843b0686b74c85260b923
Instruction ID: ab2d8551c2587fa33e08e03b3339d41412f2fea6ae8ede581cb29ed56d474115
Opcode Fuzzy Hash: 06f3fd7b24f169495ce00ad5fbc4752c958642ba750843b0686b74c85260b923
Instruction Fuzzy Hash: DDF0FC71A04708ABCB11EF759D414AEB7E8EB4A32575047B7FC14E3282D7B86E04859C

Uniqueness

Uniqueness Score: -1.00%

Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423249
LoadCursorA.USER32(00000000,00000000), ref: 00423273

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569

Uniqueness

Uniqueness Score: -1.00%

Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E39E
LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928

Uniqueness

Uniqueness Score: -1.00%

Function 00476C04 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(6F5227E0,?,?,?,?), ref: 00476C31
CallWindowProcW.USER32(FFFF04A7,?,?,?,?), ref: 00476C42

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4496e3164b9aa5ad3c3452dba108dc5669cb55cf2f882af71fb2b7941acfed1a
Instruction ID: f2bf2b0b1abe5bd87c33c6b7c80241fb96b27bc6aca7ec08f51a493da5dc8bb7
Opcode Fuzzy Hash: 4496e3164b9aa5ad3c3452dba108dc5669cb55cf2f882af71fb2b7941acfed1a
Instruction Fuzzy Hash: EDF030B6111718BFDA04DAA9DD89CB77B6DDF19360B008627BD58932A4D174AC0086B4

Uniqueness

Uniqueness Score: -1.00%

Function 0046E0E4 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046E17A), ref: 0046E0EE
76CCE550.OLE32(00499B98,00000000,00000001,00499BA8,?,?,0046E17A), ref: 0046E10A

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: E550Version
String ID:
API String ID: 1323609852-0
Opcode ID: 323ef6e325584454da74969db5385277b15969f7569c16a340aaa36caeb4eadb
Instruction ID: e32462cabb755f907f5de1887460af807d545ab7c9798ff14e002636b2035e3f
Opcode Fuzzy Hash: 323ef6e325584454da74969db5385277b15969f7569c16a340aaa36caeb4eadb
Instruction Fuzzy Hash: 90F0A7352812009FEB10975ADC86B8937C47B22315F50007BE04497292D2BD94C0471F

Uniqueness

Uniqueness Score: -1.00%

Function 004162CA Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004162E1
GetClassInfoA.USER32(00000000,?,?), ref: 004162F1

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 1299c1a0664136db271893dd0cc50e967199de2eea8caf0295a053f4b6d41932
Instruction ID: 8e3ee469ef83f81d8c71ae4630d2e8c7c449d5c480d74fd2e2a5eda3e874073d
Opcode Fuzzy Hash: 1299c1a0664136db271893dd0cc50e967199de2eea8caf0295a053f4b6d41932
Instruction Fuzzy Hash: BDE012B26015155ED710DBA89D81EE736DCDB08350B210177BE08CA256D364DD008BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0047C88B Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00499D40,00008000,00000000,?), ref: 0047C89B
76CF83B0.OLE32(?,0047C8DE), ref: 0047C8D1

Strings

SystemDrive, xrefs: 0047C6D3
ProgramFilesDir, xrefs: 0047C734, 0047C7BB
Failed to get path of 64-bit Program Files directory, xrefs: 0047C7DD
\Program Files, xrefs: 0047C75B
CommonFilesDir, xrefs: 0047C76E, 0047C7EA
Common Files, xrefs: 0047C7A5
cmd.exe, xrefs: 0047C8FC
COMMAND.COM, xrefs: 0047C91D
Failed to get path of 64-bit Common Files directory, xrefs: 0047C80C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FolderKnownPath
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 3622228125-544719455
Opcode ID: c380859d91d2530b1710b7ab5da91f48806622674321ef44444f1ad2bc0d7433
Instruction ID: f48ec61de784b6bea0373c7a91bc006da4a0813e938d35ae17fa89473a65de5f
Opcode Fuzzy Hash: c380859d91d2530b1710b7ab5da91f48806622674321ef44444f1ad2bc0d7433
Instruction Fuzzy Hash: 22E09230340604BFEB15EB61DC92F6977A8EB48B01B72847BF504E2680D67CAD00DB1C

Uniqueness

Uniqueness Score: -1.00%

Function 004508F8 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,00470149,?,00000000), ref: 0045090E
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,00470149,?,00000000), ref: 00450916

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497E2C,00000001,00000000,00000002,00000000,00497F8D,?,?,00000005,00000000,00497FC1), ref: 004506B7

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: da9b101d890a5785f8a9e71de1b90467d9f3c90ee8d89fa87e0c2c0eb401b44d
Instruction ID: 32d43412562f4d6ab64aa8be608e77008e370c57458e4df53f7444e76f76d0cb
Opcode Fuzzy Hash: da9b101d890a5785f8a9e71de1b90467d9f3c90ee8d89fa87e0c2c0eb401b44d
Instruction Fuzzy Hash: 0EE012E93042015BF700EA6599C1B2F22DCDB44315F00446ABD44CA28BE678CC048B29

Uniqueness

Uniqueness Score: -1.00%

Function 00483450 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0048345A
GetTickCount.KERNEL32 ref: 00483451

Part of subcall function 0048341C: GetForegroundWindow.USER32(00000000,00000000,?,?,00483481,?,00483566,?,?,00000000), ref: 00483422
Part of subcall function 0048341C: GetWindowThreadProcessId.USER32(00000000,?), ref: 00483434
Part of subcall function 0048341C: GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,00483481,?,00483566,?,?,00000000), ref: 0048343D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CountProcessTickWindow$CurrentForegroundThread
String ID:
API String ID: 711787588-0
Opcode ID: 9d6382f4410c0cf8a4c80b06530e5f0b551ab039682d9658fc9d01bb6d2efe45
Instruction ID: 3b4ff2fc5ab93e416a174b14f81b6e436b7efe9d21b952af33b17f0fc18b5d19
Opcode Fuzzy Hash: 9d6382f4410c0cf8a4c80b06530e5f0b551ab039682d9658fc9d01bb6d2efe45
Instruction Fuzzy Hash: 59D0C94060065155DD033EFB668222D0108AB56F2EB501D7FB08A99183CD5C8A46133F

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFF4 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F00E
EnumThreadWindows.USER32(00000000,0041EF90,00000000), ref: 0041F014

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 28faba8d13260114aebe4435219a546304dde162066a62bc81d999aa95987238
Instruction ID: 1bd0ab66c6aeceffdc4f5e21b8af03a27ec20acb013402289ac5ff21683637d0
Opcode Fuzzy Hash: 28faba8d13260114aebe4435219a546304dde162066a62bc81d999aa95987238
Instruction Fuzzy Hash: EBE02676600200AEDB12DF7AAD4575B37D0A394314F12483FA904D61A1D2745C84DB19

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB

Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0046C450 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C4AE,?,00000000,?,?,0046C6C0,?,00000000,0046C734), ref: 0046C492

Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: 0af19ab3550c8734ef4e1cf2f84aef4c41dad365f35295dd8d2c2646a272cfa9
Instruction ID: eef1953176fed27c4f60a3b97998f4e8fb1447464a393d6256780c84e8a913cd
Opcode Fuzzy Hash: 0af19ab3550c8734ef4e1cf2f84aef4c41dad365f35295dd8d2c2646a272cfa9
Instruction Fuzzy Hash: 5AF0B471248300BFE705DF62ECA6B35B6E8D748714F61047BF40886590E97D5844D51E

Uniqueness

Uniqueness Score: -1.00%

Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 93d9079c03dc8f32fd5285902e105fc94467d2f9586780870fbde36cd9cf365c
Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
Opcode Fuzzy Hash: 93d9079c03dc8f32fd5285902e105fc94467d2f9586780870fbde36cd9cf365c
Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E

Uniqueness

Uniqueness Score: -1.00%

Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71

Uniqueness

Uniqueness Score: -1.00%

Function 0042DDE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0047096C,00000000,00471782,?,00000000,004717CB,?,00000000,00471904,?,00000000,?,00000000), ref: 00454C0E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 02ef2921e44c121f52207ee13905b1ffb7187156f65b9d8975348f07efe3e98d
Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
Opcode Fuzzy Hash: 02ef2921e44c121f52207ee13905b1ffb7187156f65b9d8975348f07efe3e98d
Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617

Uniqueness

Uniqueness Score: -1.00%

Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(004959E6,?,00495A08,?,?,00000000,004959E6,?,?), ref: 0041469B

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675

Uniqueness

Uniqueness Score: -1.00%

Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D

ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 5ea0717b5a237d90ae3b60c45d238232e42852dd61880cea7560cbd7bb09fbd7
Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
Opcode Fuzzy Hash: 5ea0717b5a237d90ae3b60c45d238232e42852dd61880cea7560cbd7bb09fbd7
Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C

Uniqueness

Uniqueness Score: -1.00%

Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242DC

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD6C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00452C55,00000000,00452C6E,?,-00000001,00000000), ref: 0042CD77

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abded0c002ebc78192aa504463f5e40d8ea57a748cef45cf468d0a982b541a78
Instruction ID: 2eab32a2699244162946c929296992ee32eb3599f5fc22494aed3d9886f7b4af
Opcode Fuzzy Hash: abded0c002ebc78192aa504463f5e40d8ea57a748cef45cf468d0a982b541a78
Instruction Fuzzy Hash: 51D012D036121015DF1455BD28C535F05884B65375BA82F37B66DE62E2D23D8857281C

Uniqueness

Uniqueness Score: -1.00%

Function 00466B40 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a2c5bb09e392fd69b508e639abd752817b5c1d67cf81785bd365d6d583db0f26
Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
Opcode Fuzzy Hash: a2c5bb09e392fd69b508e639abd752817b5c1d67cf81785bd365d6d583db0f26
Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818

Uniqueness

Uniqueness Score: -1.00%

Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F39C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F3B0

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91

Uniqueness

Uniqueness Score: -1.00%

Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497E2C,00000001,00000000,00000002,00000000,00497F8D,?,?,00000005,00000000,00497FC1), ref: 004506B7

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18

Uniqueness

Uniqueness Score: -1.00%

Function 00406F50 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
Instruction ID: 1cff4f98fe1f8e2c1d524c72e998173d896329315b0501cca3ecf0a0fad01fcd
Opcode Fuzzy Hash: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
Instruction Fuzzy Hash: E4B012E13D224A26CB0079FE4CC1D1A00CC4A293063406A3A3006F72C3D83CC8180014

Uniqueness

Uniqueness Score: -1.00%

Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,00497DBA,00000000,00497F8D,?,?,00000005,00000000,00497FC1,?,?,00000000), ref: 004072B3

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824

Uniqueness

Uniqueness Score: -1.00%

Function 0044FE04 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00450010,00000000,?,004683E0,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 0044FE22

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 737efbd1d05e8daf9b2f5d4ad47827039e352d1058cf7efe3c38226c1680fcb2
Instruction ID: 66f3cd114cd8849fa0b5cd02f95834ec0ce5bd652375c405162ae2aedd08d897
Opcode Fuzzy Hash: 737efbd1d05e8daf9b2f5d4ad47827039e352d1058cf7efe3c38226c1680fcb2
Instruction Fuzzy Hash: A1D0C9B05022448EDB50EB69FA8472233E4E328346F18503FE500CA26AF33A8C44CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18

Uniqueness

Uniqueness Score: -1.00%

Function 0047D0CC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00481A2F), ref: 0047D0E2

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 798a4a0ef963ce7c9d3a16661f4bde20b6947b212f410e13b3a4d6eab8997eff
Instruction ID: 195a0cc7c2ab23ef077b9fe4dc52bf4a0a1d122fd989c5672d6e5019e3023c1d
Opcode Fuzzy Hash: 798a4a0ef963ce7c9d3a16661f4bde20b6947b212f410e13b3a4d6eab8997eff
Instruction Fuzzy Hash: D2C00271B902018FC754EB759DD4B6536E49715305F1144775424EB164D6746484CF29

Uniqueness

Uniqueness Score: -1.00%

Function 00481C6C Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 00481C74

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1bc723d2fafea9f50f28bdb772eb68fb7ee591a9533dee5a29c72c4421e393ba
Instruction ID: fbd2fd99f2342ae97ce2e912f06b4f6775a0193fa59faa32ac81747571f1ea96
Opcode Fuzzy Hash: 1bc723d2fafea9f50f28bdb772eb68fb7ee591a9533dee5a29c72c4421e393ba
Instruction Fuzzy Hash: E2A002343C430430F47462511D03F4400441744F05EE1909573053C0C704D82520201E

Uniqueness

Uniqueness Score: -1.00%

Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004165F3

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9b36e42861a8e97045d3d1c2d68090febbf4b925d95e27d87fd5eab6f39d8911
Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
Opcode Fuzzy Hash: 9b36e42861a8e97045d3d1c2d68090febbf4b925d95e27d87fd5eab6f39d8911
Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F

Strings

BtnWndProc3d, xrefs: 0041F252
Ctl3dCtlColorEx, xrefs: 0041F1FE
Ctl3dSubclassDlgEx, xrefs: 0041F1D4
Ctl3dUnregister, xrefs: 0041F1AA
Ctl3dDlgFramePaint, xrefs: 0041F1E9
CTL3D32.DLL, xrefs: 0041F149
Ctl3dSubclassCtl, xrefs: 0041F1BF
Ctl3dUnAutoSubclass, xrefs: 0041F228
Ctl3DColorChange, xrefs: 0041F23D
Ctl3dRegister, xrefs: 0041F181
Ctl3dAutoSubclass, xrefs: 0041F213

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 671fdaa251972b62047104a2fe9ad863bdd7b53d79a33238f475940deae409a8
Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
Opcode Fuzzy Hash: 671fdaa251972b62047104a2fe9ad863bdd7b53d79a33238f475940deae409a8
Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 004585C8 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045862F
QueryPerformanceCounter.KERNEL32(00000000,00000000,004588C2,?,?,00000000,00000000,?,00458FBE,?,00000000,00000000), ref: 00458638
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00458642
GetCurrentProcessId.KERNEL32(?,00000000,00000000,004588C2,?,?,00000000,00000000,?,00458FBE,?,00000000,00000000), ref: 0045864B
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004586C1
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 004586CF
CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,0045887E), ref: 00458717
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0045886D,?,00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,0045887E), ref: 00458750

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004587F9
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045882F
CloseHandle.KERNEL32(000000FF,00458874,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458867

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

D, xrefs: 00458772
Helper process PID: %u, xrefs: 0045884C
CreateProcess, xrefs: 00458802
CreateNamedPipe, xrefs: 004586DF
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00458697
CreateFile, xrefs: 00458725
helper %d 0x%x, xrefs: 004587D8
Starting 64-bit helper process., xrefs: 004585FD
64-bit helper EXE wasn't extracted, xrefs: 00458623
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458610
i, xrefs: 004587AC
SetNamedPipeHandleState, xrefs: 00458759

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: be3e2aad74af535179bad2a73bbdbce7deeedee64d3617dbf3cbed6bd2dfb7d8
Instruction ID: 54c9584e853abf465b9d0f30fdd509929e5717807e8393d963d4681616065440
Opcode Fuzzy Hash: be3e2aad74af535179bad2a73bbdbce7deeedee64d3617dbf3cbed6bd2dfb7d8
Instruction Fuzzy Hash: 19710470A003449EDB11EB65CC45B9E77F4EB05705F1085BAF904FB282DB7899488F69

Uniqueness

Uniqueness Score: -1.00%

Function 00478504 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00478370: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02222BEC,?,?,?,02222BEC,00478534,00000000,00478652,?,?,-00000010,?), ref: 00478389
Part of subcall function 00478370: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047838F
Part of subcall function 00478370: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02222BEC,?,?,?,02222BEC,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783A2
Part of subcall function 00478370: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02222BEC,?,?,?,02222BEC), ref: 004783CC
Part of subcall function 00478370: CloseHandle.KERNEL32(00000000,?,?,?,02222BEC,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783EA

Part of subcall function 00478448: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,004784DA,?,?,?,02222BEC,?,0047853C,00000000,00478652,?,?,-00000010,?), ref: 00478478

ShellExecuteEx.SHELL32(0000003C), ref: 0047858C
GetLastError.KERNEL32(00000000,00478652,?,?,-00000010,?), ref: 00478595
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004785E2
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00478606
CloseHandle.KERNEL32(00000000,00478637,00000000,00000000,000000FF,000000FF,00000000,00478630,?,00000000,00478652,?,?,-00000010,?), ref: 0047862A

Strings

<, xrefs: 0047854B
runas, xrefs: 00478559
MsgWaitForMultipleObjects, xrefs: 004785EF
ShellExecuteEx returned hProcess=0, xrefs: 004785B6
GetExitCodeProcess, xrefs: 0047860F
ShellExecuteEx, xrefs: 004785A6

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 79d3e53d443c3b79e7afe342da530abadc549f51104da72aa591649ec2f08439
Instruction ID: b05a94d88e1d9ee0fbafe330a65326fe691daae9ca7e583bddfe233bc85c86e1
Opcode Fuzzy Hash: 79d3e53d443c3b79e7afe342da530abadc549f51104da72aa591649ec2f08439
Instruction Fuzzy Hash: 0E314470A40208BEDB11EFE6C859ADEB7B8EB45718F50843FF508E7281DA7C99058B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418393
GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
GetWindowRect.USER32(?), ref: 004183CC
GetWindowLongA.USER32(?,000000F0), ref: 004183DA
GetWindowLongA.USER32(?,000000F8), ref: 004183EF
ScreenToClient.USER32(00000000), ref: 004183F8
ScreenToClient.USER32(00000000,?), ref: 00418403

Strings

,, xrefs: 0041839C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F

Strings

SeShutdownPrivilege, xrefs: 0045560B

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: df5f2c4a541694cd1c04f8324160b67a3be1538f30066156bb5e3b01538ef1f2
Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
Opcode Fuzzy Hash: df5f2c4a541694cd1c04f8324160b67a3be1538f30066156bb5e3b01538ef1f2
Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E

Uniqueness

Uniqueness Score: -1.00%

Function 004980A4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000,004983C0,?,?,00000000,0049B628), ref: 004980FB
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049817E
FindNextFileA.KERNEL32(000000FF,?,00000000,004981BA,?,00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000), ref: 00498196
FindClose.KERNEL32(000000FF,004981C1,004981BA,?,00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000,004983C0), ref: 004981B4

Strings

isRS-???.tmp, xrefs: 004980E5
isRS-, xrefs: 0049811B

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 23197ca941f9723447a3efecb7fe8701660a70fd5f6073cb28052376704fe6db
Instruction ID: fc6fb5a4e2302b333323d0d019d05182e8323e6fc1a1653111c694b95695a562
Opcode Fuzzy Hash: 23197ca941f9723447a3efecb7fe8701660a70fd5f6073cb28052376704fe6db
Instruction Fuzzy Hash: E1316A719016186FCF10EF69CC42ADEBBBCDB45314F5044BBA808E3291DA3C9F458E58

Uniqueness

Uniqueness Score: -1.00%

Function 00457594 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457611
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457638
SetForegroundWindow.USER32(?), ref: 00457649
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00457921,?,00000000,0045795D), ref: 0045790C

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 0045778C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 07d9476e03c8d7360a343fdd7a71a2d4d0b169a7e8f0ef14eb54f7c401357684
Instruction ID: 8776962154e21e4b1c8854f5ca4bcfaa90dd950cda3ad59ac2e2fede597431d6
Opcode Fuzzy Hash: 07d9476e03c8d7360a343fdd7a71a2d4d0b169a7e8f0ef14eb54f7c401357684
Instruction Fuzzy Hash: 2B91D334608204DFEB15CF55E991F5ABBF5EB89704F2184BAE80497792C638AE04DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Strings

,, xrefs: 00417D51

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: b31359e3e3f4af84bc1879df8bb30ee95a40fb82c66b770674b351632ff57231
Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
Opcode Fuzzy Hash: b31359e3e3f4af84bc1879df8bb30ee95a40fb82c66b770674b351632ff57231
Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00464158 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0046433F), ref: 004641CD
FindFirstFileA.KERNEL32(00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 00464213
FindNextFileA.KERNEL32(000000FF,?,00000000,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642C8
FindClose.KERNEL32(000000FF,004642F3,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642E6

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 7c81d958905f56a87b957aef2969a900ae63efefefe4cf2c6f6a4b42e5bbf638
Instruction ID: 9d9184480f8630aada0b530c6bd54f2fc26159d28d851f3c8c43bf9f92f270d6
Opcode Fuzzy Hash: 7c81d958905f56a87b957aef2969a900ae63efefefe4cf2c6f6a4b42e5bbf638
Instruction Fuzzy Hash: 77418370A00A18DBCF10EFA5DC959DEB7B8EB88305F5044AAF804A7341E7789E448E59

Uniqueness

Uniqueness Score: -1.00%

Function 00463CDC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00463E99), ref: 00463D0D
FindFirstFileA.KERNEL32(00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463D9C
FindNextFileA.KERNEL32(000000FF,?,00000000,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E2E
FindClose.KERNEL32(000000FF,00463E55,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E48

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 32326aa767a69d571a1d95516c7223b5c8221a00cc39b7dbd93ab343368c2d7c
Instruction ID: 85e7d80bc36d7b3e80fea797042c039a90a2821ca6a16b1e557570abf42aa49f
Opcode Fuzzy Hash: 32326aa767a69d571a1d95516c7223b5c8221a00cc39b7dbd93ab343368c2d7c
Instruction Fuzzy Hash: 3A41B770A00A589FCB11EF65CC45ADEB7B8EB88705F4044BAF404A7381E67D9F48CE59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: ca7e64f53124eee773614f4530e241cea0742e07ac6524e5167bff1d6a405f94
Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
Opcode Fuzzy Hash: ca7e64f53124eee773614f4530e241cea0742e07ac6524e5167bff1d6a405f94
Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD

Uniqueness

Uniqueness Score: -1.00%

Function 0048393C Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0048397A
GetWindowLongA.USER32(00000000,000000F0), ref: 00483998
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A8,00482E56,00482E8A,00000000,00482EAA,?,?,?,0049C0A8), ref: 004839BA
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A8,00482E56,00482E8A,00000000,00482EAA,?,?,?,0049C0A8), ref: 004839CE

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: eced40890854bebd7317fa2d6d43d84d766b7a93c8695781d913d3e5347b8eed
Instruction ID: 3cea9153c2b451a1fdc95e78a984a36fb28f479a74ffefb17a89e5a976076ef3
Opcode Fuzzy Hash: eced40890854bebd7317fa2d6d43d84d766b7a93c8695781d913d3e5347b8eed
Instruction Fuzzy Hash: 160156B0705200ABEA00BF659CCBB5F22C55714745F44093BF4459B292CAADDA859B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00462750 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00462824), ref: 004627A8
FindNextFileA.KERNEL32(000000FF,?,00000000,00462804,?,00000000,?,00000000,00462824), ref: 004627E4
FindClose.KERNEL32(000000FF,0046280B,00462804,?,00000000,?,00000000,00462824), ref: 004627FE

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: caa2b3dbc6c2998152c6f68f9b7835e94ab6156d849267386203f27ccba1b918
Instruction ID: e6acefadc91213b77ea930f6be1f86c6134c8588622ee3d3acab995ed1c325b6
Opcode Fuzzy Hash: caa2b3dbc6c2998152c6f68f9b7835e94ab6156d849267386203f27ccba1b918
Instruction Fuzzy Hash: 87210831904B08BECB11EB65CC41ACEB7ACDB49304F5084B7E808E32A1F6789E44CE69

Uniqueness

Uniqueness Score: -1.00%

Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241E4
SetActiveWindow.USER32(?,?,?,0046CD53), ref: 004241F1

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,022225AC,0042420A,?,?,?,0046CD53), ref: 00423B4F

SetFocus.USER32(00000000,?,?,?,0046CD53), ref: 0042421E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778

Uniqueness

Uniqueness Score: -1.00%

Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 19084698f29920acc68274fefc6d1be37826273bcf8ca1bc36e8902df026f6c2
Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
Opcode Fuzzy Hash: 19084698f29920acc68274fefc6d1be37826273bcf8ca1bc36e8902df026f6c2
Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8

Uniqueness

Uniqueness Score: -1.00%

Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175C3
GetCapture.USER32 ref: 004175CC

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: c8f0edb1377470e81cbec4a2b95b5efcfd9f911131a56f14dd142127f01798ba
Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
Opcode Fuzzy Hash: c8f0edb1377470e81cbec4a2b95b5efcfd9f911131a56f14dd142127f01798ba
Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798

Uniqueness

Uniqueness Score: -1.00%

Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042419B

Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724

Uniqueness

Uniqueness Score: -1.00%

Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 52e37b400ef70ce07d55a0833d187e2ce83493dd1eac51222033d67a41acb98e
Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
Opcode Fuzzy Hash: 52e37b400ef70ce07d55a0833d187e2ce83493dd1eac51222033d67a41acb98e
Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D

Uniqueness

Uniqueness Score: -1.00%

Function 00478AC0 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00478C0E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 844696e8b897343bdf835c25a6a000e65cc716b27902cfddd3917abf911a0a20
Instruction ID: 8fc52e73ba06cc46e730b07d7f7f94568764801a7b8f51cd1014d1f63996c257
Opcode Fuzzy Hash: 844696e8b897343bdf835c25a6a000e65cc716b27902cfddd3917abf911a0a20
Instruction Fuzzy Hash: EC4148B5A44104DFCB10CF99C6888AAB7F5FB49310B64C99AF848DB701D738EE45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 84fa915654b0e9cabe4af8b3610e56d273e883bd018482bfacacc2813b1fcd3b
Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
Opcode Fuzzy Hash: 84fa915654b0e9cabe4af8b3610e56d273e883bd018482bfacacc2813b1fcd3b
Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5

Uniqueness

Uniqueness Score: -1.00%

Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498BF2), ref: 0044B67F
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3

Strings

GetThemeBackgroundRegion, xrefs: 0044B731
GetThemeSysInt, xrefs: 0044B905
IsThemePartDefined, xrefs: 0044B779
GetThemeColor, xrefs: 0044B79D
GetThemeSysColor, xrefs: 0044B899
DrawThemeParentBackground, xrefs: 0044B9B9
GetThemeFilename, xrefs: 0044B887
IsThemeDialogTextureEnabled, xrefs: 0044B95F
GetThemeIntList, xrefs: 0044B851
GetWindowTheme, xrefs: 0044B93B
IsAppThemed, xrefs: 0044B929
GetThemeBool, xrefs: 0044B7D3
SetThemeAppProperties, xrefs: 0044B983
DrawThemeIcon, xrefs: 0044B767
GetThemeMetric, xrefs: 0044B7AF
GetThemeSysString, xrefs: 0044B8F3
uxtheme.dll, xrefs: 0044B67A
SetWindowTheme, xrefs: 0044B875
GetCurrentThemeName, xrefs: 0044B995
HitTestThemeBackground, xrefs: 0044B743
CloseThemeData, xrefs: 0044B6A1
GetThemeSysBool, xrefs: 0044B8BD
GetThemeTextMetrics, xrefs: 0044B71F
EnableTheming, xrefs: 0044B9CB
GetThemeInt, xrefs: 0044B7E5
GetThemePropertyOrigin, xrefs: 0044B863
GetThemeSysSize, xrefs: 0044B8CF
GetThemeFont, xrefs: 0044B81B
OpenThemeData, xrefs: 0044B68F
DrawThemeText, xrefs: 0044B6C5
GetThemeSysFont, xrefs: 0044B8E1
DrawThemeEdge, xrefs: 0044B755
GetThemeMargins, xrefs: 0044B83F
GetThemeAppProperties, xrefs: 0044B971
GetThemeBackgroundContentRect, xrefs: 0044B6D7, 0044B6E9
IsThemeActive, xrefs: 0044B917
GetThemeDocumentationProperty, xrefs: 0044B9A7
GetThemePartSize, xrefs: 0044B6FB
DrawThemeBackground, xrefs: 0044B6B3
GetThemeString, xrefs: 0044B7C1
GetThemeRect, xrefs: 0044B82D
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B78B
GetThemeEnumValue, xrefs: 0044B7F7
GetThemeSysColorBrush, xrefs: 0044B8AB
EnableThemeDialogTexture, xrefs: 0044B94D
GetThemeTextExtent, xrefs: 0044B70D
GetThemePosition, xrefs: 0044B809

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
Opcode Fuzzy Hash: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD

Uniqueness

Uniqueness Score: -1.00%

Function 00492848 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,00492D3D,?,?,?,?,00000000,00000000,00000000), ref: 00492888
FindWindowA.USER32(00000000,00000000), ref: 004928B9

Strings

OEMTOCHARBUFF, xrefs: 00492C9B
SENDMESSAGE, xrefs: 0049290D
REGISTERWINDOWMESSAGE, xrefs: 00492A1B
POSTBROADCASTMESSAGE, xrefs: 00492AA3
SENDNOTIFYMESSAGE, xrefs: 004929BF
SENDBROADCASTMESSAGE, xrefs: 00492A55
CREATEMUTEX, xrefs: 00492C69
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00492AF7
POSTMESSAGE, xrefs: 00492963
SLEEP, xrefs: 00492872
FINDWINDOWBYCLASSNAME, xrefs: 00492895
CALLDLLPROC, xrefs: 00492BAD
FREEDLL, xrefs: 00492C34
LOADDLL, xrefs: 00492B4B
CHARTOOEMBUFF, xrefs: 00492CDE
FINDWINDOWBYWINDOWNAME, xrefs: 004928D1

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: fe0993328b1714d090c62d4b65a95ce68cbab2884a00f13d32d38987ffe254b3
Instruction ID: 092cd3663c6e49ee7eb77a287a3c2ed341282e51176ce6ebc4a466309821376d
Opcode Fuzzy Hash: fe0993328b1714d090c62d4b65a95ce68cbab2884a00f13d32d38987ffe254b3
Instruction Fuzzy Hash: D9C182A0B042003BDB14BF3E9D4551F59A99F95708B119A3FB446EB78BCE7CEC0A4359

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA0C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CA40
CreateCompatibleDC.GDI32(?), ref: 0041CA4C
CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
CreateCompatibleDC.GDI32(?), ref: 0041CB2B
SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
RealizePalette.GDI32(00000000), ref: 0041CB7D
SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
RealizePalette.GDI32(0041CE3C), ref: 0041CB95
SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
SelectObject.GDI32(00000000,?), ref: 0041CBEE
DeleteDC.GDI32(00000000), ref: 0041CC04

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: 8288b1a004c19d08e53adfd80f36b756ff19622159534b91a17c952f52f31838
Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
Opcode Fuzzy Hash: 8288b1a004c19d08e53adfd80f36b756ff19622159534b91a17c952f52f31838
Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004983D0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000,?,00498B1F,00000000,00498B29,?,00000000), ref: 00498453
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000,?,00498B1F,00000000), ref: 00498466
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000), ref: 00498476
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00498497
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000), ref: 004984A7

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

.lst, xrefs: 004984E4
Setup, xrefs: 0049843F
Inno-Setup-RegSvr-Mutex, xrefs: 0049845D
.msg, xrefs: 004984CA
/REG, xrefs: 00498405
/REGU, xrefs: 00498429

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 6acfce5c0d266c00f3cb08664922df7ad17872da4bad7acadb5bfb626d6c80a7
Instruction ID: 1a66146e65e487955493167600903b91e60bc3637ed1504a34615a6495e02ea1
Opcode Fuzzy Hash: 6acfce5c0d266c00f3cb08664922df7ad17872da4bad7acadb5bfb626d6c80a7
Instruction Fuzzy Hash: 5191A434A042049FDF11EBA9DC52BAE7BE5EF4A304F5144BBF500AB692DE7C9C05CA19

Uniqueness

Uniqueness Score: -1.00%

Function 0045A6D8 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A994,?,?,?,?,?,00000006,?,00000000,0049785D,?,00000000,00497900), ref: 0045A846

Strings

Deleting file: %s, xrefs: 0045A7E5
.hlp, xrefs: 0045A70F
Failed to delete the file; it may be in use (%d)., xrefs: 0045A935
.gid, xrefs: 0045A728
Failed to strip read-only attribute., xrefs: 0045A82B
.fts, xrefs: 0045A74C
.lnk, xrefs: 0045A7B3
The file appears to be in use (%d). Will delete on restart., xrefs: 0045A88F
.chm, xrefs: 0045A774
Stripped read-only attribute., xrefs: 0045A81F
.chw, xrefs: 0045A78D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 6a202e1cd1e294c3cb0ce0d90f09718b112b8c2b0c949d99241fd9da5d4cd804
Instruction ID: 43962401d403c06de7b31dde6fd87328655f81364e16ca473e433d379c6e1912
Opcode Fuzzy Hash: 6a202e1cd1e294c3cb0ce0d90f09718b112b8c2b0c949d99241fd9da5d4cd804
Instruction Fuzzy Hash: EC719070B002545BCB00EB6998417AE77A49F4931AF91896BFC01AB383DB7C9E1DC75E

Uniqueness

Uniqueness Score: -1.00%

Function 0045CBC0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045CBDA
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CBFA
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CC07
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CC14
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CC22

Part of subcall function 0045CAC8: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045CB67,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045CB41

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCDB
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCE4

Strings

GetNamedSecurityInfoW, xrefs: 0045CC01
SetEntriesInAclW, xrefs: 0045CC1C
advapi32.dll, xrefs: 0045CBF5
W, xrefs: 0045CCF2
SetNamedSecurityInfoW, xrefs: 0045CC0E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 428efc784f41d3aa7d264c2f262ec685fe65e126583ce7bbd5579cd36a3925cf
Instruction ID: 99773ef8a3d0261052733c4904a47669a242c0659fe16ead1f438c4abb71ff4e
Opcode Fuzzy Hash: 428efc784f41d3aa7d264c2f262ec685fe65e126583ce7bbd5579cd36a3925cf
Instruction Fuzzy Hash: BD518471900308EFDB10DF99C881BEEBBB8EB48711F14806AF904E7241C678A945CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3AC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
GetDC.USER32(00000000), ref: 0041B402
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
ReleaseDC.USER32(00000000,00000000), ref: 0041B455
SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045AB6A,00000003,00000000,00000000,00454B44), ref: 0045498D

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A40

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
, xrefs: 004548FE
RegOpenKeyEx, xrefs: 00454910

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 742d62a6869efcab47093dbd07b67c32618791e42156db71d55ecd28429abb8c
Instruction ID: 3b35aed17da8244e85d272d2923899a44a2159637523a8fd9e70e85f8d21f96a
Opcode Fuzzy Hash: 742d62a6869efcab47093dbd07b67c32618791e42156db71d55ecd28429abb8c
Instruction Fuzzy Hash: 23914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69

Uniqueness

Uniqueness Score: -1.00%

Function 00459458 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459364: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004594FF
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 00459569

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004595D0

Strings

SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045951C
v1.1.4322, xrefs: 004595C2
v4.0.30319, xrefs: 004594F1
.NET Framework not found, xrefs: 0045961D
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00459583
.NET Framework version %s not found, xrefs: 00459609
v2.0.50727, xrefs: 0045955B
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 004594B2

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 06cdcde3b802fa8939e5b925d5f0cc04c3aa7329a2dd441772a6abba54712f42
Instruction ID: e7879d346446e6db82ad1067b50e8ffdd52b59a139ce3e0e88c8f748029a0227
Opcode Fuzzy Hash: 06cdcde3b802fa8939e5b925d5f0cc04c3aa7329a2dd441772a6abba54712f42
Instruction Fuzzy Hash: EB51A331A04148EBCB01DFA8C8A1BEE77A5DB59305F54447BA801DB353EA3D9E1ECB19

Uniqueness

Uniqueness Score: -1.00%

Function 00458A44 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00458A7B
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00458A97
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00458AA5
GetExitCodeProcess.KERNEL32(?), ref: 00458AB6
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458AFD
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458B19

Strings

Stopping 64-bit helper process. (PID: %u), xrefs: 00458A6D
Helper process exited with failure code: 0x%x, xrefs: 00458AE3
Helper process exited, but failed to get exit code., xrefs: 00458AEF
Helper isn't responding; killing it., xrefs: 00458A87
Helper process exited., xrefs: 00458AC5

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 8d11a9d6b8ebfffa9e94c3bd241da5180e5b7166b03f76cd8ec90a905d120898
Instruction ID: 3f2324d87e707cedf1d5c4e10b6e93e7b0b52df74c864805f1ac214018e434b5
Opcode Fuzzy Hash: 8d11a9d6b8ebfffa9e94c3bd241da5180e5b7166b03f76cd8ec90a905d120898
Instruction Fuzzy Hash: 2F2130706087409AD720E779C44575BB6D49F08345F04CC2FF99AEB283DF78E8488B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Strings

RegCreateKeyEx, xrefs: 004545C3
, xrefs: 004545B1
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 1658ad98f5d652d8ab18f870bc50976d397f5a9f15be4283fc870004d2c294f4
Instruction ID: 93c55a0ab54dbcba353dd8d7ef9dbdddde8d62e860aeeeeaccb8ee2ace91ec52
Opcode Fuzzy Hash: 1658ad98f5d652d8ab18f870bc50976d397f5a9f15be4283fc870004d2c294f4
Instruction Fuzzy Hash: 49810F75A00209AFDB00DFD5C981BDEB7B8EB49309F10452AF900FB282D7789E45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00496C50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539AB
Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539BB

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00496CCD
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00496E21), ref: 00496CEE
CreateWindowExA.USER32(00000000,STATIC,00496E30,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496D15
SetWindowLongA.USER32(?,000000FC,004964A8), ref: 00496D28
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000,STATIC,00496E30), ref: 00496D58
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00496DCC
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000), ref: 00496DD8

Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

DestroyWindow.USER32(?,00496DFB,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000,STATIC), ref: 00496DEE

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00496D87
STATIC, xrefs: 00496D0E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: e4b2ecfcfa893ff17553470f1835d2c21342bacfaf5c8ca03e615e843d4af16f
Instruction ID: 18f462a79ff6f3765b6ab1b49dcd34ad23a8ddcce266b6658739bc0f5698dca4
Opcode Fuzzy Hash: e4b2ecfcfa893ff17553470f1835d2c21342bacfaf5c8ca03e615e843d4af16f
Instruction Fuzzy Hash: 61414C70A40208AFDF00EBA5DD42F9E7BB8EB08714F52457AF510F7291D7799E008B68

Uniqueness

Uniqueness Score: -1.00%

Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E6DC,00000000), ref: 0042E441
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E6DC,00000000), ref: 0042E495

Strings

.DEFAULT\Control Panel\International, xrefs: 0042E46C
Locale, xrefs: 0042E484
Control Panel\Desktop\ResourceLocale, xrefs: 0042E4A4
GetUserDefaultUILanguage, xrefs: 0042E437
QaE, xrefs: 0042E4D7, 0042E4DF, 0042E4EA, 0042E50C
kernel32.dll, xrefs: 0042E43C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
API String ID: 4190037839-2312295185
Opcode ID: 6084c433af3ee4d64f0cd9982e7ad42a34d4dd09e5920a5815d9b88696e74604
Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
Opcode Fuzzy Hash: 6084c433af3ee4d64f0cd9982e7ad42a34d4dd09e5920a5815d9b88696e74604
Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004629F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 004629FC
GetModuleHandleA.KERNEL32(user32.dll), ref: 00462A10
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462A1D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00462A2A
GetWindowRect.USER32(?,00000000), ref: 00462A76
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462AB4

Strings

MonitorFromWindow, xrefs: 00462A17
(, xrefs: 00462A55
user32.dll, xrefs: 00462A0B
GetMonitorInfoA, xrefs: 00462A24

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 49e394185691d1c2da29acdf0cb3719649ef4a9244e3d7219ece30713ed86938
Instruction ID: 865a179037155f8fdabe2954c964c2dd38b7d55406d5d1e7c7801a7b23b437f8
Opcode Fuzzy Hash: 49e394185691d1c2da29acdf0cb3719649ef4a9244e3d7219ece30713ed86938
Instruction Fuzzy Hash: B7219575701B057BD610D6A88D85F3B36D8EB84715F094A2AF944DB3C1E6F8EC018B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F194
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
GetWindowRect.USER32(?,00000000), ref: 0042F20E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C

Strings

user32.dll, xrefs: 0042F1A3
GetMonitorInfoA, xrefs: 0042F1BC
(, xrefs: 0042F1ED
MonitorFromWindow, xrefs: 0042F1AF

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: d786bd72f778b9cca068a569f688e0802e61ee9ccadb1309323c976dabd5d685
Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
Opcode Fuzzy Hash: d786bd72f778b9cca068a569f688e0802e61ee9ccadb1309323c976dabd5d685
Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00458C1C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458DFB,?,00000000,00458E5E,?,?,00000000,00000000), ref: 00458C79
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CD6
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CE3
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458D2F
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000), ref: 00458D55
GetLastError.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000), ref: 00458D5C

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

TransactNamedPipe, xrefs: 00458CEF
CreateEvent, xrefs: 00458C87

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: ef16c20a6daf1f887f3bc2a9a4f4fdabf826d35dd2b72c43caf5f800eb3833ff
Instruction ID: 06b5d05a5e38ae799b2edb69ba26f0faef77b18cb4ad173b91f5c3c95d125767
Opcode Fuzzy Hash: ef16c20a6daf1f887f3bc2a9a4f4fdabf826d35dd2b72c43caf5f800eb3833ff
Instruction Fuzzy Hash: EF418E75A00608AFDB15DF95C981F9EB7F8EB48714F1044AAF900F72D2DA789E44CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00456D20 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456E85,?,?,00000031,?), ref: 00456D48
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456D4E
LoadTypeLib.OLEAUT32(00000000,?), ref: 00456D9B

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

GetProcAddress, xrefs: 00456D5B
UnRegisterTypeLib, xrefs: 00456D3E
UnRegisterTypeLib, xrefs: 00456E07
LoadTypeLib, xrefs: 00456DA6
ITypeLib::GetLibAttr, xrefs: 00456DD1
OLEAUT32.DLL, xrefs: 00456D43

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
Instruction ID: d1bb8c6bfccdc0522a96f5e3020b18907c52df716e7671809b7eaf465cfb4023
Opcode Fuzzy Hash: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
Instruction Fuzzy Hash: 6831A375A00604AFDB41EFAACC12D5BB7BDEB8970675244A6FD04D3352DB38DD08CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00416D80 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416E13
SaveDC.GDI32(?), ref: 00416E27
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
RestoreDC.GDI32(?,?), ref: 00416E65
CreateSolidBrush.GDI32(00000000), ref: 00416EE5
FrameRect.USER32(?,?,?), ref: 00416F18
DeleteObject.GDI32(?), ref: 00416F22
CreateSolidBrush.GDI32(00000000), ref: 00416F32
FrameRect.USER32(?,?,?), ref: 00416F65
DeleteObject.GDI32(?), ref: 00416F6F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 31305b42e63a20fe9f9ee5f73744d5e2f5e6a90e84c308e69de84060d35988a9
Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
Opcode Fuzzy Hash: 31305b42e63a20fe9f9ee5f73744d5e2f5e6a90e84c308e69de84060d35988a9
Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Uniqueness

Uniqueness Score: -1.00%

Function 004221E8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422233
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 794ac4a4d1563d503d4e128f610caca5ba976f2c29ed192f4e654ec8c2abe850
Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
Opcode Fuzzy Hash: 794ac4a4d1563d503d4e128f610caca5ba976f2c29ed192f4e654ec8c2abe850
Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698

Uniqueness

Uniqueness Score: -1.00%

Function 0046168C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004616C7
GetActiveWindow.USER32 ref: 0046172B
CoInitialize.OLE32(00000000), ref: 0046173F
SHBrowseForFolder.SHELL32(?), ref: 00461756
76C9D120.OLE32(00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046176B
SetActiveWindow.USER32(?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 00461781
SetActiveWindow.USER32(?,?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046178A

Strings

A, xrefs: 004616FF

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
String ID: A
API String ID: 2698730301-3554254475
Opcode ID: cb3d39f68a826354347aa7a8a61ff080deb010c50648a66159b3978de9eda5bc
Instruction ID: 0f37cca2ee7d5c89cd5c8fe3b5c5f67eac08b275376d6c087401a1ac056189be
Opcode Fuzzy Hash: cb3d39f68a826354347aa7a8a61ff080deb010c50648a66159b3978de9eda5bc
Instruction Fuzzy Hash: C3312F70E00348AFDB10EFA6D885A9EBBF8EB09304F55847AF404E7251E7785A048F59

Uniqueness

Uniqueness Score: -1.00%

Function 0045D2B4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D2BD
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D2CD
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D2DD
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D2ED

Strings

inflate, xrefs: 0045D2C7
inflateEnd, xrefs: 0045D2D7
inflateReset, xrefs: 0045D2E7
inflateInit_, xrefs: 0045D2B7

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 5039b32c95ab4f878aa340bc95ef1656196d0563f790867e571847c0b893819f
Instruction ID: d913f85fec6517a53d2ec7ba369195fd603025f4bffd93910817278a70f0814a
Opcode Fuzzy Hash: 5039b32c95ab4f878aa340bc95ef1656196d0563f790867e571847c0b893819f
Instruction Fuzzy Hash: C20112B0D00701DBE724DFF6ACC672636A5ABA8306F14C03B9D09962A2D77D0459DF2E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8DC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9B9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
SetBkColor.GDI32(?,?), ref: 0041AA08
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
SetBkColor.GDI32(00000000,?), ref: 0041AAC3

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: c2c61a06e11fc6ac6c72d0136d8e20986a2ab5507b690e8d84a304c9a27ba9fd
Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
Opcode Fuzzy Hash: c2c61a06e11fc6ac6c72d0136d8e20986a2ab5507b690e8d84a304c9a27ba9fd
Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004580C4 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458278,?, /s ",?,regsvr32.exe",?,00458278), ref: 004581EA

Strings

D, xrefs: 004581A0
/u, xrefs: 00458126
regsvr32.exe", xrefs: 0045810B
CreateProcess, xrefs: 004581DC
0x%x, xrefs: 0045820D
Spawning 64-bit RegSvr32: , xrefs: 0045814F
Spawning 32-bit RegSvr32: , xrefs: 00458171
/s ", xrefs: 00458133

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 4002d2de1ab03b38d977d670fcb0d45de6735b09ab9cf6adf03ef289ce7e4165
Instruction ID: cda81b302c56d3c3b7af3d8ffa4af26d40175ae7a7c1cff7e24eee752c39b11a
Opcode Fuzzy Hash: 4002d2de1ab03b38d977d670fcb0d45de6735b09ab9cf6adf03ef289ce7e4165
Instruction Fuzzy Hash: 21411670A047486BDB10EFD6D842B8DBBF9AF45305F50407FB904BB292DF789A098B19

Uniqueness

Uniqueness Score: -1.00%

Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
GetSysColor.USER32(00000014), ref: 0044D1B0
SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
GetSysColor.USER32(00000010), ref: 0044D202
SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 32856f07fc45aa5b94f1f38070a47e962b22e9d58654105098b1be26c78061dc
Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
Opcode Fuzzy Hash: 32856f07fc45aa5b94f1f38070a47e962b22e9d58654105098b1be26c78061dc
Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668

Uniqueness

Uniqueness Score: -1.00%

Function 0041B66C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B745
GetDC.USER32(?), ref: 0041B751
SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
RealizePalette.GDI32(00000000), ref: 0041B792
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4

Strings

%H, xrefs: 0041B674

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: %H
API String ID: 3275473261-1959103961
Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B93C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA17
GetDC.USER32(?), ref: 0041BA23
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
RealizePalette.GDI32(00000000), ref: 0041BA69
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1

Strings

%H, xrefs: 0041B944

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: %H
API String ID: 3275473261-1959103961
Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004964F4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

GetWindowThreadProcessId.USER32(00000000,?), ref: 00496585
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496599
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 004965B3
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965BF
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965C5
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965D8

Strings

Deleting Uninstall data files., xrefs: 004964FB

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 8e8cb50e53c2c3b2038bacabf8c777ac21aad5dfe2dc8a8db11d37eec289bdf4
Instruction ID: caddedc05ae4add9971b90b84c259ce0cd5246952d50e779d54ebc968ffbf915
Opcode Fuzzy Hash: 8e8cb50e53c2c3b2038bacabf8c777ac21aad5dfe2dc8a8db11d37eec289bdf4
Instruction Fuzzy Hash: 73216170204250BFEB10EB6ABC82B2637A8DB54728F53453BB501961D6DA7CAC448A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004701FC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004702F9,?,?,?,?,00000000), ref: 00470263
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004702F9), ref: 0047027A
AddFontResourceA.GDI32(00000000), ref: 00470297
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 004702AB

Strings

Failed to set value in Fonts registry key., xrefs: 0047026C
Failed to open Fonts registry key., xrefs: 00470281
AddFontResource, xrefs: 004702B5

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: f6cb4db48621d05014dac95341ab5faf08594db0be4636be460d29a68d9f0f75
Instruction ID: 122e39bb1ea2b43e4c2a7da55aa69ddad999e5e54c07bca5f4119535fc7344d3
Opcode Fuzzy Hash: f6cb4db48621d05014dac95341ab5faf08594db0be4636be460d29a68d9f0f75
Instruction Fuzzy Hash: 6921E271741204BBDB10EAA68C46FAE67AC9B14704F208477B904EB3C3DA7C9E01866D

Uniqueness

Uniqueness Score: -1.00%

Function 00462E30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE

GetVersion.KERNEL32 ref: 00462E60
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462E9E
SHGetFileInfo.SHELL32(00462F3C,00000000,?,00000160,00004011), ref: 00462EBB
LoadCursorA.USER32(00000000,00007F02), ref: 00462ED9
SetCursor.USER32(00000000,00000000,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462EDF
SetCursor.USER32(?,00462F1F,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462F12

Strings

Explorer, xrefs: 00462E7A

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: 271d5cc6534746d744017855cbe3809792a4a5bc456b5a0a77df68c724b1ffee
Instruction ID: b0f6820fd5a5ea072646c086af9eca81c98a3cd1ffd9b7ca0f87214cf94a4ba1
Opcode Fuzzy Hash: 271d5cc6534746d744017855cbe3809792a4a5bc456b5a0a77df68c724b1ffee
Instruction Fuzzy Hash: CD21E7307403047AEB15BB759D47B9A3798DB09708F4004BFFA05EA1C3EEBD9901966D

Uniqueness

Uniqueness Score: -1.00%

Function 00478370 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02222BEC,?,?,?,02222BEC,00478534,00000000,00478652,?,?,-00000010,?), ref: 00478389
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047838F
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02222BEC,?,?,?,02222BEC,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783A2
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02222BEC,?,?,?,02222BEC), ref: 004783CC
CloseHandle.KERNEL32(00000000,?,?,?,02222BEC,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783EA

Strings

kernel32.dll, xrefs: 00478384
GetFinalPathNameByHandleA, xrefs: 0047837F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 6bc275baaa87b820f83455aa3780e808e355a1b98666f0b165ca17ab90bcbd73
Instruction ID: 2a72e966618face2f1bd82d2a524167157479a72732682c44667b4342ad9b4bf
Opcode Fuzzy Hash: 6bc275baaa87b820f83455aa3780e808e355a1b98666f0b165ca17ab90bcbd73
Instruction Fuzzy Hash: 370180A07C070536E520316A4C8AFBB654C8B50769F14863FBA1DFA2D3FDED9D06016E

Uniqueness

Uniqueness Score: -1.00%

Function 00459E0C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459F8E,?,00000000,00000000,00000000,?,00000006,?,00000000,0049785D,?,00000000,00497900), ref: 00459ED2

Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9

Strings

Failed to delete directory (%d)., xrefs: 00459F68
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459EAC
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459F47
Deleting directory: %s, xrefs: 00459E5B
Failed to strip read-only attribute., xrefs: 00459EA0
Failed to delete directory (%d). Will retry later., xrefs: 00459EEB
Stripped read-only attribute., xrefs: 00459E94

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: f762674dc93cf731ab6ae8fc4fe730cbfae35970688ac95924b0af837e960025
Instruction ID: b8d9b7298ea7c3337bda5d500217c07e27fbd6b384233f4239b27a523d6d10d0
Opcode Fuzzy Hash: f762674dc93cf731ab6ae8fc4fe730cbfae35970688ac95924b0af837e960025
Instruction Fuzzy Hash: 1841A331A04208CACB10EB69C8413AEB6A55F4530AF54897BAC01D73D3CB7C8E0DC75E

Uniqueness

Uniqueness Score: -1.00%

Function 00422E50 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422EA4
GetCapture.USER32 ref: 00422EB3
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
ReleaseCapture.USER32 ref: 00422EBE
GetActiveWindow.USER32 ref: 00422ECD
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
GetActiveWindow.USER32 ref: 00422FBF

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: b1a57ae8c862de22bc82aa702dd5f84040ee9f6a0804fcde46ad074f7f3e30fe
Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
Opcode Fuzzy Hash: b1a57ae8c862de22bc82aa702dd5f84040ee9f6a0804fcde46ad074f7f3e30fe
Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49

Uniqueness

Uniqueness Score: -1.00%

Function 0042F290 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
GetActiveWindow.USER32 ref: 0042F2DA
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: 267c9eefe26e23fd4e765c6349420bb8bb9da3d18075eb1d96a464b655a4fe2f
Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
Opcode Fuzzy Hash: 267c9eefe26e23fd4e765c6349420bb8bb9da3d18075eb1d96a464b655a4fe2f
Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042948A
GetTextMetricsA.GDI32(00000000), ref: 00429493

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 004294A2
GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
SelectObject.GDI32(00000000,00000000), ref: 004294B6
ReleaseDC.USER32(00000000,00000000), ref: 004294BE
GetSystemMetrics.USER32(00000006), ref: 004294E3
GetSystemMetrics.USER32(00000006), ref: 004294FD

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 960ca5b6b9ec06081429caf0e2ae16fd4423d047ce8cb1d090ce01a2b2c84894
Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
Opcode Fuzzy Hash: 960ca5b6b9ec06081429caf0e2ae16fd4423d047ce8cb1d090ce01a2b2c84894
Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041DE27
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
GetStockObject.GDI32(00000007), ref: 0041DE5B
GetStockObject.GDI32(00000005), ref: 0041DE67
GetStockObject.GDI32(0000000D), ref: 0041DE73
LoadIconA.USER32(00000000,00007F00), ref: 0041DE84

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
Opcode Fuzzy Hash: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00463240 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00463344
SetCursor.USER32(00000000,00000000,00007F02,00000000,004633D9), ref: 0046334A
SetCursor.USER32(?,004633C1,00007F02,00000000,004633D9), ref: 004633B4

Strings

Internal error: Item already expanding, xrefs: 004632E1
, xrefs: 004635DA
, xrefs: 004635BF

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
Instruction ID: e4e85f4aa3fa623d7d3a169fbc538aa22306e9421cedfdc69a3031d12d347dae
Opcode Fuzzy Hash: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
Instruction Fuzzy Hash: 4CB18270604284EFDB11DF29C545B9ABBF1BF04305F1484AAE8469B792DB78EE44CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00453D30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

Strings

[rename], xrefs: 00453E7A, 00453EB6
WININIT.INI, xrefs: 00453DC5
NUL, xrefs: 00453ED9
.tmp, xrefs: 00453DD3
MoveFileEx, xrefs: 00454027

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 262666494607197906d7283235c4c76affd32b2b0fdb9ef9cba9b9ea75353bac
Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
Opcode Fuzzy Hash: 262666494607197906d7283235c4c76affd32b2b0fdb9ef9cba9b9ea75353bac
Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7

Strings

AMPM, xrefs: 00408905
:mm, xrefs: 0040891C
m/d/yy, xrefs: 00408809
mmmm d, yyyy, xrefs: 0040882B
:mm:ss, xrefs: 00408936

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
Opcode Fuzzy Hash: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D

Uniqueness

Uniqueness Score: -1.00%

Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A

Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6

Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD

Strings

?, xrefs: 004117A6
,, xrefs: 0041179F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 4986dcd06abefbee5f666d79fc26290c702fe8a84b14e195092edf3558bd7871
Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
Opcode Fuzzy Hash: 4986dcd06abefbee5f666d79fc26290c702fe8a84b14e195092edf3558bd7871
Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE63 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
DeleteObject.GDI32(?), ref: 0041BF9F
DeleteObject.GDI32(?), ref: 0041BFA8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041CED8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
RealizePalette.GDI32(?), ref: 0041CF92
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
SelectPalette.GDI32(?,?,00000001), ref: 0041D05F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
Opcode Fuzzy Hash: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004572DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 0045732E

Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00457395
TranslateMessage.USER32(?), ref: 004573B3
DispatchMessageA.USER32(?), ref: 004573BC

Strings

[Paused] , xrefs: 00457364

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: 138259db96aaba9c66cb09bcf6582550d327018b684ee04c4d651f5f89e9d65e
Instruction ID: a72840e20965590be0df7748d4dcd1bfe023db3bc5775872eefead19b10ec59e
Opcode Fuzzy Hash: 138259db96aaba9c66cb09bcf6582550d327018b684ee04c4d651f5f89e9d65e
Instruction Fuzzy Hash: 633175319082449ADB11DBB9EC81B9E7FB8EF49314F5540B7EC00E7292D73C9909DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0046B420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046B55F), ref: 0046B4DC
LoadCursorA.USER32(00000000,00007F02), ref: 0046B4EA
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B4F0
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B4FA
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B500

Strings

CheckPassword, xrefs: 0046B484

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: a15a8593e9f633b5a85a0686193dd54b7b5146f7df37d6bd0e19c7d70d8febf0
Instruction ID: 9465d4cba05e43c3341d6d018928b45656d3fee3f016636846a90655da25d4f4
Opcode Fuzzy Hash: a15a8593e9f633b5a85a0686193dd54b7b5146f7df37d6bd0e19c7d70d8febf0
Instruction Fuzzy Hash: D0316334740204AFD711EF69C899B9A7BE4EF45308F5580B6F9049B3A2D7789E40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00477C6C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00477B94: GetWindowThreadProcessId.USER32(00000000), ref: 00477B9C
Part of subcall function 00477B94: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477C93,0049C0A8,00000000), ref: 00477BAF
Part of subcall function 00477B94: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477BB5

SendMessageA.USER32(00000000,0000004A,00000000,00478026), ref: 00477CA1
GetTickCount.KERNEL32 ref: 00477CE6
GetTickCount.KERNEL32 ref: 00477CF0
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00477D45

Strings

CallSpawnServer: Unexpected response: $%x, xrefs: 00477CD6
CallSpawnServer: Unexpected status: %d, xrefs: 00477D2E

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: a349fc6668a2a279a7709dc0d92d626649643492524c5ed72309cd5f58a9f2ee
Instruction ID: 262cbc5b9954910938d5a1e8e32dc50db46ad6f301169d9d39307b56b522dac3
Opcode Fuzzy Hash: a349fc6668a2a279a7709dc0d92d626649643492524c5ed72309cd5f58a9f2ee
Instruction Fuzzy Hash: 87318474B042159EDB10EBB9C8867EE76A0AF08714F90807AB548EB392D67C9D4187AD

Uniqueness

Uniqueness Score: -1.00%

Function 00459784 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045983F

Strings

Failed to load .NET Framework DLL "%s", xrefs: 00459824
.NET Framework CreateAssemblyCache function failed, xrefs: 00459862
Fusion.dll, xrefs: 004597DF
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045984A
CreateAssemblyCache, xrefs: 00459836

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 64b7f7115ec2050a4f0e42ab113808549d669c8acfba7d9bf3bad921683fe547
Instruction ID: 9a538673283cb431493768ab67eac729fe35d93f11f945e2dcd414e2b3f175b6
Opcode Fuzzy Hash: 64b7f7115ec2050a4f0e42ab113808549d669c8acfba7d9bf3bad921683fe547
Instruction Fuzzy Hash: A2318B70E10649ABCB10FFA5C88169EB7B8EF45315F50857BE814E7382DB389E08C799

Uniqueness

Uniqueness Score: -1.00%

Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055

GetFocus.USER32 ref: 0041C168
GetDC.USER32(?), ref: 0041C174
SelectPalette.GDI32(?,?,00000000), ref: 0041C195
RealizePalette.GDI32(?), ref: 0041C1A1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
ReleaseDC.USER32(?,?), ref: 0041C1ED

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28

Uniqueness

Uniqueness Score: -1.00%

Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C70
GetSystemMetrics.USER32(0000000D), ref: 00418C78
6F542980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E

Part of subcall function 004107F8: 6F53C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC

6F5ACB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
6F5AC740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
6F5ACB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
6F540860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: MetricsSystem$C400C740F540860F542980
String ID:
API String ID: 3392676452-0
Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759

Uniqueness

Uniqueness Score: -1.00%

Function 00483C6C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483D24), ref: 00483D09

Strings

LanmanNT, xrefs: 00483CD3
ServerNT, xrefs: 00483CED
WinNT, xrefs: 00483CB9
System\CurrentControlSet\Control\ProductOptions, xrefs: 00483C90
ProductType, xrefs: 00483CA8

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: e1bcbbbaaee85d585434023fd650e6813b785c41e8fbc068ac73575afb55ee56
Instruction ID: 212569cff1cfb7858b589fbdbabdc9c693f1f7cc945fcf11155ec0ddb5f1f406
Opcode Fuzzy Hash: e1bcbbbaaee85d585434023fd650e6813b785c41e8fbc068ac73575afb55ee56
Instruction Fuzzy Hash: CC117C30704244AADB10FF65D862B5E7BF9DB45B05F618877A800E7282EB78AE05875C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00495508 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00495519

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 0049553B
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495AB9), ref: 0049554F
GetTextMetricsA.GDI32(00000000,?), ref: 00495571
ReleaseDC.USER32(00000000,00000000), ref: 0049558E

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00495546

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: a4d12ece59ca6c64cb8c4defcdc73c5f067a9176de86fed221050984d74d5100
Instruction ID: fbfe8d588f566b1ae935688c8d8bbf43f3780a3d17a9f30f48774e54417b88ea
Opcode Fuzzy Hash: a4d12ece59ca6c64cb8c4defcdc73c5f067a9176de86fed221050984d74d5100
Instruction Fuzzy Hash: 98018476A04704BFEB05DBE9CC41E5EB7EDEB48714F614476F604E7281D678AE008B28

Uniqueness

Uniqueness Score: -1.00%

Function 00423394 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004233AF
WindowFromPoint.USER32(?,?), ref: 004233BC
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
GetCurrentThreadId.KERNEL32 ref: 004233D1
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
SetCursor.USER32(00000000), ref: 00423413

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D

Uniqueness

Uniqueness Score: -1.00%

Function 0049532C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 0049533C
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00495349
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00495356

Strings

GetMonitorInfoA, xrefs: 00495350
MonitorFromRect, xrefs: 00495343
user32.dll, xrefs: 00495337

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 5579b8dc187442e7c517f6558358e9e0fd6dcc5405420102cd7b083255a2d8af
Instruction ID: d6622564654ba01390171a2dbbf88ec7785202fdd48675fe733a6c53722864ad
Opcode Fuzzy Hash: 5579b8dc187442e7c517f6558358e9e0fd6dcc5405420102cd7b083255a2d8af
Instruction Fuzzy Hash: 7EF0F692741F156ADA3121660C41B7F6B8CCB917B1F240137BE44A7382E9ED8C0047ED

Uniqueness

Uniqueness Score: -1.00%

Function 0045D188 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045D191
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045D1A1
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045D1B1

Strings

ArcFourCrypt, xrefs: 0045D1AB
ArcFourInit, xrefs: 0045D19B
ISCryptGetVersion, xrefs: 0045D18B

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: dc81785b55ac876962535e0a2eb36b1dd730d24c9132c457d47d12d4ae2e21c2
Instruction ID: d394b6b565b4a55a8c16e24b867b534ad65140704dc94b035c924c7661ebf9a3
Opcode Fuzzy Hash: dc81785b55ac876962535e0a2eb36b1dd730d24c9132c457d47d12d4ae2e21c2
Instruction Fuzzy Hash: A2F030B0D41700CAD318EFF6AC957263B96EB9830AF14C03BA414C51A2D7794454DF2C

Uniqueness

Uniqueness Score: -1.00%

Function 0045D688 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D691
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D6A1
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D6B1

Strings

BZ2_bzDecompressInit, xrefs: 0045D68B
BZ2_bzDecompress, xrefs: 0045D69B
BZ2_bzDecompressEnd, xrefs: 0045D6AB

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 0c00d940adfee3eed657d73ca32928dd6beaef8d72542be6af97d79d08c28db7
Instruction ID: 26f5c6c79611f6cc0facecefa5b4932716cc5d8e9f8ea2477ead0514974f6e87
Opcode Fuzzy Hash: 0c00d940adfee3eed657d73ca32928dd6beaef8d72542be6af97d79d08c28db7
Instruction Fuzzy Hash: 0EF01DB0D00705DFD724EFB6ACC672736D5AB6831AF50813B990E95262D778045ACF2C

Uniqueness

Uniqueness Score: -1.00%

Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,004812C8), ref: 0042EA35
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C

Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60

Strings

user32.dll, xrefs: 0042EA30
ChangeWindowMessageFilterEx, xrefs: 0042EA2B

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E

Uniqueness

Uniqueness Score: -1.00%

Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C

Strings

oleacc.dll, xrefs: 0044C7E6
CreateStdAccessibleObject, xrefs: 0044C806
LresultFromObject, xrefs: 0044C7F6

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
Opcode Fuzzy Hash: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 00478C20 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498C24), ref: 00478C26
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478C33
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478C43

Strings

VerSetConditionMask, xrefs: 00478C2D
VerifyVersionInfoW, xrefs: 00478C3D
kernel32.dll, xrefs: 00478C21

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 81267d710db967c56e7e702a34d1e8b60bf08845a808e06a5f27e56110be3c01
Instruction ID: 32a0137ea675787c0bb1f7a77b9c903aea73f6d33f3aa717a8ad139b0a70eb03
Opcode Fuzzy Hash: 81267d710db967c56e7e702a34d1e8b60bf08845a808e06a5f27e56110be3c01
Instruction Fuzzy Hash: 4DC0C9F02C1700EEAA01B7B11DCAA7A255CC500728320843F7049BA182D97C0C104F3C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B57E
GetDC.USER32(?), ref: 0041B58A
GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
ReleaseDC.USER32(?,?), ref: 0041B626

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045D04C Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D184,?,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0F6

Strings

MACHINE, xrefs: 0045D09A
USERS, xrefs: 0045D0A9
CURRENT_USER, xrefs: 0045D08B
CLASSES_ROOT, xrefs: 0045D07C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
Instruction ID: 81e1e27ad3ae8d1ea1d6b81b4c13ff0be47bc54c17845d393ef4ad8e2f10c1e8
Opcode Fuzzy Hash: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
Instruction Fuzzy Hash: 2C117535A04608AFD731DA91C942B9EB6ADDF4470AF6040776D00572C3D67C5F0B992E

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
GetDC.USER32(00000000), ref: 0041BDE9
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
ReleaseDC.USER32(00000000,00000000), ref: 0041BE56

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0047E758 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047E766
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CD49), ref: 0047E78C
GetWindowLongA.USER32(?,000000EC), ref: 0047E79C
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E7BD
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E7D1
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E7ED

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 761baba5ea275c4f8ba8f3b2538ab5f77c1d2b06cda4c3ad0feadca871259e14
Instruction ID: 463a5c2536fff799c7bf7cf61cbf8045bc8b98cac2b0bb45a0840e8ed8c25010
Opcode Fuzzy Hash: 761baba5ea275c4f8ba8f3b2538ab5f77c1d2b06cda4c3ad0feadca871259e14
Instruction Fuzzy Hash: 53010CB5641210ABEA00D769DE81F6637D8AB1C320F0943A6B959DF3E3C738EC408B49

Uniqueness

Uniqueness Score: -1.00%

Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B

UnrealizeObject.GDI32(00000000), ref: 0041B27C
SelectObject.GDI32(?,00000000), ref: 0041B28E
SetBkColor.GDI32(?,00000000), ref: 0041B2B1
SetBkMode.GDI32(?,00000002), ref: 0041B2BC
SetBkColor.GDI32(?,00000000), ref: 0041B2D7
SetBkMode.GDI32(?,00000001), ref: 0041B2E2

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A

Uniqueness

Uniqueness Score: -1.00%

Function 004538BC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539AB
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539BB

Strings

!nI, xrefs: 004538EC, 004538F7, 00453952, 0045395C, 0045392C, 00453936
.tmp, xrefs: 0045395F
_iu, xrefs: 0045394D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: !nI$.tmp$_iu
API String ID: 3498533004-584216493
Opcode ID: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
Instruction ID: 7da7e9bbb2667b7856572ae533a3071efe8e017fb0344d9459fa270775feb22d
Opcode Fuzzy Hash: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
Instruction Fuzzy Hash: 1831C5B0A00249ABCB11EF95D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00497D5C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00497FC1,?,?,00000000), ref: 00497D92

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,00497DBA,00000000,00497F8D,?,?,00000005,00000000,00497FC1,?,?,00000000), ref: 004072B3

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

.msg, xrefs: 00497DF8
IMsg, xrefs: 00497E66
.dat, xrefs: 00497DD9
Uninstall, xrefs: 00497D78

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: d050b8c65b09966d21fe0fc985d660f82682418f1ef04ac2b8f2793e44e24393
Instruction ID: abb28459e614be91aca1b68aa70fad33032f6e559e3bf784a216f74f74fa669e
Opcode Fuzzy Hash: d050b8c65b09966d21fe0fc985d660f82682418f1ef04ac2b8f2793e44e24393
Instruction Fuzzy Hash: 89314F34A14114AFCB00EF65DD9296E7BB5EF89314F91857AF800AB395DB38BD01CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09

Strings

ShutdownBlockReasonCreate, xrefs: 0042EAD0
user32.dll, xrefs: 0042EAD5

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
Opcode Fuzzy Hash: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E

Uniqueness

Uniqueness Score: -1.00%

Function 00457FF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00458028
GetExitCodeProcess.KERNEL32(?,?), ref: 00458049
CloseHandle.KERNEL32(?,0045807C), ref: 0045806F

Strings

GetExitCodeProcess, xrefs: 00458052
MsgWaitForMultipleObjects, xrefs: 00458035

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 0165f3f1031fc1aa6e60b3a9799ba1014783226e14f241c311df118ccfede771
Instruction ID: 2f0632834368beac7d1c7250186d6a5b4d0e74160b608b18ba1b2b0c741dc3d5
Opcode Fuzzy Hash: 0165f3f1031fc1aa6e60b3a9799ba1014783226e14f241c311df118ccfede771
Instruction Fuzzy Hash: 8101A231600204AFD710EBA98C02A5A73A8EB49B25F51407BFC10E73D3DE399E08965D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

Strings

user32.dll, xrefs: 0042E9BD
ChangeWindowMessageFilter, xrefs: 0042E9B8

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E

Uniqueness

Uniqueness Score: -1.00%

Function 00477B94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00477B9C
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477C93,0049C0A8,00000000), ref: 00477BAF
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477BB5

Strings

AllowSetForegroundWindow, xrefs: 00477BA5
user32.dll, xrefs: 00477BAA

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: 0c48b0152dcd94fde7082f0574e48419f86d5c04df14efc0ca492c8631bf730a
Instruction ID: d51ed2a8d8be4cb67b0f2e6afaff03014389f5b4c9f6752a27b175deb1fe6994
Opcode Fuzzy Hash: 0c48b0152dcd94fde7082f0574e48419f86d5c04df14efc0ca492c8631bf730a
Instruction Fuzzy Hash: D7D0C790248701B9D910B3F64D46E9F3A5D894471CB50C47BB418E61C5DA7CFD04893D

Uniqueness

Uniqueness Score: -1.00%

Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C52
SaveDC.GDI32(?), ref: 00416C83
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
RestoreDC.GDI32(?,?), ref: 00416D0B
EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414836
MulDiv.KERNEL32(?,?,?), ref: 00414850
MulDiv.KERNEL32(?,?,?), ref: 00414879
MulDiv.KERNEL32(?,?,?), ref: 004148A4
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148EC

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19

Uniqueness

Uniqueness Score: -1.00%

Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
GetDC.USER32(00000000), ref: 0041BC12
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
DeleteObject.GDI32(00000000), ref: 0041BC9A

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004735D8 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045D04C: SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7

GetLastError.KERNEL32(00000000,00000000,00000000,004736AC,?,?,0049C1E0,00000000), ref: 00473665
GetLastError.KERNEL32(00000000,00000000,00000000,004736AC,?,?,0049C1E0,00000000), ref: 0047367B

Strings

Could not set permissions on the registry key because it currently does not exist., xrefs: 0047366F
Failed to set permissions on registry key (%d)., xrefs: 0047368C
Setting permissions on registry key: %s\%s, xrefs: 0047362A

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: f83a2768d3c65ea5df61b415147cb4a980a2a4da2a2eeea125c2e66a17c72d68
Instruction ID: ad6b00cc897a6d1501f3fc6a2a631de3da5dc8c6e7b4eccdfad28332e4495c63
Opcode Fuzzy Hash: f83a2768d3c65ea5df61b415147cb4a980a2a4da2a2eeea125c2e66a17c72d68
Instruction Fuzzy Hash: A121C870A046445FCB10DFA9C8826EEBBE4DF49319F50817BE408E7392D7785E098B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Uniqueness

Uniqueness Score: -1.00%

Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
RealizePalette.GDI32(00000000), ref: 00414421
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
RealizePalette.GDI32(00000000), ref: 0041443B
ReleaseDC.USER32(00000000,00000000), ref: 00414446

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765

Uniqueness

Uniqueness Score: -1.00%

Function 00424CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092

Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA

OffsetRect.USER32(?,?,?), ref: 00424DC9
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
OffsetRect.USER32(?,?,?), ref: 00424E9D

Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD

Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47

Strings

vLB, xrefs: 00424CF3, 00424DD1

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
String ID: vLB
API String ID: 1477829881-1797516613
Opcode ID: b071e8f690a675b1b5ec03376c9d1dc0568a9cea913d7d114b2f1dd6f13c8b48
Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
Opcode Fuzzy Hash: b071e8f690a675b1b5ec03376c9d1dc0568a9cea913d7d114b2f1dd6f13c8b48
Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5

Strings

Z, xrefs: 0040703C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
Opcode Fuzzy Hash: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0044CFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D04E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101

Strings

, xrefs: 0044D033

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 9cefa38d4a8adbc35dceb9fbd70f94003a2f7c245499b58eac7a7a86e34dc042
Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
Opcode Fuzzy Hash: 9cefa38d4a8adbc35dceb9fbd70f94003a2f7c245499b58eac7a7a86e34dc042
Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042EF74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042EF9E

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(?,00000000), ref: 0042EFC1
ReleaseDC.USER32(00000000,?), ref: 0042F0A0

Strings

...\, xrefs: 0042F052

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: 174dea87e3c77845355dc2bffde9c2636390ac865bcfddee608935e642ca7c05
Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
Opcode Fuzzy Hash: 174dea87e3c77845355dc2bffde9c2636390ac865bcfddee608935e642ca7c05
Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
UnregisterClassA.USER32(?,00400000), ref: 004164AB
RegisterClassA.USER32(?), ref: 004164CE

Strings

@, xrefs: 00416429

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 3b6f74928dbe25e833ba5f094c78e46ad4264582666b3af08ebad3e49732e910
Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
Opcode Fuzzy Hash: 3b6f74928dbe25e833ba5f094c78e46ad4264582666b3af08ebad3e49732e910
Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00498210 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00498B60,00000000,00498306,?,?,00000000,0049B628), ref: 00498280
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00498B60,00000000,00498306,?,?,00000000,0049B628), ref: 004982A9
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004982C2

Strings

isRS-%.3u.tmp, xrefs: 0049825F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: caa082c947593af69ac399f5aa69a479bfa54a7c4d0fec8f0c1611cec8706775
Instruction ID: fc33356634acd7bce8b4c2965ae56e8bcff63ef6fc68eceab8a95db248f88364
Opcode Fuzzy Hash: caa082c947593af69ac399f5aa69a479bfa54a7c4d0fec8f0c1611cec8706775
Instruction Fuzzy Hash: 0B216471E00609ABCF10EFA9C8819AFBBB8AF45714F10457FB814B72D1DB389E018A59

Uniqueness

Uniqueness Score: -1.00%

Function 00456BFC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456C50
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456C7D

Strings

LoadTypeLib, xrefs: 00456C5B
RegisterTypeLib, xrefs: 00456C88

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
Instruction ID: 3ed1135b8019c5f4588910a0035f5c9e1cabb82a18fedb82429c118dce795412
Opcode Fuzzy Hash: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
Instruction Fuzzy Hash: 2911B430B00604AFDB02EFA6CD51A5EB7BDEB89705F5184B6FC44D3752DA389904CA24

Uniqueness

Uniqueness Score: -1.00%

Function 00457154 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 0045716E
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 0045720B

Strings

Failed to create DebugClientWnd, xrefs: 004571D4
Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 0045719A

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 3689ec14d1edae2f57f0a744906126f7255bff4f1947e1d6bbead030c2853570
Instruction ID: a6ca84080c04e90ac639e3db27cd2c1e4b46fe4ea5f20cae781d9f83c3d7e460
Opcode Fuzzy Hash: 3689ec14d1edae2f57f0a744906126f7255bff4f1947e1d6bbead030c2853570
Instruction Fuzzy Hash: 1011E770248240AFD710AB69AC85B5FBBD89B54319F15407AFA849B383D7798C18C7AE

Uniqueness

Uniqueness Score: -1.00%

Function 004786EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetFocus.USER32 ref: 00478757
GetKeyState.USER32(0000007A), ref: 00478769
WaitMessage.USER32(?,00000000,00478790,?,00000000,004787B7,?,?,00000001,00000000,?,?,?,00480402,00000000,004812C8), ref: 00478773

Strings

Wnd=$%x, xrefs: 0047873B

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: c0ca7a1e78f0957e158d44939737d51478939e9ac1b0c689120181bc9166dade
Instruction ID: f17a5035e7dee30901ec9a03c3a5a372f1d0714b29ccd98a4f066b2945bd060b
Opcode Fuzzy Hash: c0ca7a1e78f0957e158d44939737d51478939e9ac1b0c689120181bc9166dade
Instruction Fuzzy Hash: CE11C634A40244AFD704EF65DC49A9EBBF8EB49314F6184BFF409E7681DB386D00CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0046E610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E618
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E627

Strings

(invalid), xrefs: 0046E6AA
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046E69C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 93d3f9926fe1e9ec47fc0153e923e0389e011619b8f85a7a05f57e02ab74589b
Instruction ID: 5dd65cae4c1adac9d47cc9ad6336eda1851498fedff4a8a979bd050f9c4a6815
Opcode Fuzzy Hash: 93d3f9926fe1e9ec47fc0153e923e0389e011619b8f85a7a05f57e02ab74589b
Instruction Fuzzy Hash: A81136A440C3909ED340DF2AC04432BBAE4AB99704F44892EF8C8C6381E779C848DBB7

Uniqueness

Uniqueness Score: -1.00%

Function 00453F76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

MoveFile, xrefs: 00453FB1
DeleteFile, xrefs: 00453F94

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: ad4ba0b838e9d5317ad6887f6d8cb75152b6b17696a4ed4ee46c007163692804
Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
Opcode Fuzzy Hash: ad4ba0b838e9d5317ad6887f6d8cb75152b6b17696a4ed4ee46c007163692804
Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529

Uniqueness

Uniqueness Score: -1.00%

Function 00459364 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00459384
InstallRoot, xrefs: 004593A0
.NET Framework not found, xrefs: 004593C0

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: be4fb59b900ee74e718d87cdc4fcd1eef43a9c564c0a5ec1af3f625bb6e6dd39
Instruction ID: 1950c6f853cc10ed35e504d9d8503a730f6ffd27dc9bba4e9fa27fab35675349
Opcode Fuzzy Hash: be4fb59b900ee74e718d87cdc4fcd1eef43a9c564c0a5ec1af3f625bb6e6dd39
Instruction Fuzzy Hash: 12F0AF31300110DBCB10EB9AD885B6F6299DB9931AF50503BF981DB293E73CCC168629

Uniqueness

Uniqueness Score: -1.00%

Function 00483BC4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483C05
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483C28

Strings

CSDVersion, xrefs: 00483BFC
System\CurrentControlSet\Control\Windows, xrefs: 00483BD2

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 33fca6af7241f4b653fe53c350a6e88c669f1de2ef3da1c7a1752152dae0c121
Instruction ID: 1d850e848a14c5c59b8e95f13e5f63a8fb365af486cc5d6c9f9b701d22fca986
Opcode Fuzzy Hash: 33fca6af7241f4b653fe53c350a6e88c669f1de2ef3da1c7a1752152dae0c121
Instruction Fuzzy Hash: 56F03176E40208A6DF10EAD48C45BAFB3BCAB14B05F104967EA10F7280E678AB048B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

Strings

kernel32.dll, xrefs: 0042D905
GetSystemWow64DirectoryA, xrefs: 0042D900

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68

Strings

ShutdownBlockReasonDestroy, xrefs: 0042EB58
user32.dll, xrefs: 0042EB5D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD

Uniqueness

Uniqueness Score: -1.00%

Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498BF2), ref: 0044F77F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Strings

NotifyWinEvent, xrefs: 0044F775
user32.dll, xrefs: 0044F77A

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D

Uniqueness

Uniqueness Score: -1.00%

Function 00498968 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498C48,00000001,00000000,00498C6C), ref: 00498972
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498978

Strings

DisableProcessWindowsGhosting, xrefs: 00498968
user32.dll, xrefs: 0049896D

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 71af8591fbce5d4533a7188bae6238bebf63b2f5996384562a89c67780edd1c3
Instruction ID: 34f838485a85c0df890c3e192e44216071158a5cea444d63bbc0a0b2480586ef
Opcode Fuzzy Hash: 71af8591fbce5d4533a7188bae6238bebf63b2f5996384562a89c67780edd1c3
Instruction Fuzzy Hash: 22B002C0651707589D5032FA0D06B3F48484C5276D728057F3414A51C6DD6C89115D3F

Uniqueness

Uniqueness Score: -1.00%

Function 004645F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498BF2), ref: 0044B67F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498C1A), ref: 00464603
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609

Strings

SHPathPrepareForWriteA, xrefs: 004645F9
shell32.dll, xrefs: 004645FE

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: edc6f8ec64a36a5908760ff58e990ea99ea877eb638915fc896b3384d426fa6b
Instruction ID: ed4894befccbfeda2ad80f7d1b9e1cb4df1a551eae9986247d0c145e26b1cd95
Opcode Fuzzy Hash: edc6f8ec64a36a5908760ff58e990ea99ea877eb638915fc896b3384d426fa6b
Instruction Fuzzy Hash: DDB092D0A82740A4C90077F2985B90F2A4488A271EB10153B710476483EABC84100EAE

Uniqueness

Uniqueness Score: -1.00%

Function 0047D67C Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047D7F0,?,?,?,?,00000000,0047D945,?,?,?,00000000,?,0047DA54), ref: 0047D7CC
FindClose.KERNEL32(000000FF,0047D7F7,0047D7F0,?,?,?,?,00000000,0047D945,?,?,?,00000000,?,0047DA54,00000000), ref: 0047D7EA

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 9ab909986393f5b42a84b95dd7c21df9505f932c5aec58b4ed59c3933d94e7d0
Instruction ID: 2ce97de6e4eb512f8d4c2eb376340b964b0e691095a652a34be041e4083b4e02
Opcode Fuzzy Hash: 9ab909986393f5b42a84b95dd7c21df9505f932c5aec58b4ed59c3933d94e7d0
Instruction Fuzzy Hash: 07813A74D0024D9FCF11EFA5CC91ADFBBB8EF49304F5080AAE908A7291D6399A46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004755AC Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36

Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD

GetLastError.KERNEL32(00000000,00475721,?,?,0049C1E0,00000000), ref: 0047560A

Strings

LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 004756DF
, xrefs: 00475642, 0047565D
MoveFileEx, xrefs: 0047566F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: a13b4d41162069bde37ca5ba37a3bfc16fb44220c5afb8832f1568bbfa6ce935
Instruction ID: cfe7f312216358cbd0971b398f0cafde252de4893b1317a5ce8d70824cf78b76
Opcode Fuzzy Hash: a13b4d41162069bde37ca5ba37a3bfc16fb44220c5afb8832f1568bbfa6ce935
Instruction Fuzzy Hash: 4D418570A006099BDB10EFA5D882AEF77B5FF48314F508537E408BB395D7789A058BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D46
GetDesktopWindow.USER32 ref: 00413DFE

Part of subcall function 00418EC0: 6F5AC6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9

SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B

Uniqueness

Uniqueness Score: -1.00%

Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D

Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991

Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8

IsRectEmpty.USER32(?), ref: 0044E953
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: a4575d285c62c1c56b7686ad69dfdc5ef60a631fed5d3d1fc0705a1474777ead
Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
Opcode Fuzzy Hash: a4575d285c62c1c56b7686ad69dfdc5ef60a631fed5d3d1fc0705a1474777ead
Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299

Uniqueness

Uniqueness Score: -1.00%

Function 00495924 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00495988
OffsetRect.USER32(?,00000000,?), ref: 004959A3
OffsetRect.USER32(?,?,00000000), ref: 004959BD
OffsetRect.USER32(?,00000000,?), ref: 004959D8

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: e6cd63ab1267e2bef36e0ea42f4f89ffcc49fa5b03609306a0fb63f812f5ac90
Instruction ID: 9409249b62c1188f54b5b62e2685c04785358b71117f53a2337039625fc08c68
Opcode Fuzzy Hash: e6cd63ab1267e2bef36e0ea42f4f89ffcc49fa5b03609306a0fb63f812f5ac90
Instruction Fuzzy Hash: 1121AEB6700701AFDB00DE69CD81E5BB7DAEFC4350F248A2AF944C3249D638ED048761

Uniqueness

Uniqueness Score: -1.00%

Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417260
SetCursor.USER32(00000000), ref: 004172A3
GetLastActivePopup.USER32(?), ref: 004172CD
GetForegroundWindow.USER32(?), ref: 004172D4

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: f57167407fddf9cd78af34a0bec631c5eda0cffb2877c5f098be8ccd36a9b240
Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
Opcode Fuzzy Hash: f57167407fddf9cd78af34a0bec631c5eda0cffb2877c5f098be8ccd36a9b240
Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 004955DC Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000008,?), ref: 004955F1
MulDiv.KERNEL32(?,00000008,?), ref: 00495605
MulDiv.KERNEL32(?,00000008,?), ref: 00495619
MulDiv.KERNEL32(?,00000008,?), ref: 00495637

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction ID: b77f8f3c6746ea581d036ce488ab013aedd37a602364075716cddbfd1b85439e
Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction Fuzzy Hash: A5112E72604504ABCB40DEA9D8C4D9B7BECEF8D324B6441AAF908DB242D674ED408B68

Uniqueness

Uniqueness Score: -1.00%

Function 0041F480 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
RegisterClassA.USER32(00499598), ref: 0041F4D4
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: f5329bc195fe8fc87e14c8434c73e300a75752ca243df2a436e9fb21fcb0b6a1
Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
Opcode Fuzzy Hash: f5329bc195fe8fc87e14c8434c73e300a75752ca243df2a436e9fb21fcb0b6a1
Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC

Uniqueness

Uniqueness Score: -1.00%

Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CB58,0000000A,00000000), ref: 0040D041
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CB58), ref: 0040D05B
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68

Uniqueness

Uniqueness Score: -1.00%

Function 004705A0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 004705F1

Strings

Unsetting NTFS compression on file: %s, xrefs: 004705D7
Setting NTFS compression on file: %s, xrefs: 004705BF
Failed to set NTFS compression state (%d)., xrefs: 00470602

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: e534bd073bd99d1ffd8d8a7551bf23dca8ffa9a0f38022b87dc0121eb45f3a98
Instruction ID: 452327faed6fd823952186a677ff1a78a18aba12ee86070aec797b5412e08bdc
Opcode Fuzzy Hash: e534bd073bd99d1ffd8d8a7551bf23dca8ffa9a0f38022b87dc0121eb45f3a98
Instruction Fuzzy Hash: A5018B71D09248A6CB04D7AD94512DDBBE49F4D314F44C5FFE459D7342DB780A088B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0046FDF4 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046FE45

Strings

Failed to set NTFS compression state (%d)., xrefs: 0046FE56
Unsetting NTFS compression on directory: %s, xrefs: 0046FE2B
Setting NTFS compression on directory: %s, xrefs: 0046FE13

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: f57c8121f87b7cbe45d24f1443a8c943819022774a47ae68e03ba31a404fe09e
Instruction ID: 6c3eba688a3488f6cff2036d9eec8e6f632fba0cce39d579df3f4bd3b957a0ce
Opcode Fuzzy Hash: f57c8121f87b7cbe45d24f1443a8c943819022774a47ae68e03ba31a404fe09e
Instruction Fuzzy Hash: E5014421E0824856CB04D7ADE44129DBBA49F49304F4485BBA495E7253EB790A09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00455D9C Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000,0045B7D5), ref: 00455DD8
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000), ref: 00455DE1
RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 53be27aa0997865f395f34354d63af882f7726c3d4a8d794711f16c86898bbe7
Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
Opcode Fuzzy Hash: 53be27aa0997865f395f34354d63af882f7726c3d4a8d794711f16c86898bbe7
Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D

Uniqueness

Uniqueness Score: -1.00%

Function 00478204 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8,?,?,?,?,?,00498CDB,00000000), ref: 0047820D
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8,?,?,?,?,?,00498CDB), ref: 00478213
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8), ref: 00478235
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8), ref: 00478246

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 89672e1c1dad377db11468aaf314ccfc00159a4e206af17bba33db1213e8e157
Instruction ID: 91f0679cb69370e855683a510bc75a037ced8834772831ea40795c83ba0b1c60
Opcode Fuzzy Hash: 89672e1c1dad377db11468aaf314ccfc00159a4e206af17bba33db1213e8e157
Instruction Fuzzy Hash: D8F037716447007BD600E6B58C81E5B73DCEB44354F04493E7E98C71C1DA78DC089776

Uniqueness

Uniqueness Score: -1.00%

Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042424C
IsWindowVisible.USER32(?), ref: 0042425D
IsWindowEnabled.USER32(?), ref: 00424267
SetForegroundWindow.USER32(?), ref: 00424271

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: d317456c615bf9008b67529b06aff5f9fae4f5f479d94640f2b11ca0dbd6cbb7
Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
Opcode Fuzzy Hash: d317456c615bf9008b67529b06aff5f9fae4f5f479d94640f2b11ca0dbd6cbb7
Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040626F
GlobalUnWire.KERNEL32(00000000), ref: 00406276
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
GlobalFix.KERNEL32(00000000), ref: 00406281

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A218 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047BB01,?,00000000,00000000,00000001,00000000,0047A4B5,?,00000000), ref: 0047A479

Strings

Failed to parse "reg" constant, xrefs: 0047A480
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047A2ED

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 05ee6b3b67afee6859f894b9066335fb286a048b1f35c691c8bdca609618c678
Instruction ID: 25f2a786541cb687838a6194ffc4a73185deb9e5551b5ad8c851c0bf1152322b
Opcode Fuzzy Hash: 05ee6b3b67afee6859f894b9066335fb286a048b1f35c691c8bdca609618c678
Instruction Fuzzy Hash: 22817274E00108AFCB10DF95D485ADEBBF9AF88344F50817AE814B7392D739AE05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004763AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,004764DF,?,00000000,004764F0,?,00000000,00476539), ref: 004764B0
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,004764DF,?,00000000,004764F0,?,00000000,00476539), ref: 004764C4

Strings

Extracting temporary file: , xrefs: 004763EC

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: FileTime$Local
String ID: Extracting temporary file:
API String ID: 791338737-4171118009
Opcode ID: a80e35328548893b295efc7472ac722154afa94c34651c27e26e6e8334cb8313
Instruction ID: 173659db1c42fed311bbc77dc24fc0b62308bfde4479aaaaa113f8cb774a82d8
Opcode Fuzzy Hash: a80e35328548893b295efc7472ac722154afa94c34651c27e26e6e8334cb8313
Instruction Fuzzy Hash: 9541B670E00649AFCB01DFA5C892AAFBBB9EB09704F51847AF814A7291D7789905CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0046CC0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046CD38
Failed to proceed to next wizard page; aborting., xrefs: 0046CD24

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 7a25e1645a33cbe6e929f5c7beb1038c0aed19b3e354743701339651447d5c4b
Instruction ID: bcb3787111d781b294161d03010f6e791927551fc3c7e501f8e48cd77162cd73
Opcode Fuzzy Hash: 7a25e1645a33cbe6e929f5c7beb1038c0aed19b3e354743701339651447d5c4b
Instruction Fuzzy Hash: A531C430604204DFD711EB59D9C5BA977F5EB06304F5500BBF448AB392D7786E40CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00478E98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00478F7E,?,?,00000001,00000000,00000000,00478F99), ref: 00478F67

Strings

%s\%s_is1, xrefs: 00478F10
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478EF2

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 4390143081fa1cbfc05a77ab89ffad6b83c856e6c2d55465ffb8b64579313e9f
Instruction ID: 4b2a563bf9abf46f4fe3d7c32e0d4fce195dfbf5fea183d3e913b06dd9c9918d
Opcode Fuzzy Hash: 4390143081fa1cbfc05a77ab89ffad6b83c856e6c2d55465ffb8b64579313e9f
Instruction Fuzzy Hash: EC218070B44244AFDB11DBA9CC45A9EBBF9EB8D704F90847BE408E7381DB789D018B58

Uniqueness

Uniqueness Score: -1.00%

Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E

Strings

open, xrefs: 00450221

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00455290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Strings

<, xrefs: 004552E6

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 397510d247cb734b7669861417dbfcfbd251f2c0a68ff4605259e86b5c29478d
Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
Opcode Fuzzy Hash: 397510d247cb734b7669861417dbfcfbd251f2c0a68ff4605259e86b5c29478d
Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02252360,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
Opcode Fuzzy Hash: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C

Uniqueness

Uniqueness Score: -1.00%

Function 00496B2E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00496B69

Strings

@, xrefs: 00496B34
/INITPROCWND=$%x , xrefs: 00496B94

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 065ab22c92abacbd348a857e8389b224364e1a84b4d72130b6d36c29b0d142f9
Instruction ID: 88b10d18150c6b9811cea3f3864e76c9cf3cbfb68c265b437af87b1fefc14b87
Opcode Fuzzy Hash: 065ab22c92abacbd348a857e8389b224364e1a84b4d72130b6d36c29b0d142f9
Instruction Fuzzy Hash: A3117231A042489FDF01DBA4E855BAEBFE8EB49314F51847BE504E7292EB3CA905C658

Uniqueness

Uniqueness Score: -1.00%

Function 00447414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 004474C6

Strings

Unknown Method, xrefs: 0044749F
NIL Interface Exception, xrefs: 00447468

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: eaaa5532a95bbaa63f0b72a9291e33775e11d622c6162567185e6fee38e986d8
Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
Opcode Fuzzy Hash: eaaa5532a95bbaa63f0b72a9291e33775e11d622c6162567185e6fee38e986d8
Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004963A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00496468,?,0049645C,00000000,00496443), ref: 0049640E
CloseHandle.KERNEL32(004964A8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00496468,?,0049645C,00000000), ref: 00496425

Part of subcall function 004962F8: GetLastError.KERNEL32(00000000,00496390,?,?,?,?), ref: 0049631C

Strings

0nI, xrefs: 004963D9, 004963E8

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: 0nI
API String ID: 3798668922-794067871
Opcode ID: 9f8f3e3bd8d813766f30c87d8e8bb38219208be6823d56de1360ae23e0f090d4
Instruction ID: 4379268ebcebee96409867e54b2437a6ba0b21f89d1dc4ba20584320bf55fb87
Opcode Fuzzy Hash: 9f8f3e3bd8d813766f30c87d8e8bb38219208be6823d56de1360ae23e0f090d4
Instruction Fuzzy Hash: 840182B1644248AFDB00EBD1DC42A9EBBACDF08704F51403AB904E7281D6785E008A2D

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8

Strings

Inno Setup: No Icons, xrefs: 0042DD76

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
Opcode Fuzzy Hash: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E

Uniqueness

Uniqueness Score: -1.00%

Function 00452E88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,?,00000000,00452EE9,?,?,-00000001,?), ref: 00452EC3
GetLastError.KERNEL32(00000000,?,00000000,00452EE9,?,?,-00000001,?), ref: 00452ECB

Strings

T$H, xrefs: 00452EF9

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: T$H
API String ID: 1799206407-488339322
Opcode ID: 5d86fcf9b6e052d8a24a57bf4ef79df3c2f35f3d819ce0a4394afd1f6d7b89dc
Instruction ID: d2ab7b9b66ca24062e77e49c95e81f13ab46b8af1b1b2eb811bbb53637dcbd2b
Opcode Fuzzy Hash: 5d86fcf9b6e052d8a24a57bf4ef79df3c2f35f3d819ce0a4394afd1f6d7b89dc
Instruction Fuzzy Hash: 86F0F971A04204AB8B01DB7A9D4249EB7ECEB8A32171045BBFC04E3642E7B84E048558

Uniqueness

Uniqueness Score: -1.00%

Function 00498004 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047D0CC: FreeLibrary.KERNEL32(00000000,00481A2F), ref: 0047D0E2

Part of subcall function 0047CD9C: GetTickCount.KERNEL32 ref: 0047CDE6

Part of subcall function 00457294: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004572B3

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0049895B), ref: 00498059
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0049895B), ref: 0049805F

Strings

Detected restart. Removing temporary directory., xrefs: 00498013

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 281135f9a0ad5b4e488772808dcd9eaa6bf3b34c39f962a9f46887a4a11e3304
Instruction ID: bb05712aa7eb36d303e19ffab6eef2c78f2a463723ea7eca767f41585c441369
Opcode Fuzzy Hash: 281135f9a0ad5b4e488772808dcd9eaa6bf3b34c39f962a9f46887a4a11e3304
Instruction Fuzzy Hash: BDE0E532208A406DDA1177BABC1396B7F5CDB46768B22487FF50882552D92D481CC53D

Uniqueness

Uniqueness Score: -1.00%

Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455693
Sleep.KERNEL32(?), ref: 004556A3
GetLastError.KERNEL32 ref: 004556B6
GetLastError.KERNEL32 ref: 004556C0

Memory Dump Source

Source File: 00000002.00000002.2348853371.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2348831301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348902586.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348920123.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348944908.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2348982617.00000000004B5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_AccoutChangersetup.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 124e83ad3764f0425cc9cce0cec047ecc2156a8e27ad070cfe64c44283ad0992
Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
Opcode Fuzzy Hash: 124e83ad3764f0425cc9cce0cec047ecc2156a8e27ad070cfe64c44283ad0992
Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AccountChanger.exePID: 1292, Parent PID: 6052COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00007FF758994E20 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF758994E65

Part of subcall function 00007FF7589947B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7589947CC

Part of subcall function 00007FF758989E18: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF758991E42,?,?,?,00007FF758991E7F,?,?,00000000,00007FF758992345,?,?,?,00007FF758992277), ref: 00007FF758989E2E
Part of subcall function 00007FF758989E18: GetLastError.KERNEL32(?,?,?,00007FF758991E42,?,?,?,00007FF758991E7F,?,?,00000000,00007FF758992345,?,?,?,00007FF758992277), ref: 00007FF758989E38

Part of subcall function 00007FF758989DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF758989DAF,?,?,?,?,?,00007FF7589821EC), ref: 00007FF758989DD9
Part of subcall function 00007FF758989DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF758989DAF,?,?,?,?,?,00007FF7589821EC), ref: 00007FF758989DFE

_get_daylight.LIBCMT ref: 00007FF758994E54

Part of subcall function 00007FF758994818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75899482C

_get_daylight.LIBCMT ref: 00007FF7589950CA
_get_daylight.LIBCMT ref: 00007FF7589950DB
_get_daylight.LIBCMT ref: 00007FF7589950EC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF75899532C), ref: 00007FF758995113

Strings

W. Europe Summer Time, xrefs: 00007FF7589951D1
W. Europe Standard Time, xrefs: 00007FF7589951B9

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 1458651798-690618308
Opcode ID: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction ID: babb7df80d2406678910b418237b5d889743084cd76ce4179a364ad2cf10c5e1
Opcode Fuzzy Hash: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction Fuzzy Hash: D1D1C166A0824287EB24BF65D8401BAF7A5FF84786FC84135EA0D47785DF3CE841C768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758995D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF758995AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF758995AE1
Part of subcall function 00007FF758995AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF758995B5F
Part of subcall function 00007FF758995AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF758995BB0

CreateFileW.KERNELBASE ref: 00007FF758995E72
CreateFileW.KERNEL32 ref: 00007FF758995EC2
GetLastError.KERNEL32 ref: 00007FF758995EF2
GetFileType.KERNELBASE ref: 00007FF758995F07
GetLastError.KERNEL32 ref: 00007FF758995F11
CloseHandle.KERNEL32 ref: 00007FF758995F44
CloseHandle.KERNEL32 ref: 00007FF7589960A7
CreateFileW.KERNEL32 ref: 00007FF7589960DC
GetLastError.KERNEL32 ref: 00007FF7589960EB

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction ID: 198ac712a02a44540d26815707d4e8f40821e8fc767293053da4ef9c99d5cb6a
Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction Fuzzy Hash: C7C1F232B28A4286EB10EF69C4806BDB7A5FB49B99F894239DE1E57794CF38D051C314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758976780 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF75897674D), ref: 00007FF75897681A

Part of subcall function 00007FF758976990: GetEnvironmentVariableW.KERNEL32(00007FF7589736E7), ref: 00007FF7589769CA
Part of subcall function 00007FF758976990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7589769E7

Part of subcall function 00007FF7589866B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7589866CD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7589768D1

Part of subcall function 00007FF758972770: MessageBoxW.USER32 ref: 00007FF758972841

Strings

LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7589767F8
TMP, xrefs: 00007FF7589767DE
_MEI%d, xrefs: 00007FF758976828
TMP, xrefs: 00007FF7589767B8, 00007FF758976879, 00007FF758976907

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 3863800b2665c7901903b481e41fcfda7d0e5020c540a2559d82cfcc8f27efd6
Instruction ID: dc9cde8bf7f0446cb667ea082136b740f5babbe309b55579a4c1deacac0e6d21
Opcode Fuzzy Hash: 3863800b2665c7901903b481e41fcfda7d0e5020c540a2559d82cfcc8f27efd6
Instruction Fuzzy Hash: A3519351B1C68393FE55BB7199552BAF2415F46BC2FCC4431DD0E87786EF2CE4018628

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75899509C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7589950CA

Part of subcall function 00007FF758994818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75899482C

_get_daylight.LIBCMT ref: 00007FF7589950DB

Part of subcall function 00007FF7589947B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7589947CC

_get_daylight.LIBCMT ref: 00007FF7589950EC

Part of subcall function 00007FF7589947E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7589947FC

Part of subcall function 00007FF758989E18: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF758991E42,?,?,?,00007FF758991E7F,?,?,00000000,00007FF758992345,?,?,?,00007FF758992277), ref: 00007FF758989E2E
Part of subcall function 00007FF758989E18: GetLastError.KERNEL32(?,?,?,00007FF758991E42,?,?,?,00007FF758991E7F,?,?,00000000,00007FF758992345,?,?,?,00007FF758992277), ref: 00007FF758989E38

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF75899532C), ref: 00007FF758995113

Strings

W. Europe Summer Time, xrefs: 00007FF7589951D1
W. Europe Standard Time, xrefs: 00007FF7589951B9

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 2248164782-690618308
Opcode ID: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction ID: 15560a1d91d5323c55ddf2305d4868fae1f918b3d9106f2108c1847de791fa5f
Opcode Fuzzy Hash: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction Fuzzy Hash: 29519132A1864287E720FF61E9811BAF764FB88786FC84135EA4D47796DF3CE4408768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589717B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF75897185C
_fread_nolock.LIBCMT ref: 00007FF75897190E

Part of subcall function 00007FF75897F370: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75897F384

Part of subcall function 00007FF758972770: MessageBoxW.USER32 ref: 00007FF758972841

Strings

malloc, xrefs: 00007FF7589718EA
MEI, xrefs: 00007FF7589717EF
Cannot read Table of Contents., xrefs: 00007FF758971995
fseek, xrefs: 00007FF758971836
Failed to read cookie!, xrefs: 00007FF758971867
Failed to seek to cookie position!, xrefs: 00007FF75897182F
fread, xrefs: 00007FF75897186E
Could not read full TOC!, xrefs: 00007FF758971919
Could not allocate buffer for TOC!, xrefs: 00007FF7589718E3
Error on file., xrefs: 00007FF75897193D

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: e8269c6fecbafbb64fbf8d967eca12bb77435fba6b7368ca0c9731a5cc714fb5
Instruction ID: b0b6b0300653dd8c50e9c919b2742123b7b22bc806a52ab55a73a78a7f836f37
Opcode Fuzzy Hash: e8269c6fecbafbb64fbf8d967eca12bb77435fba6b7368ca0c9731a5cc714fb5
Instruction Fuzzy Hash: 05517D72A1960287EB14EF24E450278F3A0FF89B4AB998135DA0EC7795DF3CE441C768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758971440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fwrite, xrefs: 00007FF7589715DC
malloc, xrefs: 00007FF758971560
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF758971559
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7589715E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7589714CA
fseek, xrefs: 00007FF758971500
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7589714F9
fopen, xrefs: 00007FF758971491
fread, xrefs: 00007FF7589715EC
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7589715D5
Failed to extract %s: failed to open target file!, xrefs: 00007FF75897148A

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 49d110064627cd7c6bff189290cacc7484f677cb21aa04b3a1ebf0fa2f358fa1
Instruction ID: ed371e59c985418901702d5fede45379c69f28ca75afe30c7c75b7f866650fac
Opcode Fuzzy Hash: 49d110064627cd7c6bff189290cacc7484f677cb21aa04b3a1ebf0fa2f358fa1
Instruction Fuzzy Hash: 17518A61B0864283EA14BB11A4446B9F3A4FF46BD6FCC4531EE1E877A5EF3CE5458328

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589778A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF75897685A,?,00007FF75897674D), ref: 00007FF7589778E0
OpenProcessToken.ADVAPI32(?,00007FF75897674D), ref: 00007FF7589778F1
GetTokenInformation.KERNELBASE(?,00007FF75897674D(TokenIntegrityLevel)), ref: 00007FF758977913
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF75897791D
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel), ref: 00007FF75897795A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF75897796C
CloseHandle.KERNEL32(?,00007FF75897674D), ref: 00007FF758977984
LocalFree.KERNEL32(?,00007FF75897674D), ref: 00007FF7589779B6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7589779DD
CreateDirectoryW.KERNELBASE(?,00007FF75897674D), ref: 00007FF7589779EE

Strings

D:(A;;FA;;;%s), xrefs: 00007FF758977999
S-1-3-4, xrefs: 00007FF75897798F

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: a514ac21f5a9f1b0c29302b8773991edac034ab817825ff09080fe9ed33bccc0
Instruction ID: 0b30a54e3b6ba544e63c7639ba00234b61ba9b965b0bbbaae80ec70a017c5d81
Opcode Fuzzy Hash: a514ac21f5a9f1b0c29302b8773991edac034ab817825ff09080fe9ed33bccc0
Instruction Fuzzy Hash: 0741723171C68293EB50AF20E4447AAF3A5FB85796F880231EA5E876E5DF3CD444CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758976FD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF758977A30: MultiByteToWideChar.KERNEL32 ref: 00007FF758977A6A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF758973A30), ref: 00007FF75897701F
GetStartupInfoW.KERNEL32 ref: 00007FF75897703E

Part of subcall function 00007FF758989184: _invalid_parameter_noinfo.LIBCMT ref: 00007FF758989198

Part of subcall function 00007FF758986EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF758986F5F

GetCommandLineW.KERNEL32 ref: 00007FF7589770DE
CreateProcessW.KERNELBASE ref: 00007FF758977120
WaitForSingleObject.KERNEL32 ref: 00007FF758977134
GetExitCodeProcess.KERNEL32 ref: 00007FF758977144

Strings

Error creating child process!, xrefs: 00007FF758977150
CreateProcessW, xrefs: 00007FF758977157

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction ID: eb554b05c0b7ab58b29358ad528dc6c8ec621da3f6977b93da656c963a683dc4
Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction Fuzzy Hash: FA416072A0878283EA20AB60E8452AAF3A4FF95365F840335E6AD47BD5DF7CD0548B54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758971000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF758973BA0: GetModuleFileNameW.KERNEL32(?,00007FF758973699), ref: 00007FF758973BD1

SetDllDirectoryW.KERNEL32 ref: 00007FF7589738A5

Part of subcall function 00007FF758976990: GetEnvironmentVariableW.KERNEL32(00007FF7589736E7), ref: 00007FF7589769CA
Part of subcall function 00007FF758976990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7589769E7

Strings

_PYI_ONEDIR_MODE, xrefs: 00007FF7589736FC, 00007FF758973727
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF75897382C
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF75897378E
MEI, xrefs: 00007FF7589737E7
Failed to convert DLL search path!, xrefs: 00007FF75897388D
_MEIPASS2, xrefs: 00007FF7589736D3, 00007FF75897373C, 00007FF7589739EB, 00007FF7589739FB

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 929ebd36aeb8f4c42b36b5f125747109162599bf3042069f480f57849fb24238
Instruction ID: 34f7ad9c04ebf289a590e5a6ef1c932c1aeda91184bf0e88ae2f0985aad701fe
Opcode Fuzzy Hash: 929ebd36aeb8f4c42b36b5f125747109162599bf3042069f480f57849fb24238
Instruction Fuzzy Hash: 25B1C521B1C68347FA64BB2198512FDF390BF86786FC84031EA4D87796EF2CE5059768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758971050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7589710F1
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF758971249
malloc, xrefs: 00007FF7589710F8, 00007FF758971126
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7589710B4
1.2.13, xrefs: 00007FF75897107E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF75897111F

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 58ee0a96ad496ee9f980749e14be2bc9f53ee6fdc34e68aa17b84f1205dafd1e
Instruction ID: 94d156327b6f9d107560ce095a543ba334415a8dd7013d75cb424ce3f7dcf08d
Opcode Fuzzy Hash: 58ee0a96ad496ee9f980749e14be2bc9f53ee6fdc34e68aa17b84f1205dafd1e
Instruction Fuzzy Hash: A951D462B0868287EA20BB51E4403BAF290FB86796F8C4131DE4EC7795EF3CE545C718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898AF2C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75898B359

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction ID: e2ac9294a75c8f2af7735caca047a751a05dad5519dafd321f5cc6e1b253b3ab
Opcode Fuzzy Hash: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction Fuzzy Hash: 4DC1C6A2A0C68783F761AB1594402BDFB94EF91B82FDD0131D94E07791CF7CE8568B29

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898C430 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF75898C41B), ref: 00007FF75898C54C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF75898C41B), ref: 00007FF75898C5D7

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction ID: a0c3c022b9a66c10b493fcae25b58fca6928fd437a06299a1dfdabc8fdd31311
Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction Fuzzy Hash: 6B91D6A2F1865386F790AF6594402BDFBA0FB4478EF985135DE0E67A84CF38D441CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898E8DC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF75898E9CC
_get_daylight.LIBCMT ref: 00007FF75898E9DD
_get_daylight.LIBCMT ref: 00007FF75898E9EE
_isindst.LIBCMT ref: 00007FF75898EAB9

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction ID: 4701157e607650c93280270f065f3af67dd2b5cdad316ec6bd9b68a31d058bad
Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction Fuzzy Hash: A05139B2F042128BFB14EF6499512BCF7A5BB0075AF984239ED5E52AD5DF3CA402CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589847D4 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF758984807
GetFileInformationByHandle.KERNELBASE ref: 00007FF758984869
GetLastError.KERNEL32 ref: 00007FF7589848FA
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF75898470C), ref: 00007FF758984946

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6d39917c2a5e172715dc0149da862f2fc663c363b49fcf3998972eea944cc0d9
Instruction ID: a86d0745fd27bfc3b8d2f2bbf81bc8d47ec4f868929ec42ba4dea7680f7b36a0
Opcode Fuzzy Hash: 6d39917c2a5e172715dc0149da862f2fc663c363b49fcf3998972eea944cc0d9
Instruction Fuzzy Hash: BA518CA2E086428BFB10EF70D4403BDF3A1AF48B99F994134DE0D57689DF38D4518B28

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897B19C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF75897B1AB

Part of subcall function 00007FF75897B36C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF75897B38E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF75897B1C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF75897B22E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF75897B281

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction ID: 251d19a94fc0e3c8cb58e37806fec65e13abb51147d41f72c403c426498d1358
Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction Fuzzy Hash: 60311751E0D10347FA54BB6494163BDF281AF62386FCC4034EA0E9B2D3DF2CA805867D

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758984680 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7589846AD
CreateFileW.KERNELBASE ref: 00007FF7589846EC
CloseHandle.KERNEL32 ref: 00007FF758984721

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: aa6a3d9890cc6a7f195a6e990ba186583f2f0d5ddde8471eaaef5ef51b0941e7
Instruction ID: c6e0f25975917cd60219d5ce7179ce99ca48402b108f764b57a32edafd505ebf
Opcode Fuzzy Hash: aa6a3d9890cc6a7f195a6e990ba186583f2f0d5ddde8471eaaef5ef51b0941e7
Instruction Fuzzy Hash: 0B41D5A2E1878287F754AB21D500379F2A0FF95765F549334E69C03AD6DF6CA1E08B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897F39C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75897F3E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75897F4D7

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction ID: 2ac11cfd5bc4e3e7e1697d99728d257a699a313ef6726247bb8f79855990a25e
Opcode Fuzzy Hash: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction Fuzzy Hash: BA51FD61B0928247FA24BE25940467AF2C1BF46BB5F9C4735DD6D977C5CF3CD4028628

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898A028 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF758989EA5,?,?,00000000,00007FF758989F5A), ref: 00007FF75898A096
GetLastError.KERNEL32(?,?,?,00007FF758989EA5,?,?,00000000,00007FF758989F5A), ref: 00007FF75898A0A0

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction ID: 9e46f7c02ecdde925d2f440bf117db80b824c9f98dbaa21d590ad099b7dc799e
Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction Fuzzy Hash: 2021D092B0828303FE506B249444279F2D1AF857A6F8C4234DA2E4B3D2CF6CA450862A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898B604 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF75898B79D), ref: 00007FF75898B650
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF75898B79D), ref: 00007FF75898B65A

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction ID: 056168f1ce0181d790daf21e9984a825d7a7261dfd65f69462e8efd8cc0468ac
Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction Fuzzy Hash: FA11B2A2718B8282EA10AB25E404169F361AB45BF5F9C4331EA7D0B7D9CF3CD0158B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898497C Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF758984891), ref: 00007FF7589849AF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF758984891), ref: 00007FF7589849C5

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 42d85f7bbfb38a33647f37402af2049ec243a38652db21839daf1665d9964160
Instruction ID: 254f39896acce34525acc4591f4668f3b501281c527d517f4fc1d8764e91a5f1
Opcode Fuzzy Hash: 42d85f7bbfb38a33647f37402af2049ec243a38652db21839daf1665d9964160
Instruction Fuzzy Hash: DA118FA160C64282EA64AB11A41107EF7A0EB85772F940235E69E859D8EF2DD044CF28

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758989E18 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF758991E42,?,?,?,00007FF758991E7F,?,?,00000000,00007FF758992345,?,?,?,00007FF758992277), ref: 00007FF758989E2E
GetLastError.KERNEL32(?,?,?,00007FF758991E42,?,?,?,00007FF758991E7F,?,?,00000000,00007FF758992345,?,?,?,00007FF758992277), ref: 00007FF758989E38

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction ID: fc5610f04474ebbbca249f8d2573420d9ea45452faeb17555d44c30d0a0930a5
Opcode Fuzzy Hash: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction Fuzzy Hash: C1E0E6D0F0964343FF187BF15845175F6959F94B43BCC5034C90E46252EF2C68958679

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898B37C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75898B3A4

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction ID: 483d984077cd036fc36639086cdb2663c729f5adbb228bc5d1804ee03843770c
Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction Fuzzy Hash: AF41E272A1960383FA24EA25E441279F3A0EB95B46F9C1131D68E877D1CF2CE403CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758977200 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7589772AA

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 1129ec10dab14b3e107a02a96077c81cc0ad0a28bc517a078b3a481aacd7e43c
Instruction ID: de241997fbdecea90415ea3bca4d9a87d37bc3df7aa31dd02a18e3fde95e8b6f
Opcode Fuzzy Hash: 1129ec10dab14b3e107a02a96077c81cc0ad0a28bc517a078b3a481aacd7e43c
Instruction Fuzzy Hash: C921D625B0829257FA11BA1269043BAF681BF47BC5FCC4430EE0D87786CF3CE106C618

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898AE0C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75898AE92

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
Instruction ID: e2d19c2992fcb8e8ad5c9ed011fd7218a400f4f9cacdc599188484c0786ad054
Opcode Fuzzy Hash: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
Instruction Fuzzy Hash: 3D316DA2A1865387F751BB25884137CF6D0AF40B56F890535EA1D073D3CF7CA8418A2A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589854C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75898542D

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 9024823376c20faede12e9409fa992fdbc55816459e95bcd9dcbc66c6c173f72
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: 4F1165A2A0D64383FB60BF6194102B9F2A0BF85B82FCC4031EA4D57696CF7CD4048F69

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75899575C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75899577F

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction ID: 06f1aaf3c3ea92cdce44502cddad65287db040c941ad96d19e3361911330be1f
Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction Fuzzy Hash: 8421F672A186428BEB61AF18E44037AF3A4FB84B95F9C4234E75D876D9DF3CD5008B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897F61C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75897F670

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 6577bc99174f5f3e600d8af94f656093b2703c9672d86dddd67bc5589bd5f871
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: 35018861A0874642EA04FB529901069F695FF86FE5F8C5631EE5C67BDACF3CD4024718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898DD40 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF75898A8B6,?,?,?,00007FF758989A73,?,?,00000000,00007FF758989D0E), ref: 00007FF75898DD95

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction ID: 029f436f543ce8e921d8e264ea7a0f764c5e28299d2b91a0a88cd4d1ac4fd6ec
Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction Fuzzy Hash: 5FF04F94B1960383FE9476A255017B5E2985FC8B82F8C5530C90E47ED2DF1CE4408938

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898CACC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF75897FE44,?,?,?,00007FF758981356,?,?,?,?,?,00007FF758982949), ref: 00007FF75898CB0A

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction ID: e543f25ce49e115d704c6ef5b6fce7b2bc7d8b49f074b6c86a9b3334928653c8
Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction Fuzzy Hash: 57F05880B1D6434BFEA476B258012B5F1804F887A6F8C0631DC2E966C2EF2CE8808978

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF758971B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF758971BDE
MulDiv.KERNEL32 ref: 00007FF758971BF2
MulDiv.KERNEL32 ref: 00007FF758971C13
SystemParametersInfoW.USER32 ref: 00007FF758971C5B
CreateFontIndirectW.GDI32 ref: 00007FF758971C6F
#380.COMCTL32 ref: 00007FF758971C93
CreateWindowExW.USER32 ref: 00007FF758971CE6
CreateWindowExW.USER32 ref: 00007FF758971D40
CreateWindowExW.USER32 ref: 00007FF758971D9D
CreateWindowExW.USER32 ref: 00007FF758971DFF
SendMessageW.USER32 ref: 00007FF758971E1F
SendMessageW.USER32 ref: 00007FF758971E39
SendMessageW.USER32 ref: 00007FF758971E58
SendMessageW.USER32 ref: 00007FF758971E77
SendMessageW.USER32 ref: 00007FF758971E95
SendMessageW.USER32 ref: 00007FF758971EB3
SendMessageW.USER32 ref: 00007FF758971ED1
SendMessageW.USER32 ref: 00007FF758971EE9
SendMessageW.USER32 ref: 00007FF758971F01
GetClientRect.USER32 ref: 00007FF758971F10

Part of subcall function 00007FF758972030: GetDC.USER32 ref: 00007FF75897205B
Part of subcall function 00007FF758972030: SelectObject.GDI32 ref: 00007FF7589720A2
Part of subcall function 00007FF758972030: DrawTextW.USER32 ref: 00007FF7589720C5
Part of subcall function 00007FF758972030: SelectObject.GDI32 ref: 00007FF7589720DB
Part of subcall function 00007FF758972030: ReleaseDC.USER32 ref: 00007FF7589720EB
Part of subcall function 00007FF758972030: MoveWindow.USER32 ref: 00007FF75897213B
Part of subcall function 00007FF758972030: MoveWindow.USER32 ref: 00007FF75897217B
Part of subcall function 00007FF758972030: MoveWindow.USER32 ref: 00007FF7589721CE

Strings

STATIC, xrefs: 00007FF758971C9C, 00007FF758971CF1
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF758971BBD
BUTTON, xrefs: 00007FF758971DB6
EDIT, xrefs: 00007FF758971D4B
Close, xrefs: 00007FF758971DA8

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction ID: 912aa4e40529e221ceffc0193070362445f06226e8b61dec267c9cafdb2088df
Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction Fuzzy Hash: 9CA15732318B8187E7149F21E5447AAF3A4F788B91F94412AEB8D43B24CF3DE165CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589774B0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7589726A0), ref: 00007FF7589774D7
FormatMessageW.KERNEL32(00000000,00007FF7589726A0), ref: 00007FF758977506
WideCharToMultiByte.KERNEL32 ref: 00007FF75897755C

Part of subcall function 00007FF758972620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF758977744,?,?,?,?,?,?,?,?,?,?,?,00007FF75897101D), ref: 00007FF758972654
Part of subcall function 00007FF758972620: MessageBoxW.USER32 ref: 00007FF75897272C

Strings

No error messages generated., xrefs: 00007FF758977510
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF758977579
Failed to encode wchar_t as UTF-8., xrefs: 00007FF758977566
FormatMessageW, xrefs: 00007FF758977517
PyInstaller: FormatMessageW failed., xrefs: 00007FF758977523
WideCharToMultiByte, xrefs: 00007FF75897756D

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction ID: 2cd6981f9e1e79a305cf29c6b6613469e57ee1e950252e8d43b8cb6dc4c763f9
Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction Fuzzy Hash: 8F214F31B1CA4293E720AB55E8442A6F3A5FB8938AFCC0035E54E82694EF7CE545C768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897B69C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF75897B6B8
RtlCaptureContext.KERNEL32 ref: 00007FF75897B6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF75897B6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF75897B740
IsDebuggerPresent.KERNEL32 ref: 00007FF75897B794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF75897B7B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF75897B7C0

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction ID: 2f5554c9973ff355a211cb7114e1b51b9c84b8745fd3a657f23b12fbc46481c0
Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction Fuzzy Hash: B8313072709A818AEB609F60E8803EDB3A4FB45745F88443ADA4D87A95EF3CD548C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758989AE4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF758989B5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF758989B75
RtlVirtualUnwind.KERNEL32 ref: 00007FF758989BB0
IsDebuggerPresent.KERNEL32 ref: 00007FF758989BE9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF758989BF3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF758989BFE

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction ID: cc01c2190198a979e78520009b76df36955a96e8d296d6148dbaa2c54c34f627
Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction Fuzzy Hash: 56315232718B8287EB60DF25E8402AEB3A4FB85755F940136EA8D43B95DF3CD545CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589909B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF758990A00
FindFirstFileExW.KERNEL32 ref: 00007FF758990B0A

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction ID: 0389a1330234be6dc15d3c9abd08426f14826ed68643ef44a1cbcabf80253a53
Opcode Fuzzy Hash: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction Fuzzy Hash: DDB1B462B1969243EE60AB2598041B9F399FB84BE6F884131FD6D07B85EF3CE441C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589925A0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7589925A4

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction ID: 1ffd5fc06482b2bdff27c0726cc14a82ffdce2554e07e33c59f35a3c42588783
Opcode Fuzzy Hash: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction Fuzzy Hash: 32B09220F0BA42C3EA183B656C82224B3A8BF88712FDC0039C00C40320EF2C28AA5725

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589989B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction ID: 15cb54e487036180365b33a25a8464d9eedd17b70e3a00e14c73df3c8dac81f2
Opcode Fuzzy Hash: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction Fuzzy Hash: 3EF068717182558BEB989F69A802639B7D0F7483C5F889039D58D83B04D73C94518F18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897B880 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction ID: fd6f80ebf989863dd91e31cd559c34048f00da3d4a2cec4e1e1f51e776c98b88
Opcode Fuzzy Hash: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction Fuzzy Hash: 08A00221B0CC06D3FA54BB00E850070F3B4FB51302FC80032D51D810A1EF3CA440D329

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758973DF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973E06
GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973E45
GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973E6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973E8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973EB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973EDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973F07
GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973F2F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF758973F57

Strings

Failed to get address for PyUnicode_Replace, xrefs: 00007FF7589746A1
Py_NoUserSiteDirectory, xrefs: 00007FF758973ED5
Failed to get address for Py_SetPath, xrefs: 00007FF758974089
PyUnicode_Decode, xrefs: 00007FF7589745E5
Failed to get address for PyLong_AsLong, xrefs: 00007FF758974309
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF758974471
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF758973E57
Py_IgnoreEnvironmentFlag, xrefs: 00007FF758973E85
Py_BuildValue, xrefs: 00007FF758973FA5
Failed to get address for PyErr_Clear, xrefs: 00007FF758974151
Py_DecodeLocale, xrefs: 00007FF75897456D
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7589745D9
PyModule_GetDict, xrefs: 00007FF758974315
Py_Initialize, xrefs: 00007FF758974045
PyMarshal_ReadObjectFromString, xrefs: 00007FF75897451D
PyImport_AddModule, xrefs: 00007FF758974225
Py_FrozenFlag, xrefs: 00007FF758973E60
PyErr_Restore, xrefs: 00007FF7589741D5
Failed to get address for Py_SetProgramName, xrefs: 00007FF7589740D9
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF758974539
PyObject_CallFunction, xrefs: 00007FF75897433D
PyUnicode_FromFormat, xrefs: 00007FF7589745BD
Py_UTF8Mode, xrefs: 00007FF758973F7D
Py_SetPath, xrefs: 00007FF75897406D
PyImport_ImportModule, xrefs: 00007FF758974275
Py_OptimizeFlag, xrefs: 00007FF758973EFD
Failed to get address for PyList_Append, xrefs: 00007FF7589742B9
PyList_Append, xrefs: 00007FF75897429D
PyObject_GetAttrString, xrefs: 00007FF7589743B5
Failed to get address for PyImport_ImportModule, xrefs: 00007FF758974291
PyDict_GetItemString, xrefs: 00007FF75897410D
Py_VerboseFlag, xrefs: 00007FF758973F25
Failed to get address for PyList_New, xrefs: 00007FF7589742E1
Failed to get address for Py_FrozenFlag, xrefs: 00007FF758973E7C
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF758973EC9
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF758973EA1
Failed to get address for PyImport_AddModule, xrefs: 00007FF758974241
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF758974629
PyUnicode_DecodeFSDefault, xrefs: 00007FF75897460D
PyMem_RawFree, xrefs: 00007FF758974595
Failed to get address for PyDict_GetItemString, xrefs: 00007FF758974129
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF758974219
PyUnicode_FromString, xrefs: 00007FF758974545
PyErr_Print, xrefs: 00007FF758974185
Failed to get address for Py_DecodeLocale, xrefs: 00007FF758974589
Failed to get address for Py_BuildValue, xrefs: 00007FF758973FC1
Py_NoSiteFlag, xrefs: 00007FF758973EAD
PySys_SetObject, xrefs: 00007FF7589744A5
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF758973EF1
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF758973E18
Failed to get address for PySys_SetObject, xrefs: 00007FF7589744C1
Failed to get address for Py_Initialize, xrefs: 00007FF758974061
Py_Finalize, xrefs: 00007FF758973FF5
PyObject_SetAttrString, xrefs: 00007FF75897438D
Py_GetPath, xrefs: 00007FF758974095
Failed to get address for PyMem_RawFree, xrefs: 00007FF7589745B1
Failed to get address for PyUnicode_FromString, xrefs: 00007FF758974561
Failed to get address for Py_Finalize, xrefs: 00007FF758974011
Failed to get address for PyObject_CallFunction, xrefs: 00007FF758974359
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF758974421
PySys_SetArgvEx, xrefs: 00007FF758974455
PyUnicode_Join, xrefs: 00007FF75897465D
Failed to get address for PyEval_EvalCode, xrefs: 00007FF758974511
Failed to get address for PyErr_Restore, xrefs: 00007FF7589741F1
PyImport_ExecCodeModule, xrefs: 00007FF75897424D
PyErr_Occurred, xrefs: 00007FF75897415D
Py_DontWriteBytecodeFlag, xrefs: 00007FF758973DFF
Failed to get address for Py_DecRef, xrefs: 00007FF758973FE9
PyLong_AsLong, xrefs: 00007FF7589742ED
Failed to get address for PyErr_Fetch, xrefs: 00007FF7589741C9
PyUnicode_Replace, xrefs: 00007FF758974685
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7589743A9
PyUnicode_AsUTF8, xrefs: 00007FF758974635
Failed to get address for PyModule_GetDict, xrefs: 00007FF758974331
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF758974449
PyErr_NormalizeException, xrefs: 00007FF7589741FD
Py_SetProgramName, xrefs: 00007FF7589740BD
PyErr_Clear, xrefs: 00007FF758974135
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF758973F19
Failed to get address for PyUnicode_Join, xrefs: 00007FF758974679
Failed to get address for PyErr_Occurred, xrefs: 00007FF758974179
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7589743D1
PyRun_SimpleStringFlags, xrefs: 00007FF758974405
Failed to get address for PySys_SetPath, xrefs: 00007FF7589744E9
Py_DecRef, xrefs: 00007FF758973FCD
PySys_GetObject, xrefs: 00007FF75897447D
Failed to get address for Py_VerboseFlag, xrefs: 00007FF758973F41
PySys_AddWarnOption, xrefs: 00007FF75897442D
Py_UnbufferedStdioFlag, xrefs: 00007FF758973F4D
Failed to get address for PyErr_Print, xrefs: 00007FF7589741A1
Py_IncRef, xrefs: 00007FF75897401D
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF758973F69
PySys_SetPath, xrefs: 00007FF7589744CD
Failed to get address for Py_IncRef, xrefs: 00007FF758974039
GetProcAddress, xrefs: 00007FF758973E1F
Failed to get address for PyObject_Str, xrefs: 00007FF7589743F9
PyEval_EvalCode, xrefs: 00007FF7589744F5
Failed to get address for Py_GetPath, xrefs: 00007FF7589740B1
Failed to get address for Py_UTF8Mode, xrefs: 00007FF758973F99
PyObject_CallFunctionObjArgs, xrefs: 00007FF758974365
Py_FileSystemDefaultEncoding, xrefs: 00007FF758973E3B
PyList_New, xrefs: 00007FF7589742C5
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF758974651
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF758974381
Failed to get address for PyUnicode_Decode, xrefs: 00007FF758974601
Py_SetPythonHome, xrefs: 00007FF7589740E5
PyErr_Fetch, xrefs: 00007FF7589741AD
Failed to get address for Py_SetPythonHome, xrefs: 00007FF758974101
Failed to get address for PySys_GetObject, xrefs: 00007FF758974499
PyObject_Str, xrefs: 00007FF7589743DD
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF758974269

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction ID: 2f78ee508e2d4cc6f29b2346d977f7021e57a56dd90dc44f9a7e71901ac6a082
Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction Fuzzy Hash: E842D064A0EB0393FE55FB08A850174F3A9AF4A792BCC5031C94E46764FF7CB558D229

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589755D0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7589771B0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7589730BE), ref: 00007FF7589771D3

GetProcAddress.KERNEL32 ref: 00007FF758975F67
GetProcAddress.KERNEL32 ref: 00007FF758975FA6
GetProcAddress.KERNEL32 ref: 00007FF758975FCB
GetProcAddress.KERNEL32 ref: 00007FF758975FF0
GetProcAddress.KERNEL32 ref: 00007FF758976018
GetProcAddress.KERNEL32 ref: 00007FF758976040
GetProcAddress.KERNEL32 ref: 00007FF758976068
GetProcAddress.KERNEL32 ref: 00007FF758976090
GetProcAddress.KERNEL32 ref: 00007FF7589760B8

Strings

Failed to get address for Tcl_GetString, xrefs: 00007FF758976282
Failed to get address for Tcl_Finalize, xrefs: 00007FF75897602A
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7589762D2
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7589762AA
Tcl_MutexLock, xrefs: 00007FF7589760D6
Tcl_Finalize, xrefs: 00007FF75897600E
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF75897625A
Tcl_GetCurrentThread, xrefs: 00007FF7589760AE
Tcl_NewStringObj, xrefs: 00007FF75897628E
Tcl_Init, xrefs: 00007FF758975F60
Tcl_CreateInterp, xrefs: 00007FF758975F9C
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF758975FB8
Tcl_CreateThread, xrefs: 00007FF758976086
Tcl_SetVar2, xrefs: 00007FF758976216
Tk_GetNumMainWindows, xrefs: 00007FF75897641E
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF758976192
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7589762FA
Tcl_ConditionNotify, xrefs: 00007FF75897614E
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF75897643A
Tcl_FindExecutable, xrefs: 00007FF758975FC1
Tcl_SetVar2Ex, xrefs: 00007FF7589762DE
Tcl_GetString, xrefs: 00007FF758976266
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF75897561A
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7589761BA
Tk_Init, xrefs: 00007FF7589763F6
Tcl_ConditionFinalize, xrefs: 00007FF758976126
Tcl_EvalEx, xrefs: 00007FF758976356
Tcl_ConditionWait, xrefs: 00007FF758976176
Failed to get address for Tcl_Init, xrefs: 00007FF758975F79
Tcl_DoOneEvent, xrefs: 00007FF758975FE6
Failed to get address for Tcl_EvalEx, xrefs: 00007FF758976372
Failed to get address for Tk_Init, xrefs: 00007FF758976412
Tcl_ThreadAlert, xrefs: 00007FF7589761C6
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7589760F2
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF75897639A
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF758976322
Failed to get address for Tcl_SetVar2, xrefs: 00007FF758976232
Tcl_EvalFile, xrefs: 00007FF75897632E
Tcl_NewByteArrayObj, xrefs: 00007FF7589762B6
Failed to get address for Tcl_Free, xrefs: 00007FF7589763EA
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF75897607A
Failed to get address for Tcl_GetVar2, xrefs: 00007FF75897620A
Tcl_Alloc, xrefs: 00007FF7589763A6
GetProcAddress, xrefs: 00007FF758975F80
Tcl_DeleteInterp, xrefs: 00007FF75897605E
Tcl_GetVar2, xrefs: 00007FF7589761EE
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF758976002
Failed to get address for Tcl_Alloc, xrefs: 00007FF7589763C2
Failed to get address for Tcl_EvalFile, xrefs: 00007FF75897634A
Tcl_ThreadQueueEvent, xrefs: 00007FF75897619E
Tcl_GetObjResult, xrefs: 00007FF758976306
Tcl_MutexUnlock, xrefs: 00007FF7589760FE
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF758975FDD
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF758976052
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF75897611A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF75897616A
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7589761E2
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF758976142
Tcl_EvalObjv, xrefs: 00007FF75897637E
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7589760CA
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7589760A2
Tcl_FinalizeThread, xrefs: 00007FF758976036
Tcl_Free, xrefs: 00007FF7589763CE
Tcl_CreateObjCommand, xrefs: 00007FF75897623E

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction ID: dab94d29e9771ef32917e804acc144b4cdc8215d2f08fe16037c2c4223404e88
Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction Fuzzy Hash: 7CE19264A0EB0393FE95EB05A950174F3E9AF06797BCC5135C80E46368EF7CB54882AD

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758972030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF75897205B
SelectObject.GDI32 ref: 00007FF7589720A2
DrawTextW.USER32 ref: 00007FF7589720C5
SelectObject.GDI32 ref: 00007FF7589720DB
ReleaseDC.USER32 ref: 00007FF7589720EB
MoveWindow.USER32 ref: 00007FF75897213B
MoveWindow.USER32 ref: 00007FF75897217B
MoveWindow.USER32 ref: 00007FF7589721CE
MoveWindow.USER32 ref: 00007FF758972216

Strings

P%, xrefs: 00007FF7589720AF

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: 2226a1e483c8caa8dc5b62be9e4b3cc530bedb1ff2512f3ee74ccf9a19984eaa
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: D951F7266187A187D634AF26E4181BAF7A1F798B62F044121EBCF43684DF3CD045DB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758980228 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF758980268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF758980630
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7589808CF

Strings

p, xrefs: 00007FF758980372
p, xrefs: 00007FF75898030D
f, xrefs: 00007FF7589804B5
f, xrefs: 00007FF758980300
f, xrefs: 00007FF75898036A

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 683ac2ade1470ebe1c53eef500170c00f78aba617cf4386cfafe2c8b0cfd4ac3
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 7912A3B2E0C14387FB60BA15E0546BAF691FB80752FCC4135E69947AC4DB7DE4808F68

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589712B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF758971353
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7589713E2
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7589712E2
fseek, xrefs: 00007FF758971319
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF758971312
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF75897134C
fread, xrefs: 00007FF7589713E9

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: dd217ec3aaacc1be58aeec9edbc4e641fcd2b9301a7e808d22e41c5e2848f7c1
Instruction ID: 1de0a42fe41c2f0762973a7722e25546d684dd3d577051f0b2513ded0cde9cb7
Opcode Fuzzy Hash: dd217ec3aaacc1be58aeec9edbc4e641fcd2b9301a7e808d22e41c5e2848f7c1
Instruction Fuzzy Hash: 9E416D61B0864283EA24FB12E4056BAF3A4FF45795FC84432DE4E87B55EF3CE5428728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897DC30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF75897DC8D

Part of subcall function 00007FF75897EBA0: __GetUnwindTryBlock.LIBCMT ref: 00007FF75897EBE3
Part of subcall function 00007FF75897EBA0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF75897EC08

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF75897DD65
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF75897DFBA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75897E0C6

Strings

csm, xrefs: 00007FF75897DD88
csm, xrefs: 00007FF75897DD0E
csm, xrefs: 00007FF75897DCA7

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction ID: e0e643bd0ad06cfc8ce7d4ad61773b1aa867e04417c39dca56ba1f663530238a
Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction Fuzzy Hash: 01E1A672A087418BEB24AF25D4402BDF7A0FB86B99F580135EE8D97B59CF38E090C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898DDB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF75898E152,?,?,000001EDA3F18B68,00007FF75898A223,?,?,?,00007FF75898A11A,?,?,?,00007FF758985472), ref: 00007FF75898DF34
GetProcAddress.KERNEL32(?,00000000,?,00007FF75898E152,?,?,000001EDA3F18B68,00007FF75898A223,?,?,?,00007FF75898A11A,?,?,?,00007FF758985472), ref: 00007FF75898DF40

Strings

api-ms-, xrefs: 00007FF75898DE7E
ext-ms-, xrefs: 00007FF75898DE91

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction ID: 080a65ca2d7bb83d06126a4ba9a4f83e4954b85b508a45d661f7e55673be4514
Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction Fuzzy Hash: 404125A1B19A1383FA16EB169800575F392BF95BA1F8C4135DD0E87784EF3CE445C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758977600 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF75897101D), ref: 00007FF75897769F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF75897101D), ref: 00007FF7589776EF

Strings

win32_utils_to_utf8, xrefs: 00007FF758977728
Failed to encode wchar_t as UTF-8., xrefs: 00007FF758977718
Failed to get UTF-8 buffer size., xrefs: 00007FF758977731
WideCharToMultiByte, xrefs: 00007FF758977738
Out of memory., xrefs: 00007FF758977721

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 267b0c8d8adbe99f9cc92f3d6e900d5b31c1cd71cb2f75f25f71044bd00c2d8e
Instruction ID: fdf3999df30ab47ed398683ad984f297c1e2331cd08959e4a33dfe6ea7227baa
Opcode Fuzzy Hash: 267b0c8d8adbe99f9cc92f3d6e900d5b31c1cd71cb2f75f25f71044bd00c2d8e
Instruction Fuzzy Hash: 9341DE36A09B8287EA20EF15F84016AF7A4FB85B95F9C4035DA8D83B94EF3CD451C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758977B40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF758973699), ref: 00007FF758977B81

Part of subcall function 00007FF758972620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF758977744,?,?,?,?,?,?,?,?,?,?,?,00007FF75897101D), ref: 00007FF758972654
Part of subcall function 00007FF758972620: MessageBoxW.USER32 ref: 00007FF75897272C

WideCharToMultiByte.KERNEL32(?,00007FF758973699), ref: 00007FF758977BF5

Strings

win32_utils_to_utf8, xrefs: 00007FF758977BC2
Failed to encode wchar_t as UTF-8., xrefs: 00007FF758977BFF
Failed to get UTF-8 buffer size., xrefs: 00007FF758977B8E
WideCharToMultiByte, xrefs: 00007FF758977B95, 00007FF758977C06
Out of memory., xrefs: 00007FF758977BBB

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 8b53d79f468dfdec202439f2cfc50ec12b2c6f4620d2deddc649c41771dd01b7
Instruction ID: 24159e67c84855b8090e847a1654826063bf440aa2b83354efddcfb94a4bf297
Opcode Fuzzy Hash: 8b53d79f468dfdec202439f2cfc50ec12b2c6f4620d2deddc649c41771dd01b7
Instruction Fuzzy Hash: E4218D65B18B4296EA10AF56A840079F3A5EB84B85F8C4136DA0E83754EF7CE8418318

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758989264 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7589892A7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF758989694
_invalid_parameter_noinfo.LIBCMT ref: 00007FF758989930

Strings

p, xrefs: 00007FF758989359
f, xrefs: 00007FF7589893C9
p, xrefs: 00007FF7589893D1

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: 47b1a58ee1552b4e3be0efc1a0dc5c61857a0a0bc7c30f55a295cdf2a9f0d4cf
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: B8129EA2E0C14387FB24BB65D4546B9F691FB80756FDC4036E68A476C8DB3DE5808F28

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758977C30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF758977CC5
MultiByteToWideChar.KERNEL32 ref: 00007FF758977D07

Strings

MultiByteToWideChar, xrefs: 00007FF758977D4D
Failed to get wchar_t buffer size., xrefs: 00007FF758977D46
win32_utils_from_utf8, xrefs: 00007FF758977D3D
Failed to decode wchar_t from UTF-8, xrefs: 00007FF758977D2D
Out of memory., xrefs: 00007FF758977D36

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: bb74e9033905d9d92ee291b3b90ebe20a645d5fe0ae5b755d0038c0cd893acdc
Instruction ID: 53bc1d61222f863aa24689a6c477bbc64cad8b88119c8bbfd766e100d587d9fc
Opcode Fuzzy Hash: bb74e9033905d9d92ee291b3b90ebe20a645d5fe0ae5b755d0038c0cd893acdc
Instruction Fuzzy Hash: E841BF32A08A42D3E620EF15E84017AF7A5FB85795F984135DA8E87BA4EF3CD412C718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758976480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF758977A30: MultiByteToWideChar.KERNEL32 ref: 00007FF758977A6A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7589767CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7589764DF

Part of subcall function 00007FF758972770: MessageBoxW.USER32 ref: 00007FF758972841

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7589764B6
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF75897653A
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7589764F3

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction ID: 795a28abcd9fc140a90b0e5d24a37f2ad59c379f3e9ae253572dc0dc103d3a43
Opcode Fuzzy Hash: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction Fuzzy Hash: 1E317951B187C243FA21B721A9553BAF291AF99782FCC0031DA4E867D6EF2CE504C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897CEE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF75897D19A,?,?,?,00007FF75897CE8C,?,?,00000001,00007FF75897CAA9), ref: 00007FF75897CF6D
GetLastError.KERNEL32(?,?,?,00007FF75897D19A,?,?,?,00007FF75897CE8C,?,?,00000001,00007FF75897CAA9), ref: 00007FF75897CF7B
LoadLibraryExW.KERNEL32(?,?,?,00007FF75897D19A,?,?,?,00007FF75897CE8C,?,?,00000001,00007FF75897CAA9), ref: 00007FF75897CFA5
FreeLibrary.KERNEL32(?,?,?,00007FF75897D19A,?,?,?,00007FF75897CE8C,?,?,00000001,00007FF75897CAA9), ref: 00007FF75897CFEB
GetProcAddress.KERNEL32(?,?,?,00007FF75897D19A,?,?,?,00007FF75897CE8C,?,?,00000001,00007FF75897CAA9), ref: 00007FF75897CFF7

Strings

api-ms-, xrefs: 00007FF75897CF8D

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction ID: f2efc85d0beeac8aaf2eca1121847907a02c541038336f13a9074cce7a30285f
Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction Fuzzy Hash: BC31E521B0AA4293FE51BB02A400578F3D4FF4ABA6F8D4535DD1E8A384EF3CE4458768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758977A30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF758977A6A

Part of subcall function 00007FF758972620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF758977744,?,?,?,?,?,?,?,?,?,?,?,00007FF75897101D), ref: 00007FF758972654
Part of subcall function 00007FF758972620: MessageBoxW.USER32 ref: 00007FF75897272C

MultiByteToWideChar.KERNEL32 ref: 00007FF758977AF0

Strings

MultiByteToWideChar, xrefs: 00007FF758977A7E, 00007FF758977B01
Failed to get wchar_t buffer size., xrefs: 00007FF758977A77
win32_utils_from_utf8, xrefs: 00007FF758977AB9
Failed to decode wchar_t from UTF-8, xrefs: 00007FF758977AFA
Out of memory., xrefs: 00007FF758977AB2

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 13c7105583b4bafff51af941118006f09f2c49fe6ed44ac5ad13a55b88dd0971
Instruction ID: 6e2a96ee421ff39a979561ec7a3fd55df55cbe8c809ea3ff51fd61951aa6096e
Opcode Fuzzy Hash: 13c7105583b4bafff51af941118006f09f2c49fe6ed44ac5ad13a55b88dd0971
Instruction Fuzzy Hash: D6215326B18A4292EB50EB29F80006AF3A5FB857C9FDC4532DB4C83B69EF2CD5418714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898A620 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F,?,?,?,00007FF758989313), ref: 00007FF75898A62F
FlsGetValue.KERNEL32(?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F,?,?,?,00007FF758989313), ref: 00007FF75898A644
FlsSetValue.KERNEL32(?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F,?,?,?,00007FF758989313), ref: 00007FF75898A665
FlsSetValue.KERNEL32(?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F,?,?,?,00007FF758989313), ref: 00007FF75898A692
FlsSetValue.KERNEL32(?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F,?,?,?,00007FF758989313), ref: 00007FF75898A6A3
FlsSetValue.KERNEL32(?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F,?,?,?,00007FF758989313), ref: 00007FF75898A6B4
SetLastError.KERNEL32(?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F,?,?,?,00007FF758989313), ref: 00007FF75898A6CF

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
Instruction ID: c5683732857ddb1733e16ae4a6f544462273c4e7b18e70607720ea3963991050
Opcode Fuzzy Hash: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
Instruction Fuzzy Hash: 1A2150A1F0C60383FA587721565513DF2825F84BB2F9C0734E87E076DADF2CA4014A2A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75899706C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF75899709D
GetLastError.KERNEL32 ref: 00007FF7589970A9
CloseHandle.KERNEL32 ref: 00007FF7589970C1
CreateFileW.KERNEL32 ref: 00007FF7589970EC
WriteConsoleW.KERNEL32 ref: 00007FF75899710B

Strings

CONOUT$, xrefs: 00007FF7589970CD

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction ID: 91ce55386b9256e5ab061032b1bfb744e7b6cee498fbdb4490ab2c0beb5984d1
Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction Fuzzy Hash: 1F119321B18A4187E760AB16E854339F2A4FB88FE6F880234EA5D877A4DF3CD4048758

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898A798 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF75898444D,?,?,?,?,00007FF75898DDA7,?,?,00000000,00007FF75898A8B6,?,?,?), ref: 00007FF75898A7A7
FlsSetValue.KERNEL32(?,?,?,00007FF75898444D,?,?,?,?,00007FF75898DDA7,?,?,00000000,00007FF75898A8B6,?,?,?), ref: 00007FF75898A7DD
FlsSetValue.KERNEL32(?,?,?,00007FF75898444D,?,?,?,?,00007FF75898DDA7,?,?,00000000,00007FF75898A8B6,?,?,?), ref: 00007FF75898A80A
FlsSetValue.KERNEL32(?,?,?,00007FF75898444D,?,?,?,?,00007FF75898DDA7,?,?,00000000,00007FF75898A8B6,?,?,?), ref: 00007FF75898A81B
FlsSetValue.KERNEL32(?,?,?,00007FF75898444D,?,?,?,?,00007FF75898DDA7,?,?,00000000,00007FF75898A8B6,?,?,?), ref: 00007FF75898A82C
SetLastError.KERNEL32(?,?,?,00007FF75898444D,?,?,?,?,00007FF75898DDA7,?,?,00000000,00007FF75898A8B6,?,?,?), ref: 00007FF75898A847

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
Instruction ID: 3bdca37e6cd96500058131607119006de3744e346ff7ea02868d39cbd87bc3ef
Opcode Fuzzy Hash: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
Instruction Fuzzy Hash: 90115E61F0C64347FA5877216A5113DF1925F84BB2F8C4738D86E076D6EF2CA4128A3A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897C8A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF75897C8D3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF75897C968
RtlUnwindEx.KERNEL32 ref: 00007FF75897C9B7

Strings

csm, xrefs: 00007FF75897C94E
f, xrefs: 00007FF75897C8E6

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction ID: 950aee76202ed03534918572aa5491e3fe35b63c6ae10b75aff3a01e081ca6e9
Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction Fuzzy Hash: 1451D532B09602C7D758EB15E404A69F795FB46B8EF988130DE4E87748EF38E941C798

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758972240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF75897242F), ref: 00007FF758972278
DialogBoxIndirectParamW.USER32 ref: 00007FF75897233C
DeleteObject.GDI32 ref: 00007FF75897236F
DestroyIcon.USER32 ref: 00007FF758972381

Strings

Unhandled exception in script, xrefs: 00007FF7589722A8

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction ID: 78f3d7ab74e1ed46e5ef73623833db8c1793b45c33b92cfe2ed4ad8cabc6b6fa
Opcode Fuzzy Hash: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction Fuzzy Hash: 78318672A0868286EB20EF61E8552F9F3A0FF89785F880135EA4E4BB55DF3CD145C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758972620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF758977744,?,?,?,?,?,?,?,?,?,?,?,00007FF75897101D), ref: 00007FF758972654

Part of subcall function 00007FF7589774B0: GetLastError.KERNEL32(00000000,00007FF7589726A0), ref: 00007FF7589774D7
Part of subcall function 00007FF7589774B0: FormatMessageW.KERNEL32(00000000,00007FF7589726A0), ref: 00007FF758977506

Part of subcall function 00007FF758977A30: MultiByteToWideChar.KERNEL32 ref: 00007FF758977A6A

MessageBoxW.USER32 ref: 00007FF75897272C
MessageBoxA.USER32 ref: 00007FF758972748

Strings

%s%s: %s, xrefs: 00007FF7589726AD
Fatal error detected, xrefs: 00007FF758972700, 00007FF75897273A

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction ID: 736f62e9c5a77d2fbf01fd9bf0912caa28b02a0245bcc22253b1274b95ce9fd4
Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction Fuzzy Hash: EA31727272868292E620BB10E4517EAF3A4FB85785FC44036E68D47A99DF3CD305CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589888E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF758988905
GetProcAddress.KERNEL32 ref: 00007FF75898891B
FreeLibrary.KERNEL32 ref: 00007FF758988942

Strings

mscoree.dll, xrefs: 00007FF7589888FC
CorExitProcess, xrefs: 00007FF758988914

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction ID: 938ee9ce267704cd1f3b8afe0875a3d5d0ee46a89e7b29596b651101162113d1
Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction Fuzzy Hash: 64F0AF61B09A0282FA10AB20A446379F364EF857A2FCC0239C56E056F4CF2CD448C729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589987A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7589987CC
_set_statfp.LIBCMT ref: 00007FF7589987E7
_set_statfp.LIBCMT ref: 00007FF758998803
_set_statfp.LIBCMT ref: 00007FF75899883F

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 053e45dd4c7535258d3a24b2af6559379ec8e241a2f0e87b48946097acb52b41
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: D711BF22E28A0753F6943126E4433F5F4496F583E6F8D023CE97E266D6CF2CAC414178

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898A860 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF758989A73,?,?,00000000,00007FF758989D0E,?,?,?,?,?,00007FF7589821EC), ref: 00007FF75898A87F
FlsSetValue.KERNEL32(?,?,?,00007FF758989A73,?,?,00000000,00007FF758989D0E,?,?,?,?,?,00007FF7589821EC), ref: 00007FF75898A89E
FlsSetValue.KERNEL32(?,?,?,00007FF758989A73,?,?,00000000,00007FF758989D0E,?,?,?,?,?,00007FF7589821EC), ref: 00007FF75898A8C6
FlsSetValue.KERNEL32(?,?,?,00007FF758989A73,?,?,00000000,00007FF758989D0E,?,?,?,?,?,00007FF7589821EC), ref: 00007FF75898A8D7
FlsSetValue.KERNEL32(?,?,?,00007FF758989A73,?,?,00000000,00007FF758989D0E,?,?,?,?,?,00007FF7589821EC), ref: 00007FF75898A8E8

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
Instruction ID: deb9c7ce0f0c522350a7a02be61a0d163a109822d84075ab947e225eac3be284
Opcode Fuzzy Hash: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
Instruction Fuzzy Hash: 72114FA1F0C24343FA98B326A551179F1815F847A2F8C5334E97D476D6DF2CA4428E3A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898A6F4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F), ref: 00007FF75898A705
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F), ref: 00007FF75898A724
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F), ref: 00007FF75898A74C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F), ref: 00007FF75898A75D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF758992433,?,?,?,00007FF75898CB8C,?,?,00000000,00007FF758983A5F), ref: 00007FF75898A76E

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
Instruction ID: 501ccf8ae8168493b17694d372f463ba57fe2a2cc42b67fa0596431c89f5dc62
Opcode Fuzzy Hash: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
Instruction Fuzzy Hash: 8E11ECA5F0D20347F958B6214862179F2D24F85776F9C1738D87E0A2D2DF2CB4419A3B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898F198 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75898F477

Part of subcall function 00007FF758995474: _invalid_parameter_noinfo.LIBCMT ref: 00007FF758995491

Strings

UTF-16LEUNICODE, xrefs: 00007FF75898F415
ccs, xrefs: 00007FF75898F3B2
UTF-8, xrefs: 00007FF75898F3F6

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction ID: f62e41b19ecb543c6ed02b9bf2c7a294f53c6aae1d85c06be7bdeb547101f024
Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction Fuzzy Hash: 9D81C6B2E0C60387F7647F35C104278F690AB15B8AFDDA036CA0997697DF2DE5019B29

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897E108 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF75897E154
_CallSETranslator.LIBVCRUNTIME ref: 00007FF75897E1A3

Strings

MOC, xrefs: 00007FF75897E168
RCC, xrefs: 00007FF75897E171

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction ID: ffb9d0b4d26ef3a823909442667536777ffe1ec704aacbcff37c5afad1e6cd26
Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction Fuzzy Hash: A3618C33A08B458AE714EF65D4803ADB7A0FB45B89F584229EF8D57B98DF38E045C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897E464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF75897E48C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF75897E574

Strings

csm, xrefs: 00007FF75897E5C6
csm, xrefs: 00007FF75897E4AE

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction ID: 2da09213148910dd468ecd7e4f2abc6b9a3989723cc3a0c392db50e2983d74cb
Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction Fuzzy Hash: 4351827250868287EB78AF15954426CF7A0EB56F8AF9C4139EA8C87B95CF3CF450C718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7589724D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF758977A30: MultiByteToWideChar.KERNEL32 ref: 00007FF758977A6A

MessageBoxW.USER32 ref: 00007FF7589725D7
MessageBoxA.USER32 ref: 00007FF7589725F3

Strings

%s%s: %s, xrefs: 00007FF758972558
Fatal error detected, xrefs: 00007FF7589725AB, 00007FF7589725E5

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction ID: be21f39d65bd8bea91d5d710889e6cfaa0a6973a9f9d2d1aefb1d1052125bcc6
Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction Fuzzy Hash: FC31417262868292E620BB11E4517EAF3A4FFC5785FC44036EA8D47A99DF3CD305CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758973BA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF758973699), ref: 00007FF758973BD1

Part of subcall function 00007FF758972620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF758977744,?,?,?,?,?,?,?,?,?,?,?,00007FF75897101D), ref: 00007FF758972654
Part of subcall function 00007FF758972620: MessageBoxW.USER32 ref: 00007FF75897272C

Strings

GetModuleFileNameW, xrefs: 00007FF758973BE2
Failed to convert executable path to UTF-8., xrefs: 00007FF758973C0A
Failed to get executable path., xrefs: 00007FF758973BDB

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction ID: 197b111669277d7532543e301a6d6c7c82cd406eb9cf12270dd6dd1b54f482b8
Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction Fuzzy Hash: 2E018461B1D64282FA21B724D8453B9F2D5EF59387FCC0032D94EC6682EF5CE1449729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898BA70 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF75898BAEF
WriteFile.KERNEL32 ref: 00007FF75898BDB7
WriteFile.KERNEL32 ref: 00007FF75898BDFD
GetLastError.KERNEL32 ref: 00007FF75898BEB3

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction ID: 14d47bd42d42bc4b7a2337c56c85b4efe5456892545ee66a77afc44b2cec97f1
Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction Fuzzy Hash: 36D1F4B2B18A828AF710DF65C4401ACB7A1FB45799B884135CE4E97B9ADF38D017CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758971F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF758971FA4
SetWindowLongPtrW.USER32 ref: 00007FF758971FC6
GetWindowLongPtrW.USER32 ref: 00007FF758971FF0
InvalidateRect.USER32 ref: 00007FF758972010

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 4959be2b74aa9cc7d7915e962b2ac3716c7e0fd230bc9a5e06631a5886f83000
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: 3911A921F1814243F654B769E5452B9F296EF8AB81FDC4131EA4E46B9DCF2CD4C58218

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758994D3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7589908A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7589908D3

_get_daylight.LIBCMT ref: 00007FF758994E54
_get_daylight.LIBCMT ref: 00007FF758994E65

Strings

?, xrefs: 00007FF758994DE5

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction ID: 9bed7952697ddb3abfa65ea1a03e2f5fcae86fcab183c1f1e2d19bf59544b135
Opcode Fuzzy Hash: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction Fuzzy Hash: F8412852A0828247FB65AB25940137AF6A8EF80BA6F9C4235EF5D07ED5DF3CD4818718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758987E6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF758987E9E

Part of subcall function 00007FF758989E18: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF758991E42,?,?,?,00007FF758991E7F,?,?,00000000,00007FF758992345,?,?,?,00007FF758992277), ref: 00007FF758989E2E
Part of subcall function 00007FF758989E18: GetLastError.KERNEL32(?,?,?,00007FF758991E42,?,?,?,00007FF758991E7F,?,?,00000000,00007FF758992345,?,?,?,00007FF758992277), ref: 00007FF758989E38

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF75897B105), ref: 00007FF758987EBC

Strings

C:\AccountChanger\AccountChanger.exe, xrefs: 00007FF758987EAA

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\AccountChanger\AccountChanger.exe
API String ID: 2553983749-2408414432
Opcode ID: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction ID: 4210499361e1372063c8ccd952056b6200f8bb832639d39f72db77671b5c7ed2
Opcode Fuzzy Hash: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction Fuzzy Hash: 1B419076A08B4397FB14EF2694800B8F794EF44786B984035E90E53B96DF3CE8518768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898C108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF75898C21F
GetLastError.KERNEL32 ref: 00007FF75898C241

Strings

U, xrefs: 00007FF75898C1CB

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction ID: 5095e3eabe8e5aa8338c2e3322fd2badf4c95e0e72418f5b24ea622f616728d0
Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction Fuzzy Hash: 5641B462718A4296EB60EF25E4443A9F7A1FB88795F844031EE4D87798DF3CD441CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898E508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF75898E548
GetCurrentDirectoryW.KERNEL32 ref: 00007FF75898E59A

Strings

:, xrefs: 00007FF75898E55E

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
Instruction ID: d507904ece24e68695866ab8aaa2ec60b83c31ac419d6fa16cf728d6df48a9d3
Opcode Fuzzy Hash: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
Instruction Fuzzy Hash: 9E21D5E2B0864283FB20AB11D45427DF3E1FB84B45FC94039DA8D43684DF7CD9458B65

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758972770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF758977A30: MultiByteToWideChar.KERNEL32 ref: 00007FF758977A6A

MessageBoxW.USER32 ref: 00007FF758972841
MessageBoxA.USER32 ref: 00007FF75897285D

Strings

Fatal error detected, xrefs: 00007FF758972815, 00007FF75897284F

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction ID: 46834e2ac2514c011c1917eb23f92023202ef181d0f92c3a77dc86664312f158
Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction Fuzzy Hash: E321C47272868292FB20AB50F4517EAF394FB85789FC40035EA8D47A95CF3CD205CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF758972880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF758977A30: MultiByteToWideChar.KERNEL32 ref: 00007FF758977A6A

MessageBoxW.USER32 ref: 00007FF758972951
MessageBoxA.USER32 ref: 00007FF75897296D

Strings

Error detected, xrefs: 00007FF758972925, 00007FF75897295F

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction ID: 28a71a5ab89c6399406d6e949c1ad1797806737c74910f850030d00e2fcad71e
Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction Fuzzy Hash: 3121B27272868292EB20AB11F4517EAF394FBC5789FC40035EA8D47A94CF3CD205CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75897EFB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF75897EFF4
RaiseException.KERNEL32 ref: 00007FF75897F03A

Strings

csm, xrefs: 00007FF75897F027

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction ID: 6f9980c2b7257a8cf7e8f328944b40d377c5844a5c0473d877936d3cd4d4c8dc
Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction Fuzzy Hash: DF112832608B8182EB219F15E44026DF7A4FB89B95F5C4234EE8D07B68DF3DD9518B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75898F00C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75898F03C
GetDriveTypeW.KERNEL32 ref: 00007FF75898F07C

Strings

:, xrefs: 00007FF75898F065

Memory Dump Source

Source File: 00000004.00000002.3282819298.00007FF758971000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF758970000, based on PE: true

Associated: 00000004.00000002.3282766762.00007FF758970000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282875713.00007FF75899A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589AD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282917782.00007FF7589BC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589BE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589C4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.3282982574.00007FF7589CB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff758970000_AccountChanger.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction ID: 1a56cabe0c20af02ff88a7f1c4349263c160d624bfc95b95e887338977be9187
Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction Fuzzy Hash: F30184A1A186038BFB21BF60945127EF3E0EF5470AFC82035D54E46692DF2CD544DE2D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AccountChanger.exePID: 1776, Parent PID: 1292COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1295
Total number of Limit Nodes:	80

Executed Functions

Function 00007FF8A8528570 Relevance: 56.4, APIs: 9, Strings: 23, Instructions: 375
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8A8528A77
LoadIconW.USER32 ref: 00007FF8A8528B08
LoadIconW.USER32 ref: 00007FF8A8528B19
LoadCursorW.USER32 ref: 00007FF8A8528B2A
RegisterClassExW.USER32 ref: 00007FF8A8528B51
CreateWindowExW.USER32 ref: 00007FF8A8528BA0
SetWindowLongPtrW.USER32 ref: 00007FF8A8528BB4
ShowWindow.USER32 ref: 00007FF8A8528BBF
UpdateWindow.USER32 ref: 00007FF8A8528BC8

Strings

leftarrow, xrefs: 00007FF8A8528967
default, xrefs: 00007FF8A852869F
8.6.12, xrefs: 00007FF8A8528C3B
style, xrefs: 00007FF8A8528723
arrow, xrefs: 00007FF8A85289A7
ttk::theme::classic, xrefs: 00007FF8A8528A54
uparrow, xrefs: 00007FF8A852891D
highlight, xrefs: 00007FF8A85288D7
::ttk, xrefs: 00007FF8A8528707
text, xrefs: 00007FF8A85287D9
::ttk::style, xrefs: 00007FF8A85286F0
image, xrefs: 00007FF8A85287FE, 00007FF8A852886D
vsash, xrefs: 00007FF8A85289F4
Ttk, xrefs: 00007FF8A852867E, 00007FF8A8528744, 00007FF8A85287BA, 00007FF8A8528835, 00007FF8A8528BD5, 00007FF8A8528C45
rightarrow, xrefs: 00007FF8A852898C
downarrow, xrefs: 00007FF8A8528942
8.6, xrefs: 00007FF8A8528A4A
P, xrefs: 00007FF8A8528AE3
classic, xrefs: 00007FF8A85288B0
from, xrefs: 00007FF8A852877B
label, xrefs: 00007FF8A852881C
Button.border, xrefs: 00007FF8A85288F5
hsash, xrefs: 00007FF8A85289CF

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Window$Load$Icon$ClassCreateCursorHandleLongModuleRegisterShowUpdate
String ID: 8.6$8.6.12$::ttk$::ttk::style$Button.border$P$Ttk$arrow$classic$default$downarrow$from$highlight$hsash$image$label$leftarrow$rightarrow$style$text$ttk::theme::classic$uparrow$vsash
API String ID: 3723784198-449331163
Opcode ID: 8f9ba403931917c369828b063368510c2b79a1c9ad4c486de7b4d73ff0a393d7
Instruction ID: eae6639b02450d0a2cf037a24940f267d0db08421a667b95c3ce5d66b30a9ee6
Opcode Fuzzy Hash: 8f9ba403931917c369828b063368510c2b79a1c9ad4c486de7b4d73ff0a393d7
Instruction Fuzzy Hash: 78125875A0AB86A2EB449F65EC542E933A1FB48BC4F804536DE4D07B24DF3CE255C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8451470 Relevance: 47.6, APIs: 25, Strings: 2, Instructions: 333
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32 ref: 00007FF8A84514B4
SendMessageW.USER32 ref: 00007FF8A84514CC
SendMessageW.USER32 ref: 00007FF8A84514E1
GetFocus.USER32 ref: 00007FF8A845ED86
GetForegroundWindow.USER32 ref: 00007FF8A845ED99
IsWindow.USER32 ref: 00007FF8A845EDDD
SetWindowLongPtrW.USER32 ref: 00007FF8A845F155

Strings

UpdateWrapper: Cannot find container window, xrefs: 00007FF8A845EDCF
UpdateWrapper: Container was destroyed, xrefs: 00007FF8A845EDF2

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MessageSendWindow$FocusForegroundLong
String ID: UpdateWrapper: Cannot find container window$UpdateWrapper: Container was destroyed
API String ID: 2937761121-1156326135
Opcode ID: a830734d66e8a03f67b06b52093139d917c7a051ba5b548bf01ce31193972660
Instruction ID: 6ad64965bb4e452b940957ac49264ed6b62f97ef493a35fdf996a6b6fdb31a3a
Opcode Fuzzy Hash: a830734d66e8a03f67b06b52093139d917c7a051ba5b548bf01ce31193972660
Instruction Fuzzy Hash: 64F18032A0AA8292EB689F52E8447AD73A0FB84BD4F445135CF5E07B94DF3CE855C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A85191F0 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateBitmap.GDI32 ref: 00007FF8A8519358
CreatePatternBrush.GDI32 ref: 00007FF8A8519365

Strings

focus, xrefs: 00007FF8A85192C3
ttk::theme::winnative, xrefs: 00007FF8A8519494
Scrollbar.trough, xrefs: 00007FF8A85193AF
alt, xrefs: 00007FF8A8519214
field, xrefs: 00007FF8A85192A6
Combobox.focus, xrefs: 00007FF8A85192E0
thumb, xrefs: 00007FF8A85192FD
Ttk, xrefs: 00007FF8A8519201, 00007FF8A8519378
border, xrefs: 00007FF8A851925F
client, xrefs: 00007FF8A85193E2
8.6, xrefs: 00007FF8A851948A
winnative, xrefs: 00007FF8A8519229
slider, xrefs: 00007FF8A851931A
Button.border, xrefs: 00007FF8A8519289

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Create$BitmapBrushPattern
String ID: 8.6$Button.border$Combobox.focus$Scrollbar.trough$Ttk$alt$border$client$field$focus$slider$thumb$ttk::theme::winnative$winnative
API String ID: 3280665104-2094136981
Opcode ID: b31de2be146e75256c0e82ad79fddffdc6f373d01e20bd9515acc9596ba2253f
Instruction ID: 4dd5c88c4db080a2ffc4a50c078ac767be64de36777f6da445f1e62f2f4dd4fc
Opcode Fuzzy Hash: b31de2be146e75256c0e82ad79fddffdc6f373d01e20bd9515acc9596ba2253f
Instruction Fuzzy Hash: A4718975A0AB86A1EB149BA1EC442AA77E0FB48BC4F804536DE8D07765DF3CE114D728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8464370 Relevance: 19.8, APIs: 13, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsIconic.USER32 ref: 00007FF8A84643A1
IsZoomed.USER32 ref: 00007FF8A84643B3
AdjustWindowRectEx.USER32 ref: 00007FF8A846441A
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8A845EEF7), ref: 00007FF8A846463E
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8A845EEF7), ref: 00007FF8A8464653
GetSystemMetrics.USER32 ref: 00007FF8A8464668
MoveWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8A845EEF7), ref: 00007FF8A8464698
GetWindowRect.USER32 ref: 00007FF8A84646A7
GetClientRect.USER32 ref: 00007FF8A84646C9
MoveWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8A845EEF7), ref: 00007FF8A846470E
GetWindowRect.USER32 ref: 00007FF8A846471D
DrawMenuBar.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8A845EEF7), ref: 00007FF8A8464761

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Window$Rect$MessageMoveSend$AdjustClientDrawIconicMenuMetricsSystemZoomed
String ID:
API String ID: 722483491-0
Opcode ID: 5dc5ee2d82364ab45c3e1c4c4de4c407ddad4bd6f2bd69f41bdf99dfc362b757
Instruction ID: 714edc7e57cbb8d036957f495259df3f5f402e087173c78d9bf4063fef11a05c
Opcode Fuzzy Hash: 5dc5ee2d82364ab45c3e1c4c4de4c407ddad4bd6f2bd69f41bdf99dfc362b757
Instruction Fuzzy Hash: 72C1BF77A06682CAEB50CF28D4447ADB7A1FB84B88F194135DF495BB58DF38E840CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8455380 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SelectObject.GDI32 ref: 00007FF8A84553D2
GetFontData.GDI32 ref: 00007FF8A8455427
GetFontData.GDI32 ref: 00007FF8A845548A
GetFontData.GDI32 ref: 00007FF8A845554F
GetFontData.GDI32 ref: 00007FF8A84555F2
GetFontData.GDI32 ref: 00007FF8A845560F
GetTextCharset.GDI32 ref: 00007FF8A845570D
SelectObject.GDI32 ref: 00007FF8A8455751

Strings

cmap, xrefs: 00007FF8A8455406
pamc, xrefs: 00007FF8A84553FA

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: DataFont$ObjectSelect$CharsetText
String ID: cmap$pamc
API String ID: 447340330-4234804082
Opcode ID: d7069899b4642d3f946385019c9b1d51062a8bcd732f78c2b2a4bb11805ece17
Instruction ID: 77b2a65e5efdbf418760d1b4f75f1954f2e90b52973a2e02e7677e9886cff4ab
Opcode Fuzzy Hash: d7069899b4642d3f946385019c9b1d51062a8bcd732f78c2b2a4bb11805ece17
Instruction Fuzzy Hash: 01B13472A1E2A187D7588F16E40027EB7E1FB94B81F415032EE8987B98DB7DD845CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8452020 Relevance: 63.2, APIs: 27, Strings: 9, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF8A845206D
SystemParametersInfoW.USER32 ref: 00007FF8A8452089
CreateFontIndirectW.GDI32 ref: 00007FF8A845209E
DeleteObject.GDI32 ref: 00007FF8A84520BF
CreateFontIndirectW.GDI32 ref: 00007FF8A84520CC
DeleteObject.GDI32 ref: 00007FF8A84520ED
CreateFontIndirectW.GDI32 ref: 00007FF8A84520FA
DeleteObject.GDI32 ref: 00007FF8A845211B
CreateFontIndirectW.GDI32 ref: 00007FF8A8452128
DeleteObject.GDI32 ref: 00007FF8A8452149
CreateFontIndirectW.GDI32 ref: 00007FF8A8452156
DeleteObject.GDI32 ref: 00007FF8A8452177
CreateFontIndirectW.GDI32 ref: 00007FF8A8452181
DeleteObject.GDI32 ref: 00007FF8A84521A2
CreateFontIndirectW.GDI32 ref: 00007FF8A84521AC
DeleteObject.GDI32 ref: 00007FF8A84521CD
SystemParametersInfoW.USER32 ref: 00007FF8A84521E8
CreateFontIndirectW.GDI32 ref: 00007FF8A84521F6
DeleteObject.GDI32 ref: 00007FF8A8452217
GetDC.USER32 ref: 00007FF8A845225C
GetDeviceCaps.GDI32 ref: 00007FF8A845226D
MulDiv.KERNEL32 ref: 00007FF8A8452283
MulDiv.KERNEL32 ref: 00007FF8A8452296
ReleaseDC.USER32 ref: 00007FF8A84522A7
CreateFontIndirectW.GDI32 ref: 00007FF8A84522B2
DeleteObject.GDI32 ref: 00007FF8A84522D3
GetStockObject.GDI32 ref: 00007FF8A84522F3

Strings

TkSmallCaptionFont, xrefs: 00007FF8A84521B2
TkTooltipFont, xrefs: 00007FF8A845215C
TkTextFont, xrefs: 00007FF8A8452100
TkFixedFont, xrefs: 00007FF8A84522B8
TkMenuFont, xrefs: 00007FF8A845212E
TkHeadingFont, xrefs: 00007FF8A84520D2
TkIconFont, xrefs: 00007FF8A84521FC
TkDefaultFont, xrefs: 00007FF8A84520A4
TkCaptionFont, xrefs: 00007FF8A8452187

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Object$CreateDeleteFontIndirect$InfoParametersSystem$CapsDeviceReleaseStockmemset
String ID: TkCaptionFont$TkDefaultFont$TkFixedFont$TkHeadingFont$TkIconFont$TkMenuFont$TkSmallCaptionFont$TkTextFont$TkTooltipFont
API String ID: 3615235001-2508811397
Opcode ID: c1a13152ffc53438591685186ff9e8c3d61c07655ef8a1d46dd18468c0637432
Instruction ID: bc86241c680d3700d4a02f81387d67c2364530f8f633451776429597f78f0f52
Opcode Fuzzy Hash: c1a13152ffc53438591685186ff9e8c3d61c07655ef8a1d46dd18468c0637432
Instruction Fuzzy Hash: 8D817A32E8AA43AAEB149B62EC142E92361FB48FC8F405032DD4E57765DF3CE549C758

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84A894D Relevance: 36.3, APIs: 6, Strings: 18, Instructions: 335
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84A89A4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84A89E7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84A8A29
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84A8A68

Strings

-class, xrefs: 00007FF8A84A899A
CONTAINMENT, xrefs: 00007FF8A84A8ED5
-screen, xrefs: 00007FF8A84A8A1F
windows cannot have both the -use and the -container option set, xrefs: 00007FF8A84A8EB5
visual, xrefs: 00007FF8A84A8C4E
Colormap, xrefs: 00007FF8A84A8C62
FRAME, xrefs: 00007FF8A84A8EDC
Visual, xrefs: 00007FF8A84A8C44
Class, xrefs: 00007FF8A84A8BB4
-visual, xrefs: 00007FF8A84A8A97
-use, xrefs: 00007FF8A84A8A5E
colormap, xrefs: 00007FF8A84A8C6C
class, xrefs: 00007FF8A84A8BBE
"6, xrefs: 00007FF8A84A8BE9
Use, xrefs: 00007FF8A84A8BFF
use, xrefs: 00007FF8A84A8C09
-colormap, xrefs: 00007FF8A84A89DD
v, xrefs: 00007FF8A84A8A8E

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: strncmp
String ID: -class$-colormap$-screen$-use$-visual$CONTAINMENT$Class$Colormap$FRAME$Use$Visual$class$colormap$use$v$visual$windows cannot have both the -use and the -container option set$"6
API String ID: 1114863663-646938501
Opcode ID: f7413b5202df08c6a529bb41f8151afdd6ac3aac6e59a64dd44c62e999cebe4e
Instruction ID: 1b13ca307eff611e0109a147138e9a1a428bc83be27870861a63243cbd5affda
Opcode Fuzzy Hash: f7413b5202df08c6a529bb41f8151afdd6ac3aac6e59a64dd44c62e999cebe4e
Instruction Fuzzy Hash: 8DF15971A0BB86A5EB548B12E9403B9B7A1FB49BC4F084435CE4E4B795DF3CE424C768

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8462140 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 313
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84621C0
SHGetFileInfoW.SHELL32 ref: 00007FF8A846238C
SHGetFileInfoW.SHELL32 ref: 00007FF8A84623E0
DestroyIcon.USER32 ref: 00007FF8A846241D
DestroyIcon.USER32 ref: 00007FF8A846242B
memset.VCRUNTIME140 ref: 00007FF8A8462450
CreateIconIndirect.USER32 ref: 00007FF8A84625E3
DestroyIcon.USER32 ref: 00007FF8A846260B

Strings

window ?-default? ?image?, xrefs: 00007FF8A846268E
OPTION, xrefs: 00007FF8A84621EC
H, xrefs: 00007FF8A84623ED
-default, xrefs: 00007FF8A84621B6
Tk_SizeOfBitmap received unknown bitmap argument, xrefs: 00007FF8A84625AA
ICONBITMAP, xrefs: 00007FF8A84621FD
illegal option "%s" must be "-default", xrefs: 00007FF8A84621D0

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Icon$Destroy$FileInfo$CreateIndirectmemsetstrcmp
String ID: -default$H$ICONBITMAP$OPTION$Tk_SizeOfBitmap received unknown bitmap argument$illegal option "%s" must be "-default"$window ?-default? ?image?
API String ID: 1970194709-3871694194
Opcode ID: d4e7a1b5e1d081a1c90487fabab4b637c41dd435efa97fd269368cb93b1798a0
Instruction ID: f55378dd80e580433ffe594484714a9971c5409c7709d21cf143561f419713e5
Opcode Fuzzy Hash: d4e7a1b5e1d081a1c90487fabab4b637c41dd435efa97fd269368cb93b1798a0
Instruction Fuzzy Hash: 07E17F76A0AB86A6EB548F16E8543A9B3A1FB88FC4F084435CE4E07754EF7CE454C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A845DB90 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 269
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetClassLongPtrW.USER32 ref: 00007FF8A845DCBF
SetClassLongPtrW.USER32 ref: 00007FF8A845DD2A
SetClassLongPtrW.USER32 ref: 00007FF8A845DD84
SendMessageW.USER32 ref: 00007FF8A845DE73

Part of subcall function 00007FF8A845D9B0: GetModuleHandleW.KERNEL32 ref: 00007FF8A845DA57
Part of subcall function 00007FF8A845D9B0: GetModuleHandleW.KERNEL32 ref: 00007FF8A845DA8D
Part of subcall function 00007FF8A845D9B0: LoadIconW.USER32 ref: 00007FF8A845DAA4
Part of subcall function 00007FF8A845D9B0: LoadCursorW.USER32 ref: 00007FF8A845DB12
Part of subcall function 00007FF8A845D9B0: RegisterClassW.USER32 ref: 00007FF8A845DB22

SendMessageW.USER32 ref: 00007FF8A845DEE1
SendMessageW.USER32 ref: 00007FF8A845DF39

Strings

ICON, xrefs: 00007FF8A845DE2C
LOOKUP, xrefs: 00007FF8A845DC06
FAILED, xrefs: 00007FF8A845DCA4
Can't set icon; window has no wrapper., xrefs: 00007FF8A845DE02
window "%s" isn't a top-level window, xrefs: 00007FF8A845DBD7
TOPLEVEL, xrefs: 00007FF8A845DBF8
Unable to set icon, xrefs: 00007FF8A845DC86
WRAPPER, xrefs: 00007FF8A845DE20

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Class$LongMessageSend$HandleLoadModule$CursorIconRegister
String ID: Can't set icon; window has no wrapper.$FAILED$ICON$LOOKUP$TOPLEVEL$Unable to set icon$WRAPPER$window "%s" isn't a top-level window
API String ID: 3636279047-342970489
Opcode ID: a2bafaad1a0e91a4ff663574851f97a4f874177a5870845699ef4c085061d73b
Instruction ID: a4f7f5598cf20710e419ce8b72078afea84b233f42d43e6c2788d07e30123acc
Opcode Fuzzy Hash: a2bafaad1a0e91a4ff663574851f97a4f874177a5870845699ef4c085061d73b
Instruction Fuzzy Hash: F4B16C22A0BE46A1EA699B51E8447BD2BA1FF45BC4F046132DE0E47795CF3CE945C328

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A845E220 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-translation, xrefs: 00007FF8A845E2B9
error seeking in file: %s, xrefs: 00007FF8A845E742
binary, xrefs: 00007FF8A845E2AF, 00007FF8A845E2D4
error opening file "%s" for reading: %s, xrefs: 00007FF8A845E279
ICON, xrefs: 00007FF8A845E45C, 00007FF8A845E6F9
-encoding, xrefs: 00007FF8A845E2DE
FORMAT, xrefs: 00007FF8A845E6E8
error reading file: %s, xrefs: 00007FF8A845E427, 00007FF8A845E730
Error converting to internal format, xrefs: 00007FF8A845E6C3
Invalid file header, xrefs: 00007FF8A845E7CA
READ, xrefs: 00007FF8A845E44E

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID:
String ID: -encoding$-translation$Error converting to internal format$FORMAT$ICON$Invalid file header$READ$binary$error opening file "%s" for reading: %s$error reading file: %s$error seeking in file: %s
API String ID: 0-1482656021
Opcode ID: 371e343402f841fe62214fdaeb89f45ebee375b445223cedba42b878f4efc454
Instruction ID: 19f6649dcf179b51cc58151c7d6858c2bd9cd9b0e838429fd868d7f7f15f4c02
Opcode Fuzzy Hash: 371e343402f841fe62214fdaeb89f45ebee375b445223cedba42b878f4efc454
Instruction Fuzzy Hash: 8DF1C176A0AA4692EB549F2AE84457D33A1FB84FC0F448532CE5E473A4DF7DE844C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8453AE0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 00007FF8A8453B2B
SelectObject.GDI32 ref: 00007FF8A8453B3A
GetTextMetricsW.GDI32 ref: 00007FF8A8453B4E
GetTextFaceW.GDI32 ref: 00007FF8A8453B64
GetCharWidthW.GDI32 ref: 00007FF8A8453D35
GetCharWidthA.GDI32 ref: 00007FF8A8453D3D
SelectObject.GDI32 ref: 00007FF8A8453D5B
ReleaseDC.USER32 ref: 00007FF8A8453D67

Strings

unicode, xrefs: 00007FF8A8453D0A
utf-16, xrefs: 00007FF8A8453CE8

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: CharObjectSelectTextWidth$FaceMetricsRelease
String ID: unicode$utf-16
API String ID: 1149465119-3317161374
Opcode ID: 6c62d7fe5fb31ee48c4a0bf02e1ed4bb9f6750a33350b10a183d9f8d52f1a927
Instruction ID: be024ce0fa470ec91168273cd9acedf0a21bfba329c96d4918434d7672a0fdbc
Opcode Fuzzy Hash: 6c62d7fe5fb31ee48c4a0bf02e1ed4bb9f6750a33350b10a183d9f8d52f1a927
Instruction Fuzzy Hash: 82719E72A0AB86A6DB25CF26E8402AE77A1FB48BC4F044232DE4D47754EF3CD445C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8465D50 Relevance: 13.7, APIs: 9, Instructions: 245windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF8A8465DB4
DefWindowProcW.USER32 ref: 00007FF8A846742D
DefWindowProcW.USER32 ref: 00007FF8A8467453
ImmGetContext.IMM32 ref: 00007FF8A8467489
ImmGetCompositionStringW.IMM32 ref: 00007FF8A84674A9
ImmGetCompositionStringW.IMM32 ref: 00007FF8A84674D7
GetTickCount.KERNEL32 ref: 00007FF8A8467569
ImmReleaseContext.IMM32 ref: 00007FF8A84675E2

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: CompositionContextProcStringWindow$CountMessageReleaseSendTick
String ID:
API String ID: 4008441895-0
Opcode ID: ff085adabb561743047a4ef4701becfe351342b6efb8f6f8758746e34f8ec804
Instruction ID: 4d64d9dd5547f98c3b63411227ccae353278d27212dddb4f0ad0276aca18c396
Opcode Fuzzy Hash: ff085adabb561743047a4ef4701becfe351342b6efb8f6f8758746e34f8ec804
Instruction Fuzzy Hash: D8A1A032F0BB4296E750CB6AD8446BD23A2FB88BD4F144235DE4D83B95DF38E4518728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A845D9B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 112registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8A845DA57
GetModuleHandleW.KERNEL32 ref: 00007FF8A845DA8D
LoadIconW.USER32 ref: 00007FF8A845DAA4
LoadCursorW.USER32 ref: 00007FF8A845DB12
RegisterClassW.USER32 ref: 00007FF8A845DB22

Strings

TkTopLevel, xrefs: 00007FF8A845DA69
Unable to register TkTopLevel class, xrefs: 00007FF8A845DB34

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: HandleLoadModule$ClassCursorIconRegister
String ID: TkTopLevel$Unable to register TkTopLevel class
API String ID: 1220223050-2494010311
Opcode ID: c0923999ed4cc9b7338c188408aeeb62c0a2598192d10c4c95110e9482fa82c4
Instruction ID: 28bb1da0e76d4dd01cece43c0b9a37cdb04ca420283b73a5ebcd99db973569b8
Opcode Fuzzy Hash: c0923999ed4cc9b7338c188408aeeb62c0a2598192d10c4c95110e9482fa82c4
Instruction Fuzzy Hash: E5513531E4AF46A2EB588B11E84026A37A5FF94BC4F545536CA8E03B54DF7CE881C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A845FE13 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 71COMMON

Download Yara Rule

Strings

COMMUNICATION, xrefs: 00007FF8A845FEEE
can't deiconify %s: the container does not support the request, xrefs: 00007FF8A845FED1
ICON, xrefs: 00007FF8A845FE6C
DEICONIFY, xrefs: 00007FF8A845FE65
can't deiconify %s: it is an icon for %s, xrefs: 00007FF8A845FE49
window, xrefs: 00007FF8A845FE1F

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID:
String ID: COMMUNICATION$DEICONIFY$ICON$can't deiconify %s: it is an icon for %s$can't deiconify %s: the container does not support the request$window
API String ID: 0-2110834912
Opcode ID: dfd80bf3ae312700e6ccb0616fe672bfd4e3aa7d24cf606ba49cdb1acadf0053
Instruction ID: a40c0707fd6df6932df279d7d15866aa13bba768c9f510a7cc33ffb6f1dd97b3
Opcode Fuzzy Hash: dfd80bf3ae312700e6ccb0616fe672bfd4e3aa7d24cf606ba49cdb1acadf0053
Instruction Fuzzy Hash: 52315C22E0AE47A1EB548FA1ED542BA2360FB48BC8F445432CE0E07760DF3CE546C329

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8485C10 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

GC already registered in Tk_GetGC, xrefs: 00007FF8A8486059
called GCInit after GCCleanup, xrefs: 00007FF8A8485E3A

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID:
String ID: GC already registered in Tk_GetGC$called GCInit after GCCleanup
API String ID: 0-2292843906
Opcode ID: 0deb52e485abdda52e19bb4cbe4988028832129d9b520bc6c9c8bfd8f43b202f
Instruction ID: 4ae30a9dd6e5b71dcdf4a1cfa901e1cfd3a850e856581fd05f4e5e88299b5680
Opcode Fuzzy Hash: 0deb52e485abdda52e19bb4cbe4988028832129d9b520bc6c9c8bfd8f43b202f
Instruction Fuzzy Hash: A7027772A06B859AEB50CF24E8447A973B5FB48BC8F154136CE5D4BB54EF38E490CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84653C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF8A8465410
IsWindowVisible.USER32 ref: 00007FF8A8465435
GetWindowPlacement.USER32 ref: 00007FF8A8465454
GetClientRect.USER32 ref: 00007FF8A84654C9
MoveWindow.USER32 ref: 00007FF8A846551F

Strings

,, xrefs: 00007FF8A8465443

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Window$ClientLongMovePlacementRectVisible
String ID: ,
API String ID: 2284278383-3772416878
Opcode ID: fec93ba8e8cb3e46e73ddd7a2b334128f749a3711153143432947e657c33fd0b
Instruction ID: 72604bbc150bcf49603871ba7ec8bc188956eed24a310ecc12725edfa2dc2165
Opcode Fuzzy Hash: fec93ba8e8cb3e46e73ddd7a2b334128f749a3711153143432947e657c33fd0b
Instruction Fuzzy Hash: A0A13772A0A682ABE768CF38C544B6C77A1FB48B94F014135DB5D87758CF38E860CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8453F80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FF8A8453FD3
GetTextFaceW.GDI32 ref: 00007FF8A8453FEC
SelectObject.GDI32 ref: 00007FF8A845405C
memset.VCRUNTIME140 ref: 00007FF8A845409F

Strings

unicode, xrefs: 00007FF8A8454158
utf-16, xrefs: 00007FF8A8454133

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: ObjectSelect$FaceTextmemset
String ID: unicode$utf-16
API String ID: 920176757-3317161374
Opcode ID: 0ef7dd9b9b51d631bdd2aeaee7c11b4b5063e5093dfbb883ad80748d58dbe8de
Instruction ID: b12cd835f6221ca04f2774613c048997ed252459fb4326256ac83ad657a04d8f
Opcode Fuzzy Hash: 0ef7dd9b9b51d631bdd2aeaee7c11b4b5063e5093dfbb883ad80748d58dbe8de
Instruction Fuzzy Hash: BA517B72A4AF46A1EB588B12ED443AA73A1FB48BD0F045536CE5D4BB94EF7CE460C314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8460D46 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 64windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF8A8460DB2

Strings

WITHDRAW, xrefs: 00007FF8A8460D90
can't withdraw %s: the container does not support the request, xrefs: 00007FF8A8460DD5
window, xrefs: 00007FF8A845FE1F
can't withdraw %s: it is an icon for %s, xrefs: 00007FF8A8460D74

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MessageSend
String ID: WITHDRAW$can't withdraw %s: it is an icon for %s$can't withdraw %s: the container does not support the request$window
API String ID: 3850602802-424501824
Opcode ID: 79a46f53ba4360cf16e6e2b74b14b2f4ba767769c70bf59951814a704449ab67
Instruction ID: b379cd148ca60a2331de9d0100eabf2da091ee38891826fb66d5226a6a4a1f41
Opcode Fuzzy Hash: 79a46f53ba4360cf16e6e2b74b14b2f4ba767769c70bf59951814a704449ab67
Instruction Fuzzy Hash: 95214F32E07A82E2EB458F61E8546AE2760FB44BD9F440432CE0E5B754DF3CD545C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A848C9EF Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 185stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A848CA80

Strings

type coords ?arg ...?, xrefs: 00007FF8A848CA04
LOOKUP, xrefs: 00007FF8A848CB06
coords ?arg ...?, xrefs: 00007FF8A848CB47
unknown or ambiguous item type "%s", xrefs: 00007FF8A848CACC
CANVAS_ITEM_TYPE, xrefs: 00007FF8A848CAFA

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: strncmp
String ID: CANVAS_ITEM_TYPE$LOOKUP$coords ?arg ...?$type coords ?arg ...?$unknown or ambiguous item type "%s"
API String ID: 1114863663-1447066070
Opcode ID: 0cda0bfedab92142da0f90a7e60c2344bed200ace4742f9410701e5b37c69d26
Instruction ID: d586f028639652d52bdaaa9b68e326b0b540bfe278893aedb4b16f50c0e35b0e
Opcode Fuzzy Hash: 0cda0bfedab92142da0f90a7e60c2344bed200ace4742f9410701e5b37c69d26
Instruction Fuzzy Hash: 5A916A36A0AF86A2EB50DB65E8442AE77A4FB48BD4F050536CE5E07760DF3CE454C328

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84A4200 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

GetStockObject.GDI32 ref: 00007FF8A84A443D

Strings

INTERNAL_PROBLEM, xrefs: 00007FF8A84A4541
failed to allocate font due to internal system font engine problem, xrefs: 00007FF8A84A451C
ansifixed, xrefs: 00007FF8A84A43D4
FONT, xrefs: 00007FF8A84A4548

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: ObjectStock
String ID: FONT$INTERNAL_PROBLEM$ansifixed$failed to allocate font due to internal system font engine problem
API String ID: 3428563643-2695973982
Opcode ID: e6095de84f3b5cac40ee9deedb42eb35ec5baf23f33c08243b597f8fc63043b6
Instruction ID: a01244db7358b603a2194bbb429394a00e1aede6a37b64895161154d6366833d
Opcode Fuzzy Hash: e6095de84f3b5cac40ee9deedb42eb35ec5baf23f33c08243b597f8fc63043b6
Instruction Fuzzy Hash: 1CD18B76A0AB46A6EB64CF26E94066DB7A4FB48BC4F048536CE4E47B50DF3CE450C718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8463A50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF8A8463ADE
GetWindowTextW.USER32 ref: 00007FF8A8463B0B

Strings

window ?newTitle?, xrefs: 00007FF8A8463A96

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MessageSendTextWindow
String ID: window ?newTitle?
API String ID: 893732450-417226443
Opcode ID: da97f23dc6ecb1b594dc001403435b6db0cbe47546771a0e3350356de93d9f36
Instruction ID: 08707aec080a4609c811afeac61efc60c31a81c486a3720608b4ec231fc840b0
Opcode Fuzzy Hash: da97f23dc6ecb1b594dc001403435b6db0cbe47546771a0e3350356de93d9f36
Instruction Fuzzy Hash: 0B518F32B1AAC5A2EB548B16E8543BA33A0FB88FE4F040632DE6E07794DF7CD5558714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8517E70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF8A8517EA4
GetSysColor.USER32 ref: 00007FF8A8517F53
DefWindowProcW.USER32 ref: 00007FF8A851803C

Strings

Ttk, xrefs: 00007FF8A8517EC5, 00007FF8A8517EFD
#%04X%04X%04X, xrefs: 00007FF8A8517F8F

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Window$ColorLongProc
String ID: #%04X%04X%04X$Ttk
API String ID: 3223664542-2938447076
Opcode ID: 693c34e29bc11cfb49a8e3cda0b5ae87dfb013d3ad0891fccf0242aefbe6574b
Instruction ID: 8c822889b798699a9b250dbe6dce3e124715efaaa911504ac43ce088ff4db515
Opcode Fuzzy Hash: 693c34e29bc11cfb49a8e3cda0b5ae87dfb013d3ad0891fccf0242aefbe6574b
Instruction Fuzzy Hash: B141CE36A0AB5692E7509F15E80077AB7A1FB84BC4F404436EE8D077A8DF3DE458CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8453DA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF8A8453DEC
DeleteObject.GDI32 ref: 00007FF8A8453DFC

Strings

unicode, xrefs: 00007FF8A8453ECD
utf-16, xrefs: 00007FF8A8453EAB

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: DeleteObject
String ID: unicode$utf-16
API String ID: 1531683806-3317161374
Opcode ID: c60797b1542d4fd6972a4b2a454828e70e554c962c1ccce3523fcd8e462a9309
Instruction ID: a79098488a57d8fcda1944961fd60f9087b01e5bcf11594ff2f4e6468cb58dcd
Opcode Fuzzy Hash: c60797b1542d4fd6972a4b2a454828e70e554c962c1ccce3523fcd8e462a9309
Instruction Fuzzy Hash: D5512636A0BF46A2EA488B16D94426D77A1FB88FC0F455836CE5E07760DF7DE860C314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A845BFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32(?,?,?,00007FF8A84A2ABE), ref: 00007FF8A845BFE4
SetForegroundWindow.USER32(?,?,?,00007FF8A84A2ABE), ref: 00007FF8A845C067
SetFocus.USER32(?,?,?,00007FF8A84A2ABE), ref: 00007FF8A845C083

Strings

ChangeXFocus got null X window, xrefs: 00007FF8A845C041

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Focus$ForegroundWindow
String ID: ChangeXFocus got null X window
API String ID: 332191172-2759626269
Opcode ID: f71b1e17d0a1c7054ca5a51a3d613f9a3fffcf2401f1bd7ddc1e0f69ff52be33
Instruction ID: 705d7865a1635c210f7945556904c037be69526aec71e9e3e60a9231f0662b81
Opcode Fuzzy Hash: f71b1e17d0a1c7054ca5a51a3d613f9a3fffcf2401f1bd7ddc1e0f69ff52be33
Instruction Fuzzy Hash: 23312B36A0AA81D5EB54CF56E48026D63B0FB88FC4F189132DE4E43755DF39D882C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A845D0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF8A8516191), ref: 00007FF8A845D105
CreateWindowExW.USER32 ref: 00007FF8A845D153
SetWindowPos.USER32 ref: 00007FF8A845D177

Strings

TkChild, xrefs: 00007FF8A845D117

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: Window$CreateHandleModule
String ID: TkChild
API String ID: 1084761317-227893619
Opcode ID: 7a62c55992fbcbf6ed3e4b251bfeaaffb2160c89fa5d2e0555a0a13e8e40b345
Instruction ID: 3ed22aa965467fdfc8da776b97643c7ad6d32d493114928d333a36b2eb3e78d1
Opcode Fuzzy Hash: 7a62c55992fbcbf6ed3e4b251bfeaaffb2160c89fa5d2e0555a0a13e8e40b345
Instruction Fuzzy Hash: E021DB76A4AB818BE764CF25E94461AB7E1F748BD4F545135EF8943B24DF3CD4408B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8465E10 Relevance: 4.6, APIs: 3, Instructions: 126COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF8A8465EFD

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: de7c3142df15802711a77df211f90b19db5808617cda21bf7a862613cbf31ce6
Instruction ID: 8910dca1e4d002a942997fccd3118ef5808b1c7533ab97339fb5d1e90c9cfca4
Opcode Fuzzy Hash: de7c3142df15802711a77df211f90b19db5808617cda21bf7a862613cbf31ce6
Instruction Fuzzy Hash: 26517E36E0BA82A6E7608F65E8402B977A1FB88BD4F144535DE4D13B58CF7CE454C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84661A6 Relevance: 4.6, APIs: 3, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00007FF8A8466271
SendMessageW.USER32 ref: 00007FF8A8466292
DefWindowProcW.USER32 ref: 00007FF8A84662D9

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: FocusMessageProcSendWindow
String ID:
API String ID: 1049918876-0
Opcode ID: d9164bf8fc9927836ba4ef06716c2d5649523429fcf7e64b499289219d0004ec
Instruction ID: d9a4a83a4f1d63b3cef42e4189b44f36c4839eea27bdfc061fd0a347abea322b
Opcode Fuzzy Hash: d9164bf8fc9927836ba4ef06716c2d5649523429fcf7e64b499289219d0004ec
Instruction Fuzzy Hash: A8316D36A0BA42A5FB649F95D4402B863A1FF84BE4F140532DE4D03B94DF3DE895C368

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A848F240 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 254COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF8A848F561

Strings

, xrefs: 00007FF8A848F63C

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-3916222277
Opcode ID: c4c98e5017c430adff7865ce2fe8a515a642d3654d2466e64942ae288f729cad
Instruction ID: 99bb47259c538bb5752f98fdd1067c55b9a7242bff87fdaae32c2d0e4efac192
Opcode Fuzzy Hash: c4c98e5017c430adff7865ce2fe8a515a642d3654d2466e64942ae288f729cad
Instruction Fuzzy Hash: 4BC17D36A0AB819BD720CF29E54476EB7A0FB88B98F144136DF8957B58DF38E441CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84A2900 Relevance: 3.1, APIs: 2, Instructions: 136windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF8A84A2A3D
SendMessageW.USER32 ref: 00007FF8A84A2A51

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MessageParentSend
String ID:
API String ID: 928151917-0
Opcode ID: 0d11fa61fa1ba28113aa678631cae75faf8abb5e5f532d1a7b3b73f4af94d59e
Instruction ID: 92d98947c97db6f8a9793d930f96e8aba0c5dc3bb54d6c7ff89a987c4ceabe26
Opcode Fuzzy Hash: 0d11fa61fa1ba28113aa678631cae75faf8abb5e5f532d1a7b3b73f4af94d59e
Instruction Fuzzy Hash: 9951287260AB8292EB688F15E5403BAA3A1FB94BC4F048035CF8D5BB95DF3CE441D758

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84DBC70 Relevance: 2.7, APIs: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A84DBCD6
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84DBE26

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: strchrstrncpy
String ID:
API String ID: 3824778938-0
Opcode ID: 62b3fb103a1e519a1537019359e054589cb6381959dce622bf3db57402ce6b3f
Instruction ID: 95b4ea76b0054e4d5c7ef389c81b662eae4cabedc471f0f41fabdf07e7234ac2
Opcode Fuzzy Hash: 62b3fb103a1e519a1537019359e054589cb6381959dce622bf3db57402ce6b3f
Instruction Fuzzy Hash: C3818936B0BA86A6EB64CF1AD45066977A1FB88BC8F448435CF0E47795CF38E851CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84AFDC0 Relevance: 1.8, APIs: 1, Instructions: 284COMMON

Download Yara Rule

APIs

MoveWindow.USER32 ref: 00007FF8A84B0129

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MoveWindow
String ID:
API String ID: 2234453006-0
Opcode ID: b8ec697d234991d647997f328a99f84faf91738698819445265623955b33e407
Instruction ID: 2a792813831d57d6f720abdb8eb86cb56d5a575147d401ccfb6fca9df409e201
Opcode Fuzzy Hash: b8ec697d234991d647997f328a99f84faf91738698819445265623955b33e407
Instruction Fuzzy Hash: A0C1EB33A1A6459BDB64CF29D588A6E7BA0FB84BC4F018131DF4A47B54CF39E811CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A8516135 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49adc51c11fdc41956eb7846327f06f8c0b3de6bcaa303810f5715714d3548e0
Instruction ID: 4d80fcbb3f9d0ea59a93dd03f7e4e33d20aabc9118a56ddc1296c4e4ca7e1c89
Opcode Fuzzy Hash: 49adc51c11fdc41956eb7846327f06f8c0b3de6bcaa303810f5715714d3548e0
Instruction Fuzzy Hash: A0412872A4AA8291EB649F59D8507A967E1EF84FC8F08403ADF1D47396DF38D440C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A845D260 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF8A845D298

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: a816552e71fadee9afb63e3e519801a83d88db330619432cb018bf26502ad68b
Instruction ID: fdf5af562d12e2ec94872d5a068c9006225da94ec1d564c39bdfda36df015bcd
Opcode Fuzzy Hash: a816552e71fadee9afb63e3e519801a83d88db330619432cb018bf26502ad68b
Instruction Fuzzy Hash: 4E311D7261AA8196EB68CF15E4443AEB7E0FB88B88F045136DE8D47B59DF3CD844CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84E0B40 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

MoveWindow.USER32 ref: 00007FF8A84E0BCA

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MoveWindow
String ID:
API String ID: 2234453006-0
Opcode ID: f46dc3e5b92a7ab5c5a9b8aa5185552fb6b3b26ed0418699e5164a107ea437d4
Instruction ID: d2a6ded208c6c1faa046f5aaddd19b42b69b47c0f35d5763ab4d4b50a7c61db1
Opcode Fuzzy Hash: f46dc3e5b92a7ab5c5a9b8aa5185552fb6b3b26ed0418699e5164a107ea437d4
Instruction Fuzzy Hash: A1317032B1A68687EB658F39D4007BD7BE0FB54B88F044131DE9D43A59EF38E8818B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84E0B2F Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

MoveWindow.USER32 ref: 00007FF8A84E0BCA

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MoveWindow
String ID:
API String ID: 2234453006-0
Opcode ID: 91a6afffb4cf71b900fc08434ba299e53b42ea600529bb91ee9eb3b3a7a603bd
Instruction ID: dbc331af00f513d902a65abe1fee942a6999dfffcc50e8898f9bd92561859fe7
Opcode Fuzzy Hash: 91a6afffb4cf71b900fc08434ba299e53b42ea600529bb91ee9eb3b3a7a603bd
Instruction Fuzzy Hash: 45316432A1A68597DB658F39D5007BD7BA0FF54B88F044131DE5D03A59EF38E891CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84E0B22 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

MoveWindow.USER32 ref: 00007FF8A84E0BCA

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MoveWindow
String ID:
API String ID: 2234453006-0
Opcode ID: c968035ffc600094596b637508d909060dd0684104149f81eec53029c88659d4
Instruction ID: a08aa9570cb928ebf04ab00d63879828e784dbc5aa19fbbccd5c4bc82cdc8a33
Opcode Fuzzy Hash: c968035ffc600094596b637508d909060dd0684104149f81eec53029c88659d4
Instruction Fuzzy Hash: F9317032A1A68697EB618F29D100BBD7BA0FB54B88F044131DE5D03A59EF38E8818B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84E0B0F Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

MoveWindow.USER32 ref: 00007FF8A84E0BCA

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MoveWindow
String ID:
API String ID: 2234453006-0
Opcode ID: f8093c2893e8d3213a12130f25508ff83b8902eccc81c84bde1b5ecd049b35a1
Instruction ID: e25597c4a6f9f753983abbb0151a4035d4e26eda842c32d54dd48bdfa34e7ca3
Opcode Fuzzy Hash: f8093c2893e8d3213a12130f25508ff83b8902eccc81c84bde1b5ecd049b35a1
Instruction Fuzzy Hash: 23316432A1A68597DB658F39D4007BD7BA0FF54B88F044131DE5D03A59EF38E891CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84E0B27 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

MoveWindow.USER32 ref: 00007FF8A84E0BCA

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MoveWindow
String ID:
API String ID: 2234453006-0
Opcode ID: 49540435e32ea7e14518ac27fd52d9ea3ce2e9c97f0b64d79d36c13fc9a017b1
Instruction ID: 33dc90942d0e87d9b2bd036f556107bb52ae84bdcedb4bcc8f26fb6b7f1cc7f4
Opcode Fuzzy Hash: 49540435e32ea7e14518ac27fd52d9ea3ce2e9c97f0b64d79d36c13fc9a017b1
Instruction Fuzzy Hash: 68318432A1A68597DB618F29E100BBD7BA0FF54BC8F044132DE5D03A59EF38E891CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84E0B1D Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

MoveWindow.USER32 ref: 00007FF8A84E0BCA

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: MoveWindow
String ID:
API String ID: 2234453006-0
Opcode ID: 39b0aded0448c8f7a40685ed99d4320b06eb8ceeb03b64b24d296393d0a0ace4
Instruction ID: 41011d7ff8d7d8e6bcbf23e31fbd8a9362534e748cbf1c084baa9593a3dbc24d
Opcode Fuzzy Hash: 39b0aded0448c8f7a40685ed99d4320b06eb8ceeb03b64b24d296393d0a0ace4
Instruction Fuzzy Hash: 61314332A1A68596DB658F29E500BBD7BA0FF54B88F044132DE5D03A59EF38E891CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A845F4D0 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A845D9B0: GetModuleHandleW.KERNEL32 ref: 00007FF8A845DA57
Part of subcall function 00007FF8A845D9B0: GetModuleHandleW.KERNEL32 ref: 00007FF8A845DA8D
Part of subcall function 00007FF8A845D9B0: LoadIconW.USER32 ref: 00007FF8A845DAA4
Part of subcall function 00007FF8A845D9B0: LoadCursorW.USER32 ref: 00007FF8A845DB12
Part of subcall function 00007FF8A845D9B0: RegisterClassW.USER32 ref: 00007FF8A845DB22

ShowWindow.USER32 ref: 00007FF8A845F58E

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: HandleLoadModule$ClassCursorIconRegisterShowWindow
String ID:
API String ID: 3163394910-0
Opcode ID: f90de97afad66ea11c02e709b31a7bec116550207db85d13ab11c4fe6dd1f453
Instruction ID: a825ce88beb585ed8f2138f20a4e7e2bb0d72fc231cdbf9fe526989d32e19590
Opcode Fuzzy Hash: f90de97afad66ea11c02e709b31a7bec116550207db85d13ab11c4fe6dd1f453
Instruction Fuzzy Hash: 6321B532E0B686A2EB588F25D1843BD67A0EB88BD4F585434DE0D4B786CF78DC81C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A84DCB20 Relevance: 1.6, APIs: 1, Instructions: 301COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,00000008,00000000,000000D0,?,?,00007FF8A84DBCC2), ref: 00007FF8A84DCE5B

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 302c3eceb27c4ca11bb3a0936eba7cc327ed8030016746d93d9e5a04496589a3
Instruction ID: 8c2a341083cf029fb53ed78bb94bc0b23cbc4c11640a702c4f5990d3f9fd31e5
Opcode Fuzzy Hash: 302c3eceb27c4ca11bb3a0936eba7cc327ed8030016746d93d9e5a04496589a3
Instruction Fuzzy Hash: 89F12BB7606F85DACB60CF09E4801ADBBB4F798B84B55812ACB4E43760DF39E595C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8A846B2B0 Relevance: 1.5, APIs: 1, Instructions: 292COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,00000000,00007FF8A85151E4), ref: 00007FF8A846B73D

Memory Dump Source

Source File: 00000005.00000002.3289226372.00007FF8A8441000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF8A8440000, based on PE: true

Associated: 00000005.00000002.3289190505.00007FF8A8440000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289330603.00007FF8A8541000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289379707.00007FF8A8588000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289422928.00007FF8A8589000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289456037.00007FF8A858D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289487944.00007FF8A858E000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289523040.00007FF8A8590000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000005.00000002.3289557477.00007FF8A8592000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8a8440000_AccountChanger.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: e74d781beeba70443377cc54e8dc89fe99b30deb64ed9bc94750147b23a5e519
Instruction ID: 41e5e1875927a95467c860fddb1d47540d3189eca1f7ccb99d189e0d36a34afc
Opcode Fuzzy Hash: e74d781beeba70443377cc54e8dc89fe99b30deb64ed9bc94750147b23a5e519
Instruction Fuzzy Hash: 30F11371E4AA9696E744CF28EC8026433A1FB857A0F544739E96DC73E0DF3CE8419B58

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AccoutChangersetup.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\AccountChanger\AccountChanger.exe (copy)

C:\AccountChanger\config.json (copy)

C:\AccountChanger\images\is-LAVPD.tmp

C:\AccountChanger\images\logo.ico (copy)

C:\AccountChanger\is-4KCS3.tmp

C:\AccountChanger\is-6MOI9.tmp

C:\AccountChanger\is-9HL2D.tmp

C:\AccountChanger\is-EOJ2S.tmp

C:\AccountChanger\unins000.dat

C:\AccountChanger\unins000.exe (copy)

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AccountChanger\AccountChanger.lnk

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\JpegPresets.py

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\McIdasImagePlugin.py

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\MicImagePlugin.py

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\MpegImagePlugin.py

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__\PcxImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__\PdfImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__\PdfParser.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__\PixarImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__\PngImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\__pycache__\PpmImagePlugin.cpython-310.pyc

Windows Analysis Report
AccoutChangersetup.exe

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PcxImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PdfImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PdfParser.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PixarImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PngImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PpmImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PsdImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\PyAccess.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\QoiImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\SgiImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\SpiderImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\SunImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\TarIO.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\TgaImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\TiffImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\TiffTags.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\WalImageFile.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\WebPImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\WmfImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\XVThumbImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\XbmImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\XpmImagePlugin.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\init.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\main.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_binary.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_deprecate.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_tkinter_finder.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_util.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\_version.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\PIL\pycache\features.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\init.py

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\pycache\init.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\init.py

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\pycache\init.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\pycache\ctk_input_dialog.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\pycache\ctk_tk.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\pycache\ctk_toplevel.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\init.py

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\init.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_button.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_checkbox.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_combobox.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_entry.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_frame.cpython-310.pyc

C:\Users\user\AppData\Local\Temp\_MEI12922\customtkinter\windows\widgets\pycache\ctk_label.cpython-310.pyc

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre