Trojan.Siggen32.6317

Technical Information

Modifies file system

Creates the following files

%TEMP%\_mei8402\crypto\cipher\_arc4.pyd
%TEMP%\_mei8402\crypto\cipher\_salsa20.pyd
%TEMP%\_mei8402\crypto\cipher\_chacha20.pyd
%TEMP%\_mei8402\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_des.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei8402\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei8402\crypto\hash\_blake2b.pyd
%TEMP%\_mei8402\crypto\hash\_blake2s.pyd
%TEMP%\_mei8402\crypto\hash\_md2.pyd
%TEMP%\_mei8402\crypto\hash\_md4.pyd
%TEMP%\_mei8402\crypto\hash\_md5.pyd
%TEMP%\_mei8402\crypto\hash\_ripemd160.pyd
%TEMP%\_mei8402\crypto\hash\_sha1.pyd
%TEMP%\_mei8402\crypto\hash\_sha224.pyd
%TEMP%\_mei8402\crypto\hash\_sha256.pyd
%TEMP%\_mei8402\crypto\hash\_sha384.pyd
%TEMP%\_mei8402\crypto\hash\_sha512.pyd
%TEMP%\_mei8402\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei8402\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei8402\crypto\hash\_keccak.pyd
%TEMP%\_mei8402\crypto\hash\_poly1305.pyd
%TEMP%\_mei8402\crypto\math\_modexp.pyd
%TEMP%\_mei8402\crypto\protocol\_scrypt.pyd
%TEMP%\_mei8402\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei8402\crypto\publickey\_ed25519.pyd
%TEMP%\_mei8402\crypto\publickey\_ed448.pyd
%TEMP%\_mei8402\crypto\publickey\_x25519.pyd
%TEMP%\_mei8402\crypto\util\_cpuid_c.pyd
%TEMP%\_mei8402\crypto\util\_strxor.pyd
%TEMP%\_mei8402\vcruntime140.dll
%TEMP%\_mei8402\_asyncio.pyd
%TEMP%\_mei8402\_bz2.pyd
%TEMP%\_mei8402\_cffi_backend.cp311-win_amd64.pyd
%TEMP%\_mei8402\_ctypes.pyd
%TEMP%\_mei8402\_decimal.pyd
%TEMP%\_mei8402\_hashlib.pyd
%TEMP%\_mei8402\_lzma.pyd
%TEMP%\_mei8402\_multiprocessing.pyd
%TEMP%\_mei8402\_overlapped.pyd
%TEMP%\_mei8402\_queue.pyd
%TEMP%\_mei8402\_socket.pyd
%TEMP%\_mei8402\_sqlite3.pyd
%TEMP%\_mei8402\_ssl.pyd
%TEMP%\_mei8402\_uuid.pyd
%TEMP%\_mei8402\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei8402\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei8402\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei8402\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei8402\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei8402\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei8402\base_library.zip
%TEMP%\_mei8402\bleak_winrt\_winrt.pyd
%TEMP%\_mei8402\bluetooth\_msbt.cp311-win_amd64.pyd
%TEMP%\_mei8402\libcrypto-3.dll
%TEMP%\_mei8402\libffi-8.dll
%TEMP%\_mei8402\libssl-3.dll
%TEMP%\_mei8402\markupsafe\_speedups.cp311-win_amd64.pyd
%TEMP%\_mei8402\pendulum\_extensions\_helpers.cp311-win_amd64.pyd
%TEMP%\_mei8402\pendulum\locales\da\custom.py
%TEMP%\_mei8402\pendulum\locales\da\locale.py
%TEMP%\_mei8402\pendulum\locales\de\custom.py
%TEMP%\_mei8402\pendulum\locales\de\locale.py
%TEMP%\_mei8402\pendulum\locales\en\custom.py
%TEMP%\_mei8402\pendulum\locales\en\locale.py
%TEMP%\_mei8402\pendulum\locales\es\custom.py
%TEMP%\_mei8402\pendulum\locales\es\locale.py
%TEMP%\_mei8402\pendulum\locales\fa\custom.py
%TEMP%\_mei8402\pendulum\locales\fa\locale.py
%TEMP%\_mei8402\pendulum\locales\fo\custom.py
%TEMP%\_mei8402\pendulum\locales\fo\locale.py
%TEMP%\_mei8402\pendulum\locales\fr\__init__.py
%TEMP%\_mei8402\pendulum\locales\fr\custom.py
%TEMP%\_mei8402\pendulum\locales\fr\locale.py
%TEMP%\_mei8402\pendulum\locales\id\custom.py
%TEMP%\_mei8402\pendulum\locales\id\locale.py
%TEMP%\_mei8402\pendulum\locales\it\custom.py
%TEMP%\_mei8402\pendulum\locales\it\locale.py
%TEMP%\_mei8402\pendulum\locales\ko\custom.py
%TEMP%\_mei8402\pendulum\locales\ko\locale.py
%TEMP%\_mei8402\pendulum\locales\locale.py
%TEMP%\_mei8402\pendulum\locales\lt\custom.py
%TEMP%\_mei8402\pendulum\locales\lt\locale.py
%TEMP%\_mei8402\pendulum\locales\nb\custom.py
%TEMP%\_mei8402\pendulum\locales\nb\locale.py
%TEMP%\_mei8402\pendulum\locales\nl\custom.py
%TEMP%\_mei8402\pendulum\locales\nl\locale.py
%TEMP%\_mei8402\pendulum\locales\nn\custom.py
%TEMP%\_mei8402\pendulum\locales\nn\locale.py
%TEMP%\_mei8402\pendulum\locales\pl\custom.py
%TEMP%\_mei8402\pendulum\locales\pl\locale.py
%TEMP%\_mei8402\pendulum\locales\pt_br\custom.py
%TEMP%\_mei8402\pendulum\locales\pt_br\locale.py
%TEMP%\_mei8402\pendulum\locales\ru\custom.py
%TEMP%\_mei8402\pendulum\locales\ru\locale.py
%TEMP%\_mei8402\pendulum\locales\zh\custom.py
%TEMP%\_mei8402\pendulum\locales\zh\locale.py
%TEMP%\_mei8402\pendulum\parsing\_iso8601.cp311-win_amd64.pyd
%TEMP%\_mei8402\pyexpat.pyd
%TEMP%\_mei8402\python311.dll
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\abidjan
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\accra
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\addis_ababa
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\algiers
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\asmara
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\asmera
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\bamako
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\bangui
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\banjul
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\bissau
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\blantyre
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\brazzaville
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\bujumbura
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\cairo
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\casablanca
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\ceuta
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\conakry
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\dakar
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\dar_es_salaam
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\djibouti
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\douala
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\el_aaiun
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\freetown
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\gaborone
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\harare
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\johannesburg
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\juba
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\kampala
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\khartoum
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\kigali
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\kinshasa
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\lagos
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\libreville
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\lome
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\luanda
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\lubumbashi
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\lusaka
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\malabo
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\maputo
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\maseru
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\mbabane
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\mogadishu
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\monrovia
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\nairobi
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\ndjamena
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\niamey
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\nouakchott
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\ouagadougou
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\porto-novo
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\sao_tome
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\timbuktu
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\tripoli
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\tunis
%TEMP%\_mei8402\pytzdata\zoneinfo\africa\windhoek
%TEMP%\_mei8402\pytzdata\zoneinfo\america\adak
%TEMP%\_mei8402\pytzdata\zoneinfo\america\anchorage
%TEMP%\_mei8402\pytzdata\zoneinfo\america\anguilla
%TEMP%\_mei8402\pytzdata\zoneinfo\america\antigua
%TEMP%\_mei8402\pytzdata\zoneinfo\america\araguaina
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\buenos_aires
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\catamarca
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\comodrivadavia
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\cordoba
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\jujuy
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\la_rioja
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\mendoza
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\rio_gallegos
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\salta
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\san_juan
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\san_luis
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\tucuman
%TEMP%\_mei8402\pytzdata\zoneinfo\america\argentina\ushuaia
%TEMP%\_mei8402\pytzdata\zoneinfo\america\aruba
%TEMP%\_mei8402\pytzdata\zoneinfo\america\asuncion
%TEMP%\_mei8402\pytzdata\zoneinfo\america\atikokan
%TEMP%\_mei8402\pytzdata\zoneinfo\america\atka
%TEMP%\_mei8402\pytzdata\zoneinfo\america\bahia
%TEMP%\_mei8402\pytzdata\zoneinfo\america\bahia_banderas
%TEMP%\_mei8402\pytzdata\zoneinfo\america\barbados
%TEMP%\_mei8402\pytzdata\zoneinfo\america\belem
%TEMP%\_mei8402\pytzdata\zoneinfo\america\belize
%TEMP%\_mei8402\pytzdata\zoneinfo\america\blanc-sablon
%TEMP%\_mei8402\pytzdata\zoneinfo\america\boa_vista
%TEMP%\_mei8402\pytzdata\zoneinfo\america\bogota
%TEMP%\_mei8402\pytzdata\zoneinfo\america\boise
%TEMP%\_mei8402\pytzdata\zoneinfo\america\buenos_aires
%TEMP%\_mei8402\pytzdata\zoneinfo\america\cambridge_bay
%TEMP%\_mei8402\pytzdata\zoneinfo\america\campo_grande
%TEMP%\_mei8402\pytzdata\zoneinfo\america\cancun
%TEMP%\_mei8402\pytzdata\zoneinfo\america\caracas
%TEMP%\_mei8402\pytzdata\zoneinfo\america\catamarca
%TEMP%\_mei8402\pytzdata\zoneinfo\america\cayenne
%TEMP%\_mei8402\pytzdata\zoneinfo\america\cayman
%TEMP%\_mei8402\pytzdata\zoneinfo\america\chicago
%TEMP%\_mei8402\pytzdata\zoneinfo\america\chihuahua
%TEMP%\_mei8402\pytzdata\zoneinfo\america\coral_harbour
%TEMP%\_mei8402\pytzdata\zoneinfo\america\cordoba
%TEMP%\_mei8402\pytzdata\zoneinfo\america\costa_rica
%TEMP%\_mei8402\pytzdata\zoneinfo\america\creston
%TEMP%\_mei8402\pytzdata\zoneinfo\america\cuiaba
%TEMP%\_mei8402\pytzdata\zoneinfo\america\curacao
%TEMP%\_mei8402\pytzdata\zoneinfo\america\danmarkshavn
%TEMP%\_mei8402\pytzdata\zoneinfo\america\dawson
%TEMP%\_mei8402\pytzdata\zoneinfo\america\dawson_creek
%TEMP%\_mei8402\pytzdata\zoneinfo\america\denver
%TEMP%\_mei8402\pytzdata\zoneinfo\america\detroit
%TEMP%\_mei8402\pytzdata\zoneinfo\america\dominica
%TEMP%\_mei8402\pytzdata\zoneinfo\america\edmonton
%TEMP%\_mei8402\pytzdata\zoneinfo\america\eirunepe
%TEMP%\_mei8402\pytzdata\zoneinfo\america\el_salvador
%TEMP%\_mei8402\pytzdata\zoneinfo\america\ensenada
%TEMP%\_mei8402\pytzdata\zoneinfo\america\fort_nelson
%TEMP%\_mei8402\pytzdata\zoneinfo\america\fort_wayne
%TEMP%\_mei8402\pytzdata\zoneinfo\america\fortaleza
%TEMP%\_mei8402\pytzdata\zoneinfo\america\glace_bay
%TEMP%\_mei8402\pytzdata\zoneinfo\america\godthab
%TEMP%\_mei8402\pytzdata\zoneinfo\america\goose_bay
%TEMP%\_mei8402\pytzdata\zoneinfo\america\grand_turk
%TEMP%\_mei8402\pytzdata\zoneinfo\america\grenada
%TEMP%\_mei8402\pytzdata\zoneinfo\america\guadeloupe
%TEMP%\_mei8402\pytzdata\zoneinfo\america\guatemala
%TEMP%\_mei8402\pytzdata\zoneinfo\america\guayaquil
%TEMP%\_mei8402\pytzdata\zoneinfo\america\guyana
%TEMP%\_mei8402\pytzdata\zoneinfo\america\halifax
%TEMP%\_mei8402\pytzdata\zoneinfo\america\havana
%TEMP%\_mei8402\pytzdata\zoneinfo\america\hermosillo
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indiana\indianapolis
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indiana\knox
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indiana\marengo
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indiana\petersburg
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indiana\tell_city
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indiana\vevay
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indiana\vincennes
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indiana\winamac
%TEMP%\_mei8402\pytzdata\zoneinfo\america\indianapolis
%TEMP%\_mei8402\pytzdata\zoneinfo\america\inuvik
%TEMP%\_mei8402\pytzdata\zoneinfo\america\iqaluit
%TEMP%\_mei8402\pytzdata\zoneinfo\america\jamaica
%TEMP%\_mei8402\pytzdata\zoneinfo\america\jujuy
%TEMP%\_mei8402\pytzdata\zoneinfo\america\juneau
%TEMP%\_mei8402\pytzdata\zoneinfo\america\kentucky\louisville
%TEMP%\_mei8402\pytzdata\zoneinfo\america\kentucky\monticello
%TEMP%\_mei8402\pytzdata\zoneinfo\america\knox_in
%TEMP%\_mei8402\pytzdata\zoneinfo\america\kralendijk
%TEMP%\_mei8402\pytzdata\zoneinfo\america\la_paz
%TEMP%\_mei8402\pytzdata\zoneinfo\america\lima
%TEMP%\_mei8402\pytzdata\zoneinfo\america\los_angeles
%TEMP%\_mei8402\pytzdata\zoneinfo\america\louisville
%TEMP%\_mei8402\pytzdata\zoneinfo\america\lower_princes
%TEMP%\_mei8402\pytzdata\zoneinfo\america\maceio
%TEMP%\_mei8402\pytzdata\zoneinfo\america\managua
%TEMP%\_mei8402\pytzdata\zoneinfo\america\manaus
%TEMP%\_mei8402\pytzdata\zoneinfo\america\marigot
%TEMP%\_mei8402\pytzdata\zoneinfo\america\martinique
%TEMP%\_mei8402\pytzdata\zoneinfo\america\matamoros
%TEMP%\_mei8402\pytzdata\zoneinfo\america\mazatlan
%TEMP%\_mei8402\pytzdata\zoneinfo\america\mendoza
%TEMP%\_mei8402\pytzdata\zoneinfo\america\menominee
%TEMP%\_mei8402\pytzdata\zoneinfo\america\merida
%TEMP%\_mei8402\pytzdata\zoneinfo\america\metlakatla
%TEMP%\_mei8402\pytzdata\zoneinfo\america\mexico_city
%TEMP%\_mei8402\pytzdata\zoneinfo\america\miquelon
%TEMP%\_mei8402\pytzdata\zoneinfo\america\moncton
%TEMP%\_mei8402\pytzdata\zoneinfo\america\monterrey
%TEMP%\_mei8402\pytzdata\zoneinfo\america\montevideo
%TEMP%\_mei8402\pytzdata\zoneinfo\america\montreal
%TEMP%\_mei8402\pytzdata\zoneinfo\america\montserrat
%TEMP%\_mei8402\pytzdata\zoneinfo\america\nassau
%TEMP%\_mei8402\pytzdata\zoneinfo\america\new_york
%TEMP%\_mei8402\pytzdata\zoneinfo\america\nipigon
%TEMP%\_mei8402\pytzdata\zoneinfo\america\nome
%TEMP%\_mei8402\pytzdata\zoneinfo\america\noronha
%TEMP%\_mei8402\pytzdata\zoneinfo\america\north_dakota\beulah
%TEMP%\_mei8402\pytzdata\zoneinfo\america\north_dakota\center
%TEMP%\_mei8402\pytzdata\zoneinfo\america\north_dakota\new_salem
%TEMP%\_mei8402\pytzdata\zoneinfo\america\nuuk
%TEMP%\_mei8402\pytzdata\zoneinfo\america\ojinaga
%TEMP%\_mei8402\pytzdata\zoneinfo\america\panama
%TEMP%\_mei8402\pytzdata\zoneinfo\america\pangnirtung
%TEMP%\_mei8402\pytzdata\zoneinfo\america\paramaribo
%TEMP%\_mei8402\pytzdata\zoneinfo\america\phoenix
%TEMP%\_mei8402\pytzdata\zoneinfo\america\port-au-prince
%TEMP%\_mei8402\pytzdata\zoneinfo\america\port_of_spain
%TEMP%\_mei8402\pytzdata\zoneinfo\america\porto_acre
%TEMP%\_mei8402\pytzdata\zoneinfo\america\porto_velho
%TEMP%\_mei8402\pytzdata\zoneinfo\america\puerto_rico
%TEMP%\_mei8402\pytzdata\zoneinfo\america\punta_arenas
%TEMP%\_mei8402\pytzdata\zoneinfo\america\rainy_river
%TEMP%\_mei8402\pytzdata\zoneinfo\america\rankin_inlet
%TEMP%\_mei8402\pytzdata\zoneinfo\america\recife
%TEMP%\_mei8402\pytzdata\zoneinfo\america\regina
%TEMP%\_mei8402\pytzdata\zoneinfo\america\resolute
%TEMP%\_mei8402\pytzdata\zoneinfo\america\rio_branco
%TEMP%\_mei8402\pytzdata\zoneinfo\america\rosario
%TEMP%\_mei8402\pytzdata\zoneinfo\america\santa_isabel
%TEMP%\_mei8402\pytzdata\zoneinfo\america\santarem
%TEMP%\_mei8402\pytzdata\zoneinfo\america\santiago
%TEMP%\_mei8402\pytzdata\zoneinfo\america\santo_domingo
%TEMP%\_mei8402\pytzdata\zoneinfo\america\sao_paulo
%TEMP%\_mei8402\pytzdata\zoneinfo\america\scoresbysund
%TEMP%\_mei8402\pytzdata\zoneinfo\america\shiprock
%TEMP%\_mei8402\pytzdata\zoneinfo\america\sitka
%TEMP%\_mei8402\pytzdata\zoneinfo\america\st_barthelemy
%TEMP%\_mei8402\pytzdata\zoneinfo\america\st_johns
%TEMP%\_mei8402\pytzdata\zoneinfo\america\st_kitts
%TEMP%\_mei8402\pytzdata\zoneinfo\america\st_lucia
%TEMP%\_mei8402\pytzdata\zoneinfo\america\st_thomas
%TEMP%\_mei8402\pytzdata\zoneinfo\america\st_vincent
%TEMP%\_mei8402\pytzdata\zoneinfo\america\swift_current
%TEMP%\_mei8402\pytzdata\zoneinfo\america\tegucigalpa
%TEMP%\_mei8402\pytzdata\zoneinfo\america\thule
%TEMP%\_mei8402\pytzdata\zoneinfo\america\thunder_bay
%TEMP%\_mei8402\pytzdata\zoneinfo\america\tijuana
%TEMP%\_mei8402\pytzdata\zoneinfo\america\toronto
%TEMP%\_mei8402\pytzdata\zoneinfo\america\tortola
%TEMP%\_mei8402\pytzdata\zoneinfo\america\vancouver
%TEMP%\_mei8402\pytzdata\zoneinfo\america\virgin
%TEMP%\_mei8402\pytzdata\zoneinfo\america\whitehorse
%TEMP%\_mei8402\pytzdata\zoneinfo\america\winnipeg
%TEMP%\_mei8402\pytzdata\zoneinfo\america\yakutat
%TEMP%\_mei8402\pytzdata\zoneinfo\america\yellowknife
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\casey
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\davis
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\dumontdurville
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\macquarie
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\mawson
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\mcmurdo
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\palmer
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\rothera
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\south_pole
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\syowa
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\troll
%TEMP%\_mei8402\pytzdata\zoneinfo\antarctica\vostok
%TEMP%\_mei8402\pytzdata\zoneinfo\arctic\longyearbyen
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\aden
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\almaty
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\amman
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\anadyr
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\aqtau
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\aqtobe
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\ashgabat
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\ashkhabad
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\atyrau
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\baghdad
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\bahrain
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\baku
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\bangkok
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\barnaul
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\beirut
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\bishkek
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\brunei
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\calcutta
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\chita
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\choibalsan
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\chongqing
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\chungking
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\colombo
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\dacca
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\damascus
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\dhaka
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\dili
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\dubai
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\dushanbe
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\famagusta
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\gaza
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\harbin
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\hebron
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\ho_chi_minh
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\hong_kong
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\hovd
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\irkutsk
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\istanbul
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\jakarta
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\jayapura
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\jerusalem
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\kabul
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\kamchatka
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\karachi
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\kashgar
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\kathmandu
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\katmandu
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\khandyga
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\kolkata
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\krasnoyarsk
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\kuala_lumpur
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\kuching
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\kuwait
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\macao
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\macau
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\magadan
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\makassar
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\manila
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\muscat
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\nicosia
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\novokuznetsk
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\novosibirsk
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\omsk
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\oral
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\phnom_penh
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\pontianak
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\pyongyang
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\qatar
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\qostanay
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\qyzylorda
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\rangoon
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\riyadh
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\saigon
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\sakhalin
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\samarkand
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\seoul
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\shanghai
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\singapore
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\srednekolymsk
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\taipei
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\tashkent
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\tbilisi
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\tehran
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\tel_aviv
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\thimbu
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\thimphu
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\tokyo
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\tomsk
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\ujung_pandang
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\ulaanbaatar
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\ulan_bator
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\urumqi
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\ust-nera
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\vientiane
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\vladivostok
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\yakutsk
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\yangon
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\yekaterinburg
%TEMP%\_mei8402\pytzdata\zoneinfo\asia\yerevan
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\azores
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\bermuda
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\canary
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\cape_verde
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\faeroe
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\faroe
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\jan_mayen
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\madeira
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\reykjavik
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\south_georgia
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\st_helena
%TEMP%\_mei8402\pytzdata\zoneinfo\atlantic\stanley
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\act
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\adelaide
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\brisbane
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\broken_hill
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\canberra
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\currie
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\darwin
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\eucla
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\hobart
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\lhi
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\lindeman
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\lord_howe
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\melbourne
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\nsw
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\north
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\perth
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\queensland
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\south
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\sydney
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\tasmania
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\victoria
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\west
%TEMP%\_mei8402\pytzdata\zoneinfo\australia\yancowinna
%TEMP%\_mei8402\pytzdata\zoneinfo\brazil\acre
%TEMP%\_mei8402\pytzdata\zoneinfo\brazil\denoronha
%TEMP%\_mei8402\pytzdata\zoneinfo\brazil\east
%TEMP%\_mei8402\pytzdata\zoneinfo\brazil\west
%TEMP%\_mei8402\pytzdata\zoneinfo\cet
%TEMP%\_mei8402\pytzdata\zoneinfo\cst6cdt
%TEMP%\_mei8402\pytzdata\zoneinfo\canada\atlantic
%TEMP%\_mei8402\pytzdata\zoneinfo\canada\central
%TEMP%\_mei8402\pytzdata\zoneinfo\canada\eastern
%TEMP%\_mei8402\pytzdata\zoneinfo\canada\mountain
%TEMP%\_mei8402\pytzdata\zoneinfo\canada\newfoundland
%TEMP%\_mei8402\pytzdata\zoneinfo\canada\pacific
%TEMP%\_mei8402\pytzdata\zoneinfo\canada\saskatchewan
%TEMP%\_mei8402\pytzdata\zoneinfo\canada\yukon
%TEMP%\_mei8402\pytzdata\zoneinfo\chile\continental
%TEMP%\_mei8402\pytzdata\zoneinfo\chile\easterisland
%TEMP%\_mei8402\pytzdata\zoneinfo\cuba
%TEMP%\_mei8402\pytzdata\zoneinfo\eet
%TEMP%\_mei8402\pytzdata\zoneinfo\est
%TEMP%\_mei8402\pytzdata\zoneinfo\est5edt
%TEMP%\_mei8402\pytzdata\zoneinfo\egypt
%TEMP%\_mei8402\pytzdata\zoneinfo\eire
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+0
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+1
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+10
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+11
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+12
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+2
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+3
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+4
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+5
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+6
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+7
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+8
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt+9
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-0
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-1
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-10
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-11
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-12
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-13
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-14
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-2
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-3
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-4
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-5
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-6
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-7
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-8
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt-9
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\gmt0
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\greenwich
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\uct
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\utc
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\universal
%TEMP%\_mei8402\pytzdata\zoneinfo\etc\zulu
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\amsterdam
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\andorra
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\astrakhan
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\athens
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\belfast
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\belgrade
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\berlin
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\bratislava
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\brussels
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\bucharest
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\budapest
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\busingen
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\chisinau
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\copenhagen
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\dublin
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\gibraltar
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\guernsey
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\helsinki
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\isle_of_man
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\istanbul
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\jersey
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\kaliningrad
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\kiev
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\kirov
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\lisbon
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\ljubljana
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\london
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\luxembourg
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\madrid
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\malta
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\mariehamn
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\minsk
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\monaco
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\moscow
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\nicosia
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\oslo
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\paris
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\podgorica
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\prague
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\riga
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\rome
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\samara
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\san_marino
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\sarajevo
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\saratov
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\simferopol
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\skopje
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\sofia
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\stockholm
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\tallinn
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\tirane
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\tiraspol
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\ulyanovsk
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\uzhgorod
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\vaduz
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\vatican
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\vienna
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\vilnius
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\volgograd
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\warsaw
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\zagreb
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\zaporozhye
%TEMP%\_mei8402\pytzdata\zoneinfo\europe\zurich
%TEMP%\_mei8402\pytzdata\zoneinfo\factory
%TEMP%\_mei8402\pytzdata\zoneinfo\gb
%TEMP%\_mei8402\pytzdata\zoneinfo\gb-eire
%TEMP%\_mei8402\pytzdata\zoneinfo\gmt
%TEMP%\_mei8402\pytzdata\zoneinfo\gmt+0
%TEMP%\_mei8402\pytzdata\zoneinfo\gmt-0
%TEMP%\_mei8402\pytzdata\zoneinfo\gmt0
%TEMP%\_mei8402\pytzdata\zoneinfo\greenwich
%TEMP%\_mei8402\pytzdata\zoneinfo\hst
%TEMP%\_mei8402\pytzdata\zoneinfo\hongkong
%TEMP%\_mei8402\pytzdata\zoneinfo\iceland
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\antananarivo
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\chagos
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\christmas
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\cocos
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\comoro
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\kerguelen
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\mahe
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\maldives
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\mauritius
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\mayotte
%TEMP%\_mei8402\pytzdata\zoneinfo\indian\reunion
%TEMP%\_mei8402\pytzdata\zoneinfo\iran
%TEMP%\_mei8402\pytzdata\zoneinfo\israel
%TEMP%\_mei8402\pytzdata\zoneinfo\jamaica
%TEMP%\_mei8402\pytzdata\zoneinfo\japan
%TEMP%\_mei8402\pytzdata\zoneinfo\kwajalein
%TEMP%\_mei8402\pytzdata\zoneinfo\libya
%TEMP%\_mei8402\pytzdata\zoneinfo\met
%TEMP%\_mei8402\pytzdata\zoneinfo\mst
%TEMP%\_mei8402\pytzdata\zoneinfo\mst7mdt
%TEMP%\_mei8402\pytzdata\zoneinfo\mexico\bajanorte
%TEMP%\_mei8402\pytzdata\zoneinfo\mexico\bajasur
%TEMP%\_mei8402\pytzdata\zoneinfo\mexico\general
%TEMP%\_mei8402\pytzdata\zoneinfo\nz
%TEMP%\_mei8402\pytzdata\zoneinfo\nz-chat
%TEMP%\_mei8402\pytzdata\zoneinfo\navajo
%TEMP%\_mei8402\pytzdata\zoneinfo\prc
%TEMP%\_mei8402\pytzdata\zoneinfo\pst8pdt
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\apia
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\auckland
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\bougainville
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\chatham
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\chuuk
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\easter
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\efate
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\enderbury
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\fakaofo
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\fiji
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\funafuti
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\galapagos
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\gambier
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\guadalcanal
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\guam
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\honolulu
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\johnston
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\kiritimati
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\kosrae
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\kwajalein
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\majuro
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\marquesas
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\midway
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\nauru
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\niue
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\norfolk
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\noumea
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\pago_pago
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\palau
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\pitcairn
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\pohnpei
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\ponape
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\port_moresby
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\rarotonga
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\saipan
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\samoa
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\tahiti
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\tarawa
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\tongatapu
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\truk
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\wake
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\wallis
%TEMP%\_mei8402\pytzdata\zoneinfo\pacific\yap
%TEMP%\_mei8402\pytzdata\zoneinfo\poland
%TEMP%\_mei8402\pytzdata\zoneinfo\portugal
%TEMP%\_mei8402\pytzdata\zoneinfo\roc
%TEMP%\_mei8402\pytzdata\zoneinfo\rok
%TEMP%\_mei8402\pytzdata\zoneinfo\singapore
%TEMP%\_mei8402\pytzdata\zoneinfo\turkey
%TEMP%\_mei8402\pytzdata\zoneinfo\uct
%TEMP%\_mei8402\pytzdata\zoneinfo\us\alaska
%TEMP%\_mei8402\pytzdata\zoneinfo\us\aleutian
%TEMP%\_mei8402\pytzdata\zoneinfo\us\arizona
%TEMP%\_mei8402\pytzdata\zoneinfo\us\central
%TEMP%\_mei8402\pytzdata\zoneinfo\us\east-indiana
%TEMP%\_mei8402\pytzdata\zoneinfo\us\eastern
%TEMP%\_mei8402\pytzdata\zoneinfo\us\hawaii
%TEMP%\_mei8402\pytzdata\zoneinfo\us\indiana-starke
%TEMP%\_mei8402\pytzdata\zoneinfo\us\michigan
%TEMP%\_mei8402\pytzdata\zoneinfo\us\mountain
%TEMP%\_mei8402\pytzdata\zoneinfo\us\pacific
%TEMP%\_mei8402\pytzdata\zoneinfo\us\samoa
%TEMP%\_mei8402\pytzdata\zoneinfo\utc
%TEMP%\_mei8402\pytzdata\zoneinfo\universal
%TEMP%\_mei8402\pytzdata\zoneinfo\w-su
%TEMP%\_mei8402\pytzdata\zoneinfo\wet
%TEMP%\_mei8402\pytzdata\zoneinfo\zulu
%TEMP%\_mei8402\pytzdata\zoneinfo\iso3166.tab
%TEMP%\_mei8402\pytzdata\zoneinfo\leapseconds
%TEMP%\_mei8402\pytzdata\zoneinfo\posixrules
%TEMP%\_mei8402\pytzdata\zoneinfo\tzdata.zi
%TEMP%\_mei8402\pytzdata\zoneinfo\zone.tab
%TEMP%\_mei8402\pytzdata\zoneinfo\zone1970.tab
%TEMP%\_mei8402\select.pyd
%TEMP%\_mei8402\sqlite3.dll
%TEMP%\_mei8402\static\amcharts5\index.js
%TEMP%\_mei8402\static\amcharts5\xy.js
%TEMP%\_mei8402\static\css\styles.css
%TEMP%\_mei8402\static\css\themes\dark.bootstrap.min.css
%TEMP%\_mei8402\static\css\themes\dark.styles.css
%TEMP%\_mei8402\static\css\themes\light.bootstrap.min.css
%TEMP%\_mei8402\static\css\themes\light.styles.css
%TEMP%\_mei8402\static\css\themes\midnight.bootstrap.min.css
%TEMP%\_mei8402\static\css\themes\midnight.styles.css
%TEMP%\_mei8402\static\fonts\glyphicons-halflings-regular.eot
%TEMP%\_mei8402\static\fonts\glyphicons-halflings-regular.svg
%TEMP%\_mei8402\static\fonts\glyphicons-halflings-regular.ttf
%TEMP%\_mei8402\static\fonts\glyphicons-halflings-regular.woff
%TEMP%\_mei8402\static\fonts\glyphicons-halflings-regular.woff2
%TEMP%\_mei8402\static\img\favicon.ico
%TEMP%\_mei8402\static\img\icon.ico
%TEMP%\_mei8402\static\js\application.js
%TEMP%\_mei8402\static\js\bootstrap.min.js
%TEMP%\_mei8402\static\js\jquery.min.js
%TEMP%\_mei8402\static\js\js-cookie.min.js
%TEMP%\_mei8402\static\js\socket.io.min.js
%TEMP%\_mei8402\ucrtbase.dll
%TEMP%\_mei8402\unicodedata.pyd
%TEMP%\_mei8402\webapp\templates\ble.html
%TEMP%\_mei8402\webapp\templates\csv-import.html
%TEMP%\_mei8402\webapp\templates\data.html
%TEMP%\_mei8402\webapp\templates\default.html
%TEMP%\_mei8402\webapp\templates\graph.html
%TEMP%\_mei8402\webapp\templates\layout.html
%TEMP%\_mei8402\webapp\templates\rfcomm.html
%TEMP%\_mei8402\webapp\templates\serial.html
%TEMP%\_mei8402\webapp\templates\setup.html
%TEMP%\_mei8402\webapp\templates\tc66c-import.html
%TEMP%\_mei8402\werkzeug-3.0.1.dist-info\installer
%TEMP%\_mei8402\werkzeug-3.0.1.dist-info\license.rst
%TEMP%\_mei8402\werkzeug-3.0.1.dist-info\metadata
%TEMP%\_mei8402\werkzeug-3.0.1.dist-info\record
%TEMP%\_mei8402\werkzeug-3.0.1.dist-info\wheel
%TEMP%\_mei8402\wheel-0.42.0.dist-info\installer
%TEMP%\_mei8402\wheel-0.42.0.dist-info\license.txt
%TEMP%\_mei8402\wheel-0.42.0.dist-info\metadata
%TEMP%\_mei8402\wheel-0.42.0.dist-info\record
%TEMP%\_mei8402\wheel-0.42.0.dist-info\wheel
%TEMP%\_mei8402\wheel-0.42.0.dist-info\entry_points.txt
%LOCALAPPDATA%\rd-usb\config.json
%LOCALAPPDATA%\rd-usb\data.db-journal
%LOCALAPPDATA%\rd-usb\data.db
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690f005e-d4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690f0061-6f8.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2444e3197bab5596_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1769637f41694f9c_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5310a82ba68609ca_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\48530499775b1682_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e1b48c397c671927_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1d053c42171f05a6_0
%LOCALAPPDATA%\rd-usb\error.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%TEMP%\91930f1d-3de0-44c0-818f-b5b9f9f1cba0.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal

Deletes following files that it created itself

%LOCALAPPDATA%\rd-usb\data.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690f005e-d4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690f0061-6f8.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons
%LOCALAPPDATA%\microsoft\edge\user data\default\top sites-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\top sites
%TEMP%\.ses

Substitutes the following files

%LOCALAPPDATA%\rd-usb\data.db-journal
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Network activity

Connects to

'localhost':49692
'localhost':5000

TCP

HTTP GET requests

http://12#.#.0.1:5000/socket.io/?EI##########################################################

HTTP POST requests

Other

'localhost':49694
'localhost':49696
'localhost':49695
'localhost':49698
'localhost':49697
'localhost':49702
'localhost':49699
'localhost':49703
'localhost':49704
'localhost':49700
'localhost':49701
'localhost':49705
'localhost':49706
'localhost':49707
'localhost':49708
'localhost':49709
'localhost':49710
'localhost':49711
'localhost':49712
'localhost':49713
'localhost':49714

UDP

DNS ASK co####.edge.skype.com

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "ver"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://127.0.0.1:5000/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://127.0.0.1:5000/
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,16305930764457986636,11457643363812362147,131072 --lang=en-US --service-sandbox-type=none --mojo...
'<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://127.0.0.1:5000/' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial