Trojan.Siggen31.58342

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\net.exe' stop GoodbyeZapret
'<SYSTEM32>\taskkill.exe' /F /IM winws.exe
'<SYSTEM32>\net.exe' stop "WinDivert"
'<SYSTEM32>\net.exe' stop "WinDivert14"
'<SYSTEM32>\net.exe' stop "monkey"
'<SYSTEM32>\taskkill.exe' /F /IM GoodbyeZapretTray.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies settings of Windows Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe;.reg.;.bat.;.vbs;.cmd;.ps1;.zip;.rar;.msi;.msu;.lnk;.7z;.tar.gz;.doc;.docx;.pdf;'

Modifies file system

Creates the following files

%TEMP%\b055.tmp\b056.tmp\b057.bat
nul
C:\log.txt
C:\goodbyezapret.zip
C:\gz_temp\bin\cygwin1.dll
C:\gz_temp\bin\fake\fake_quic_1.bin
C:\gz_temp\bin\fake\fake_quic_2.bin
C:\gz_temp\bin\fake\fake_quic_3.bin
C:\gz_temp\bin\fake\fake_syndata.bin
C:\gz_temp\bin\fake\fake_tls_1.bin
C:\gz_temp\bin\fake\fake_tls_2.bin
C:\gz_temp\bin\fake\fake_tls_3.bin
C:\gz_temp\bin\fake\fake_tls_4.bin
C:\gz_temp\bin\fake\fake_tls_5.bin
C:\gz_temp\bin\fake\fake_tls_6.bin
C:\gz_temp\bin\fake\fake_tls_7.bin
C:\gz_temp\bin\fake\fake_tls_8.bin
C:\gz_temp\bin\fake\http_fake_ms.bin
C:\gz_temp\bin\fake\http_iana_org.bin
C:\gz_temp\bin\fake\quic_1.bin
C:\gz_temp\bin\fake\quic_2.bin
C:\gz_temp\bin\fake\quic_3.bin
C:\gz_temp\bin\fake\quic_4.bin
C:\gz_temp\bin\fake\quic_5.bin
C:\gz_temp\bin\fake\quic_6.bin
C:\gz_temp\bin\fake\quic_7.bin
C:\gz_temp\bin\fake\quic_initial_fonts_google_com.bin
C:\gz_temp\bin\fake\quic_initial_www_google_com.bin
C:\gz_temp\bin\fake\syn_packet.bin
C:\gz_temp\bin\fake\tls_clienthello_1.bin
C:\gz_temp\bin\fake\tls_clienthello_11.bin
C:\gz_temp\bin\fake\tls_clienthello_12.bin
C:\gz_temp\bin\fake\tls_clienthello_14.bin
C:\gz_temp\bin\fake\tls_clienthello_15.bin
C:\gz_temp\bin\fake\tls_clienthello_16.bin
C:\gz_temp\bin\fake\tls_clienthello_17.bin
C:\gz_temp\bin\fake\tls_clienthello_18.bin
C:\gz_temp\bin\fake\tls_clienthello_2.bin
C:\gz_temp\bin\fake\tls_clienthello_24.bin
C:\gz_temp\bin\fake\tls_clienthello_3.bin
C:\gz_temp\bin\fake\tls_clienthello_312.bin
C:\gz_temp\bin\fake\tls_clienthello_4.bin
C:\gz_temp\bin\fake\tls_clienthello_5.bin
C:\gz_temp\bin\fake\tls_clienthello_6.bin
C:\gz_temp\bin\fake\tls_clienthello_7.bin
C:\gz_temp\bin\fake\tls_clienthello_9.bin
C:\gz_temp\bin\fake\tls_clienthello_edge-106_google.com.bin
C:\gz_temp\bin\fake\tls_clienthello_edge-85_google.com.bin
C:\gz_temp\bin\fake\tls_clienthello_www_google_com.bin
C:\gz_temp\bin\killall.exe
C:\gz_temp\bin\monkey64.sys
C:\gz_temp\bin\stop_and_delete.bat
C:\gz_temp\bin\windivert.dll
C:\gz_temp\bin\windivert.dll.bak
C:\gz_temp\bin\windivert.filter\readme.txt
C:\gz_temp\bin\windivert.filter\windivert.discord_media+stun.txt
C:\gz_temp\bin\windivert.filter\windivert.discord_media.txt
C:\gz_temp\bin\windivert.filter\windivert.stun.txt
C:\gz_temp\bin\windivert64.sys.bak
C:\gz_temp\bin\windivert_delete.cmd
C:\gz_temp\bin\winws.exe
C:\gz_temp\configs\custom\customfix.bat
C:\gz_temp\configs\custom\helpers\download_helpers.bat
C:\gz_temp\configs\preset\multifix.bat
C:\gz_temp\configs\preset\multifix2.bat
C:\gz_temp\configs\preset\multifix3.bat
C:\gz_temp\configs\preset\multifix_ts.bat
C:\gz_temp\configs\preset\old_configs\ultimatefix_amaizing_4.bat
C:\gz_temp\configs\preset\old_configs\ultimatefix_amaizing_7_ip-v6.bat
C:\gz_temp\configs\preset\ultimatefix.bat
C:\gz_temp\configs\preset\ultimatefix_2.bat
C:\gz_temp\configs\preset\ultimatefix_3.bat
C:\gz_temp\configs\preset\ultimatefix_4.bat
C:\gz_temp\configs\preset\ultimatefix_5.bat
C:\gz_temp\configs\preset\ultimatefix_6.bat
C:\gz_temp\configs\preset\ultimatefix_allport.bat
C:\gz_temp\configs\preset\ultimatefix_alt.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing_2.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing_3.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing_5.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing_6.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing_7.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing_amazon.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing_amazon_2.bat
C:\gz_temp\configs\preset\ultimatefix_amaizing_amazon_3.bat
C:\gz_temp\configs\preset\ultimatefix_lab.bat
C:\gz_temp\configs\preset\ultimatefix_unreal.bat
C:\gz_temp\configs\preset\warp.bat
C:\gz_temp\configs\preset\webunlock.bat
C:\gz_temp\configs\preset\webunlock_2.bat
C:\gz_temp\configs\preset\webunlock_3.bat
C:\gz_temp\configs\preset\webunlock_x-ip.bat
C:\gz_temp\configs\preset\webunlock_x-ip_2.bat
C:\gz_temp\configs\preset\webunlock_x-ip_3.bat
C:\gz_temp\lists\custom-hostlist.txt
C:\gz_temp\lists\exclude-autohostlist.txt
C:\gz_temp\lists\exclude-cloudflare.txt
C:\gz_temp\lists\exclude-cloudflare_ip.txt
C:\gz_temp\lists\exclude.txt
C:\gz_temp\lists\ipset-cloudflare.txt
C:\gz_temp\lists\ipset-cloudflare2.txt
C:\gz_temp\lists\ipset-cloudflare3.txt
C:\gz_temp\lists\ipset-cloudflare4.txt
C:\gz_temp\lists\ipset-cloudflare_ipv6.txt
C:\gz_temp\lists\ipset-cloudflare_off.txt
C:\gz_temp\lists\ipset-dns.txt
C:\gz_temp\lists\ipset-facebook_instagram.txt
C:\gz_temp\lists\list-cloudflare.txt
C:\gz_temp\lists\list-facebook_instagram.txt
C:\gz_temp\lists\list-general.txt
C:\gz_temp\lists\list-general2.txt
C:\gz_temp\lists\list-instagram.txt
C:\gz_temp\lists\list-nvidia.txt
C:\gz_temp\lists\list-rutracker.txt
C:\gz_temp\lists\list-speedtest.txt
C:\gz_temp\lists\list-steam.txt
C:\gz_temp\lists\list-telegram.txt
C:\gz_temp\lists\list-twitch.txt
C:\gz_temp\lists\list-youtube.txt
C:\gz_temp\lists\list-youtubewithoutgv.txt
C:\gz_temp\lists\mycdnlist.txt
C:\gz_temp\lists\netrogat.txt
C:\gz_temp\lists\netrogat_ip.txt
C:\gz_temp\lists\other.txt
C:\gz_temp\lists\russia-blacklist.txt
C:\gz_temp\lists\russia-discord-ipset.txt
C:\gz_temp\lists\russia-discord.txt
C:\gz_temp\lists\russia-youtube-rtmps.txt
C:\gz_temp\lists\russia-youtube.txt
C:\gz_temp\lists\russia-youtube2.txt
C:\gz_temp\lists\russia-youtubeq.txt
C:\gz_temp\lists\youtube.txt
C:\gz_temp\lists\youtubeq.txt
C:\gz_temp\lists\youtube_googlevideo.txt
C:\gz_temp\lists\youtube_video-chanel-preview.txt
C:\gz_temp\tools\config_check\auto_find_working_config.exe
C:\gz_temp\tools\config_check\config_check.exe
C:\gz_temp\tools\config_check\domains.txt
C:\gz_temp\tools\curl\curl.exe
C:\gz_temp\tools\delete_services.bat
C:\gz_temp\tools\delete_services_for_finder.bat
C:\gz_temp\tools\dns_config.bat
C:\gz_temp\tools\host_unlock.bat
C:\gz_temp\tools\reset_network.bat
C:\gz_temp\tools\tray\goodbyezaprettray.exe
C:\gz_temp\tools\tray\goodbyezapret_tray.log
C:\gz_temp\tools\tray\tray_delete_services.bat
C:\gz_temp\tools\tray\tray_kill.cmd
C:\gz_temp\tools\tray\tray_kill_wiws.bat
C:\gz_temp\tools\tray\tray_start_service.bat
C:\gz_temp\tools\updater.exe
C:\gz_temp\tools\update_blacklist.bat
C:\gz_temp\tools\update_winws.bat
C:\gz_temp\instructions.html
C:\gz_temp\launcher.bat
C:\tools\delete_services.bat
C:\tools\delete_services_for_finder.bat
C:\tools\dns_config.bat
C:\tools\host_unlock.bat
C:\tools\reset_network.bat
C:\tools\updater.exe
C:\tools\update_blacklist.bat
C:\tools\update_winws.bat
C:\tools\tray\goodbyezaprettray.exe
C:\tools\tray\goodbyezapret_tray.log
C:\tools\tray\tray_delete_services.bat
C:\tools\tray\tray_kill.cmd
C:\tools\tray\tray_kill_wiws.bat
C:\tools\tray\tray_start_service.bat
C:\tools\curl\curl.exe
C:\configs\preset\multifix.bat
C:\configs\preset\multifix2.bat
C:\configs\preset\multifix3.bat
C:\configs\preset\multifix_ts.bat
C:\configs\preset\ultimatefix.bat
C:\configs\preset\ultimatefix_2.bat
C:\configs\preset\ultimatefix_3.bat
C:\configs\preset\ultimatefix_4.bat
C:\configs\preset\ultimatefix_5.bat
C:\configs\preset\ultimatefix_6.bat
C:\configs\preset\ultimatefix_allport.bat
C:\configs\preset\ultimatefix_alt.bat
C:\configs\preset\ultimatefix_amaizing.bat
C:\configs\preset\ultimatefix_amaizing_2.bat
C:\configs\preset\ultimatefix_amaizing_3.bat
C:\configs\preset\ultimatefix_amaizing_5.bat
C:\configs\preset\ultimatefix_amaizing_6.bat
C:\configs\preset\ultimatefix_amaizing_7.bat
C:\configs\preset\ultimatefix_amaizing_amazon.bat
C:\configs\preset\ultimatefix_amaizing_amazon_2.bat
C:\configs\preset\ultimatefix_amaizing_amazon_3.bat
C:\configs\preset\ultimatefix_lab.bat
C:\configs\preset\ultimatefix_unreal.bat
C:\configs\preset\warp.bat
C:\configs\preset\webunlock.bat
C:\configs\preset\webunlock_2.bat
C:\configs\preset\webunlock_3.bat
C:\configs\preset\webunlock_x-ip.bat
C:\configs\preset\webunlock_x-ip_2.bat
C:\configs\preset\webunlock_x-ip_3.bat
C:\configs\preset\old_configs\ultimatefix_amaizing_4.bat
C:\configs\preset\old_configs\ultimatefix_amaizing_7_ip-v6.bat
C:\launcher.bat
%TEMP%\gz_updater.bat
%TEMP%\_mei22362\pil\_avif.cp313-win_amd64.pyd
%TEMP%\_mei22362\pil\_imaging.cp313-win_amd64.pyd
%TEMP%\_mei22362\pil\_imagingcms.cp313-win_amd64.pyd
%TEMP%\_mei22362\pil\_imagingmath.cp313-win_amd64.pyd
%TEMP%\_mei22362\pil\_imagingtk.cp313-win_amd64.pyd
%TEMP%\_mei22362\pil\_webp.cp313-win_amd64.pyd
%TEMP%\_mei22362\vcruntime140.dll
%TEMP%\_mei22362\vcruntime140_1.dll
%TEMP%\_mei22362\_asyncio.pyd
%TEMP%\_mei22362\_bz2.pyd
%TEMP%\_mei22362\_ctypes.pyd
%TEMP%\_mei22362\_decimal.pyd
%TEMP%\_mei22362\_elementtree.pyd
%TEMP%\_mei22362\_hashlib.pyd
%TEMP%\_mei22362\_lzma.pyd
%TEMP%\_mei22362\_multiprocessing.pyd
%TEMP%\_mei22362\_overlapped.pyd
%TEMP%\_mei22362\_queue.pyd
%TEMP%\_mei22362\_socket.pyd
%TEMP%\_mei22362\_ssl.pyd
%TEMP%\_mei22362\_tcl_data\auto.tcl
%TEMP%\_mei22362\_tcl_data\clock.tcl
%TEMP%\_mei22362\_tcl_data\encoding\ascii.enc
%TEMP%\_mei22362\_tcl_data\encoding\big5.enc
%TEMP%\_mei22362\_tcl_data\encoding\cns11643.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1250.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1251.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1252.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1253.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1254.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1255.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1256.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1257.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp1258.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp437.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp737.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp775.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp850.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp852.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp855.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp857.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp860.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp861.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp862.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp863.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp864.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp865.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp866.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp869.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp874.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp932.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp936.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp949.enc
%TEMP%\_mei22362\_tcl_data\encoding\cp950.enc
%TEMP%\_mei22362\_tcl_data\encoding\dingbats.enc
%TEMP%\_mei22362\_tcl_data\encoding\ebcdic.enc
%TEMP%\_mei22362\_tcl_data\encoding\euc-cn.enc
%TEMP%\_mei22362\_tcl_data\encoding\euc-jp.enc
%TEMP%\_mei22362\_tcl_data\encoding\euc-kr.enc
%TEMP%\_mei22362\_tcl_data\encoding\gb12345.enc
%TEMP%\_mei22362\_tcl_data\encoding\gb1988.enc
%TEMP%\_mei22362\_tcl_data\encoding\gb2312-raw.enc
%TEMP%\_mei22362\_tcl_data\encoding\gb2312.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso2022-jp.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso2022-kr.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso2022.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-1.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-10.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-11.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-13.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-14.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-15.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-16.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-2.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-3.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-4.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-5.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-6.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-7.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-8.enc
%TEMP%\_mei22362\_tcl_data\encoding\iso8859-9.enc
%TEMP%\_mei22362\_tcl_data\encoding\jis0201.enc
%TEMP%\_mei22362\_tcl_data\encoding\jis0208.enc
%TEMP%\_mei22362\_tcl_data\encoding\jis0212.enc
%TEMP%\_mei22362\_tcl_data\encoding\koi8-r.enc
%TEMP%\_mei22362\_tcl_data\encoding\koi8-ru.enc
%TEMP%\_mei22362\_tcl_data\encoding\koi8-t.enc
%TEMP%\_mei22362\_tcl_data\encoding\koi8-u.enc
%TEMP%\_mei22362\_tcl_data\encoding\ksc5601.enc
%TEMP%\_mei22362\_tcl_data\encoding\maccenteuro.enc
%TEMP%\_mei22362\_tcl_data\encoding\maccroatian.enc
%TEMP%\_mei22362\_tcl_data\encoding\maccyrillic.enc
%TEMP%\_mei22362\_tcl_data\encoding\macdingbats.enc
%TEMP%\_mei22362\_tcl_data\encoding\macgreek.enc
%TEMP%\_mei22362\_tcl_data\encoding\maciceland.enc
%TEMP%\_mei22362\_tcl_data\encoding\macjapan.enc
%TEMP%\_mei22362\_tcl_data\encoding\macroman.enc
%TEMP%\_mei22362\_tcl_data\encoding\macromania.enc
%TEMP%\_mei22362\_tcl_data\encoding\macthai.enc
%TEMP%\_mei22362\_tcl_data\encoding\macturkish.enc
%TEMP%\_mei22362\_tcl_data\encoding\macukraine.enc
%TEMP%\_mei22362\_tcl_data\encoding\shiftjis.enc
%TEMP%\_mei22362\_tcl_data\encoding\symbol.enc
%TEMP%\_mei22362\_tcl_data\encoding\tis-620.enc
%TEMP%\_mei22362\_tcl_data\history.tcl
%TEMP%\_mei22362\_tcl_data\http1.0\http.tcl
%TEMP%\_mei22362\_tcl_data\http1.0\pkgindex.tcl
%TEMP%\_mei22362\_tcl_data\init.tcl
%TEMP%\_mei22362\_tcl_data\msgs\af.msg
%TEMP%\_mei22362\_tcl_data\msgs\af_za.msg
%TEMP%\_mei22362\_tcl_data\msgs\ar.msg
%TEMP%\_mei22362\_tcl_data\msgs\ar_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\ar_jo.msg
%TEMP%\_mei22362\_tcl_data\msgs\ar_lb.msg
%TEMP%\_mei22362\_tcl_data\msgs\ar_sy.msg
%TEMP%\_mei22362\_tcl_data\msgs\be.msg
%TEMP%\_mei22362\_tcl_data\msgs\bg.msg
%TEMP%\_mei22362\_tcl_data\msgs\bn.msg
%TEMP%\_mei22362\_tcl_data\msgs\bn_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\ca.msg
%TEMP%\_mei22362\_tcl_data\msgs\cs.msg
%TEMP%\_mei22362\_tcl_data\msgs\da.msg
%TEMP%\_mei22362\_tcl_data\msgs\de.msg
%TEMP%\_mei22362\_tcl_data\msgs\de_at.msg
%TEMP%\_mei22362\_tcl_data\msgs\de_be.msg
%TEMP%\_mei22362\_tcl_data\msgs\el.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_au.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_be.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_bw.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_ca.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_gb.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_hk.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_ie.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_nz.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_ph.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_sg.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_za.msg
%TEMP%\_mei22362\_tcl_data\msgs\en_zw.msg
%TEMP%\_mei22362\_tcl_data\msgs\eo.msg
%TEMP%\_mei22362\_tcl_data\msgs\es.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_ar.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_bo.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_cl.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_co.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_cr.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_do.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_ec.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_gt.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_hn.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_mx.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_ni.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_pa.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_pe.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_pr.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_py.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_sv.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_uy.msg
%TEMP%\_mei22362\_tcl_data\msgs\es_ve.msg
%TEMP%\_mei22362\_tcl_data\msgs\et.msg
%TEMP%\_mei22362\_tcl_data\msgs\eu.msg
%TEMP%\_mei22362\_tcl_data\msgs\eu_es.msg
%TEMP%\_mei22362\_tcl_data\msgs\fa.msg
%TEMP%\_mei22362\_tcl_data\msgs\fa_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\fa_ir.msg
%TEMP%\_mei22362\_tcl_data\msgs\fi.msg
%TEMP%\_mei22362\_tcl_data\msgs\fo.msg
%TEMP%\_mei22362\_tcl_data\msgs\fo_fo.msg
%TEMP%\_mei22362\_tcl_data\msgs\fr.msg
%TEMP%\_mei22362\_tcl_data\msgs\fr_be.msg
%TEMP%\_mei22362\_tcl_data\msgs\fr_ca.msg
%TEMP%\_mei22362\_tcl_data\msgs\fr_ch.msg
%TEMP%\_mei22362\_tcl_data\msgs\ga.msg
%TEMP%\_mei22362\_tcl_data\msgs\ga_ie.msg
%TEMP%\_mei22362\_tcl_data\msgs\gl.msg
%TEMP%\_mei22362\_tcl_data\msgs\gl_es.msg
%TEMP%\_mei22362\_tcl_data\msgs\gv.msg
%TEMP%\_mei22362\_tcl_data\msgs\gv_gb.msg
%TEMP%\_mei22362\_tcl_data\msgs\he.msg
%TEMP%\_mei22362\_tcl_data\msgs\hi.msg
%TEMP%\_mei22362\_tcl_data\msgs\hi_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\hr.msg
%TEMP%\_mei22362\_tcl_data\msgs\hu.msg
%TEMP%\_mei22362\_tcl_data\msgs\id.msg
%TEMP%\_mei22362\_tcl_data\msgs\id_id.msg
%TEMP%\_mei22362\_tcl_data\msgs\is.msg
%TEMP%\_mei22362\_tcl_data\msgs\it.msg
%TEMP%\_mei22362\_tcl_data\msgs\it_ch.msg
%TEMP%\_mei22362\_tcl_data\msgs\ja.msg
%TEMP%\_mei22362\_tcl_data\msgs\kl.msg
%TEMP%\_mei22362\_tcl_data\msgs\kl_gl.msg
%TEMP%\_mei22362\_tcl_data\msgs\ko.msg
%TEMP%\_mei22362\_tcl_data\msgs\ko_kr.msg
%TEMP%\_mei22362\_tcl_data\msgs\kok.msg
%TEMP%\_mei22362\_tcl_data\msgs\kok_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\kw.msg
%TEMP%\_mei22362\_tcl_data\msgs\kw_gb.msg
%TEMP%\_mei22362\_tcl_data\msgs\lt.msg
%TEMP%\_mei22362\_tcl_data\msgs\lv.msg
%TEMP%\_mei22362\_tcl_data\msgs\mk.msg
%TEMP%\_mei22362\_tcl_data\msgs\mr.msg
%TEMP%\_mei22362\_tcl_data\msgs\mr_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\ms.msg
%TEMP%\_mei22362\_tcl_data\msgs\ms_my.msg
%TEMP%\_mei22362\_tcl_data\msgs\mt.msg
%TEMP%\_mei22362\_tcl_data\msgs\nb.msg
%TEMP%\_mei22362\_tcl_data\msgs\nl.msg
%TEMP%\_mei22362\_tcl_data\msgs\nl_be.msg
%TEMP%\_mei22362\_tcl_data\msgs\nn.msg
%TEMP%\_mei22362\_tcl_data\msgs\pl.msg
%TEMP%\_mei22362\_tcl_data\msgs\pt.msg
%TEMP%\_mei22362\_tcl_data\msgs\pt_br.msg
%TEMP%\_mei22362\_tcl_data\msgs\ro.msg
%TEMP%\_mei22362\_tcl_data\msgs\ru.msg
%TEMP%\_mei22362\_tcl_data\msgs\ru_ua.msg
%TEMP%\_mei22362\_tcl_data\msgs\sh.msg
%TEMP%\_mei22362\_tcl_data\msgs\sk.msg
%TEMP%\_mei22362\_tcl_data\msgs\sl.msg
%TEMP%\_mei22362\_tcl_data\msgs\sq.msg
%TEMP%\_mei22362\_tcl_data\msgs\sr.msg
%TEMP%\_mei22362\_tcl_data\msgs\sv.msg
%TEMP%\_mei22362\_tcl_data\msgs\sw.msg
%TEMP%\_mei22362\_tcl_data\msgs\ta.msg
%TEMP%\_mei22362\_tcl_data\msgs\ta_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\te.msg
%TEMP%\_mei22362\_tcl_data\msgs\te_in.msg
%TEMP%\_mei22362\_tcl_data\msgs\th.msg
%TEMP%\_mei22362\_tcl_data\msgs\tr.msg
%TEMP%\_mei22362\_tcl_data\msgs\uk.msg
%TEMP%\_mei22362\_tcl_data\msgs\vi.msg
%TEMP%\_mei22362\_tcl_data\msgs\zh.msg
%TEMP%\_mei22362\_tcl_data\msgs\zh_cn.msg
%TEMP%\_mei22362\_tcl_data\msgs\zh_hk.msg
%TEMP%\_mei22362\_tcl_data\msgs\zh_sg.msg
%TEMP%\_mei22362\_tcl_data\msgs\zh_tw.msg
%TEMP%\_mei22362\_tcl_data\opt0.4\optparse.tcl
%TEMP%\_mei22362\_tcl_data\opt0.4\pkgindex.tcl
%TEMP%\_mei22362\_tcl_data\package.tcl
%TEMP%\_mei22362\_tcl_data\parray.tcl
%TEMP%\_mei22362\_tcl_data\safe.tcl
%TEMP%\_mei22362\_tcl_data\tclindex
%TEMP%\_mei22362\_tcl_data\tm.tcl
%TEMP%\_mei22362\_tcl_data\tzdata\africa\abidjan
%TEMP%\_mei22362\_tcl_data\tzdata\africa\accra
%TEMP%\_mei22362\_tcl_data\tzdata\africa\addis_ababa
%TEMP%\_mei22362\_tcl_data\tzdata\africa\algiers
%TEMP%\_mei22362\_tcl_data\tzdata\africa\asmara
%TEMP%\_mei22362\_tcl_data\tzdata\africa\asmera
%TEMP%\_mei22362\_tcl_data\tzdata\africa\bamako
%TEMP%\_mei22362\_tcl_data\tzdata\africa\bangui
%TEMP%\_mei22362\_tcl_data\tzdata\africa\banjul
%TEMP%\_mei22362\_tcl_data\tzdata\africa\bissau
%TEMP%\_mei22362\_tcl_data\tzdata\africa\blantyre
%TEMP%\_mei22362\_tcl_data\tzdata\africa\brazzaville
%TEMP%\_mei22362\_tcl_data\tzdata\africa\bujumbura
%TEMP%\_mei22362\_tcl_data\tzdata\africa\cairo
%TEMP%\_mei22362\_tcl_data\tzdata\africa\casablanca
%TEMP%\_mei22362\_tcl_data\tzdata\africa\ceuta
%TEMP%\_mei22362\_tcl_data\tzdata\africa\conakry
%TEMP%\_mei22362\_tcl_data\tzdata\africa\dakar
%TEMP%\_mei22362\_tcl_data\tzdata\africa\dar_es_salaam
%TEMP%\_mei22362\_tcl_data\tzdata\africa\djibouti
%TEMP%\_mei22362\_tcl_data\tzdata\africa\douala
%TEMP%\_mei22362\_tcl_data\tzdata\africa\el_aaiun
%TEMP%\_mei22362\_tcl_data\tzdata\africa\freetown
%TEMP%\_mei22362\_tcl_data\tzdata\africa\gaborone
%TEMP%\_mei22362\_tcl_data\tzdata\africa\harare
%TEMP%\_mei22362\_tcl_data\tzdata\africa\johannesburg
%TEMP%\_mei22362\_tcl_data\tzdata\africa\juba
%TEMP%\_mei22362\_tcl_data\tzdata\africa\kampala
%TEMP%\_mei22362\_tcl_data\tzdata\africa\khartoum
%TEMP%\_mei22362\_tcl_data\tzdata\africa\kigali
%TEMP%\_mei22362\_tcl_data\tzdata\africa\kinshasa
%TEMP%\_mei22362\_tcl_data\tzdata\africa\lagos
%TEMP%\_mei22362\_tcl_data\tzdata\africa\libreville
%TEMP%\_mei22362\_tcl_data\tzdata\africa\lome
%TEMP%\_mei22362\_tcl_data\tzdata\africa\luanda
%TEMP%\_mei22362\_tcl_data\tzdata\africa\lubumbashi
%TEMP%\_mei22362\_tcl_data\tzdata\africa\lusaka
%TEMP%\_mei22362\_tcl_data\tzdata\africa\malabo
%TEMP%\_mei22362\_tcl_data\tzdata\africa\maputo
%TEMP%\_mei22362\_tcl_data\tzdata\africa\maseru
%TEMP%\_mei22362\_tcl_data\tzdata\africa\mbabane
%TEMP%\_mei22362\_tcl_data\tzdata\africa\mogadishu
%TEMP%\_mei22362\_tcl_data\tzdata\africa\monrovia
%TEMP%\_mei22362\_tcl_data\tzdata\africa\nairobi
%TEMP%\_mei22362\_tcl_data\tzdata\africa\ndjamena
%TEMP%\_mei22362\_tcl_data\tzdata\africa\niamey
%TEMP%\_mei22362\_tcl_data\tzdata\africa\nouakchott
%TEMP%\_mei22362\_tcl_data\tzdata\africa\ouagadougou
%TEMP%\_mei22362\_tcl_data\tzdata\africa\porto-novo
%TEMP%\_mei22362\_tcl_data\tzdata\africa\sao_tome
%TEMP%\_mei22362\_tcl_data\tzdata\africa\timbuktu
%TEMP%\_mei22362\_tcl_data\tzdata\africa\tripoli
%TEMP%\_mei22362\_tcl_data\tzdata\africa\tunis
%TEMP%\_mei22362\_tcl_data\tzdata\africa\windhoek
%TEMP%\_mei22362\_tcl_data\tzdata\america\adak
%TEMP%\_mei22362\_tcl_data\tzdata\america\anchorage
%TEMP%\_mei22362\_tcl_data\tzdata\america\anguilla
%TEMP%\_mei22362\_tcl_data\tzdata\america\antigua
%TEMP%\_mei22362\_tcl_data\tzdata\america\araguaina
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\buenos_aires
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\catamarca
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\comodrivadavia
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\cordoba
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\jujuy
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\la_rioja
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\mendoza
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\rio_gallegos
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\salta
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\san_juan
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\san_luis
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\tucuman
%TEMP%\_mei22362\_tcl_data\tzdata\america\argentina\ushuaia
%TEMP%\_mei22362\_tcl_data\tzdata\america\aruba
%TEMP%\_mei22362\_tcl_data\tzdata\america\asuncion
%TEMP%\_mei22362\_tcl_data\tzdata\america\atikokan
%TEMP%\_mei22362\_tcl_data\tzdata\america\atka
%TEMP%\_mei22362\_tcl_data\tzdata\america\bahia
%TEMP%\_mei22362\_tcl_data\tzdata\america\bahia_banderas
%TEMP%\_mei22362\_tcl_data\tzdata\america\barbados
%TEMP%\_mei22362\_tcl_data\tzdata\america\belem
%TEMP%\_mei22362\_tcl_data\tzdata\america\belize
%TEMP%\_mei22362\_tcl_data\tzdata\america\blanc-sablon
%TEMP%\_mei22362\_tcl_data\tzdata\america\boa_vista
%TEMP%\_mei22362\_tcl_data\tzdata\america\bogota
%TEMP%\_mei22362\_tcl_data\tzdata\america\boise
%TEMP%\_mei22362\_tcl_data\tzdata\america\buenos_aires
%TEMP%\_mei22362\_tcl_data\tzdata\america\cambridge_bay
%TEMP%\_mei22362\_tcl_data\tzdata\america\campo_grande
%TEMP%\_mei22362\_tcl_data\tzdata\america\cancun
%TEMP%\_mei22362\_tcl_data\tzdata\america\caracas
%TEMP%\_mei22362\_tcl_data\tzdata\america\catamarca
%TEMP%\_mei22362\_tcl_data\tzdata\america\cayenne
%TEMP%\_mei22362\_tcl_data\tzdata\america\cayman
%TEMP%\_mei22362\_tcl_data\tzdata\america\chicago
%TEMP%\_mei22362\_tcl_data\tzdata\america\chihuahua
%TEMP%\_mei22362\_tcl_data\tzdata\america\ciudad_juarez
%TEMP%\_mei22362\_tcl_data\tzdata\america\coral_harbour
%TEMP%\_mei22362\_tcl_data\tzdata\america\cordoba
%TEMP%\_mei22362\_tcl_data\tzdata\america\costa_rica
%TEMP%\_mei22362\_tcl_data\tzdata\america\creston
%TEMP%\_mei22362\_tcl_data\tzdata\america\cuiaba
%TEMP%\_mei22362\_tcl_data\tzdata\america\curacao
%TEMP%\_mei22362\_tcl_data\tzdata\america\danmarkshavn
%TEMP%\_mei22362\_tcl_data\tzdata\america\dawson
%TEMP%\_mei22362\_tcl_data\tzdata\america\dawson_creek
%TEMP%\_mei22362\_tcl_data\tzdata\america\denver
%TEMP%\_mei22362\_tcl_data\tzdata\america\detroit
%TEMP%\_mei22362\_tcl_data\tzdata\america\dominica
%TEMP%\_mei22362\_tcl_data\tzdata\america\edmonton
%TEMP%\_mei22362\_tcl_data\tzdata\america\eirunepe
%TEMP%\_mei22362\_tcl_data\tzdata\america\el_salvador
%TEMP%\_mei22362\_tcl_data\tzdata\america\ensenada
%TEMP%\_mei22362\_tcl_data\tzdata\america\fort_nelson
%TEMP%\_mei22362\_tcl_data\tzdata\america\fort_wayne
%TEMP%\_mei22362\_tcl_data\tzdata\america\fortaleza
%TEMP%\_mei22362\_tcl_data\tzdata\america\glace_bay
%TEMP%\_mei22362\_tcl_data\tzdata\america\godthab
%TEMP%\_mei22362\_tcl_data\tzdata\america\goose_bay
%TEMP%\_mei22362\_tcl_data\tzdata\america\grand_turk
%TEMP%\_mei22362\_tcl_data\tzdata\america\grenada
%TEMP%\_mei22362\_tcl_data\tzdata\america\guadeloupe
%TEMP%\_mei22362\_tcl_data\tzdata\america\guatemala
%TEMP%\_mei22362\_tcl_data\tzdata\america\guayaquil
%TEMP%\_mei22362\_tcl_data\tzdata\america\guyana
%TEMP%\_mei22362\_tcl_data\tzdata\america\halifax
%TEMP%\_mei22362\_tcl_data\tzdata\america\havana
%TEMP%\_mei22362\_tcl_data\tzdata\america\hermosillo
%TEMP%\_mei22362\_tcl_data\tzdata\america\indiana\indianapolis
%TEMP%\_mei22362\_tcl_data\tzdata\america\indiana\knox
%TEMP%\_mei22362\_tcl_data\tzdata\america\indiana\marengo
%TEMP%\_mei22362\_tcl_data\tzdata\america\indiana\petersburg
%TEMP%\_mei22362\_tcl_data\tzdata\america\indiana\tell_city
%TEMP%\_mei22362\_tcl_data\tzdata\america\indiana\vevay
%TEMP%\_mei22362\_tcl_data\tzdata\america\indiana\vincennes
%TEMP%\_mei22362\_tcl_data\tzdata\america\indiana\winamac
%TEMP%\_mei22362\_tcl_data\tzdata\america\indianapolis
%TEMP%\_mei22362\_tcl_data\tzdata\america\inuvik
%TEMP%\_mei22362\_tcl_data\tzdata\america\iqaluit
%TEMP%\_mei22362\_tcl_data\tzdata\america\jamaica
%TEMP%\_mei22362\_tcl_data\tzdata\america\jujuy
%TEMP%\_mei22362\_tcl_data\tzdata\america\juneau
%TEMP%\_mei22362\_tcl_data\tzdata\america\kentucky\louisville
%TEMP%\_mei22362\_tcl_data\tzdata\america\kentucky\monticello
%TEMP%\_mei22362\_tcl_data\tzdata\america\knox_in
%TEMP%\_mei22362\_tcl_data\tzdata\america\kralendijk
%TEMP%\_mei22362\_tcl_data\tzdata\america\la_paz
%TEMP%\_mei22362\_tcl_data\tzdata\america\lima
%TEMP%\_mei22362\_tcl_data\tzdata\america\los_angeles
%TEMP%\_mei22362\_tcl_data\tzdata\america\louisville
%TEMP%\_mei22362\_tcl_data\tzdata\america\lower_princes
%TEMP%\_mei22362\_tcl_data\tzdata\america\maceio
%TEMP%\_mei22362\_tcl_data\tzdata\america\managua
%TEMP%\_mei22362\_tcl_data\tzdata\america\manaus
%TEMP%\_mei22362\_tcl_data\tzdata\america\marigot
%TEMP%\_mei22362\_tcl_data\tzdata\america\martinique
%TEMP%\_mei22362\_tcl_data\tzdata\america\matamoros
%TEMP%\_mei22362\_tcl_data\tzdata\america\mazatlan
%TEMP%\_mei22362\_tcl_data\tzdata\america\mendoza
%TEMP%\_mei22362\_tcl_data\tzdata\america\menominee
%TEMP%\_mei22362\_tcl_data\tzdata\america\merida
%TEMP%\_mei22362\_tcl_data\tzdata\america\metlakatla
%TEMP%\_mei22362\_tcl_data\tzdata\america\mexico_city
%TEMP%\_mei22362\_tcl_data\tzdata\america\miquelon
%TEMP%\_mei22362\_tcl_data\tzdata\america\moncton
%TEMP%\_mei22362\_tcl_data\tzdata\america\monterrey
%TEMP%\_mei22362\_tcl_data\tzdata\america\montevideo
%TEMP%\_mei22362\_tcl_data\tzdata\america\montreal
%TEMP%\_mei22362\_tcl_data\tzdata\america\montserrat
%TEMP%\_mei22362\_tcl_data\tzdata\america\nassau
%TEMP%\_mei22362\_tcl_data\tzdata\america\new_york
%TEMP%\_mei22362\_tcl_data\tzdata\america\nipigon
%TEMP%\_mei22362\_tcl_data\tzdata\america\nome
%TEMP%\_mei22362\_tcl_data\tzdata\america\noronha
%TEMP%\_mei22362\_tcl_data\tzdata\america\north_dakota\beulah
%TEMP%\_mei22362\_tcl_data\tzdata\america\north_dakota\center
%TEMP%\_mei22362\_tcl_data\tzdata\america\north_dakota\new_salem
%TEMP%\_mei22362\_tcl_data\tzdata\america\nuuk
%TEMP%\_mei22362\_tcl_data\tzdata\america\ojinaga
%TEMP%\_mei22362\_tcl_data\tzdata\america\panama
%TEMP%\_mei22362\_tcl_data\tzdata\america\pangnirtung
%TEMP%\_mei22362\_tcl_data\tzdata\america\paramaribo
%TEMP%\_mei22362\_tcl_data\tzdata\america\phoenix
%TEMP%\_mei22362\_tcl_data\tzdata\america\port-au-prince
%TEMP%\_mei22362\_tcl_data\tzdata\america\port_of_spain
%TEMP%\_mei22362\_tcl_data\tzdata\america\porto_acre
%TEMP%\_mei22362\_tcl_data\tzdata\america\porto_velho
%TEMP%\_mei22362\_tcl_data\tzdata\america\puerto_rico
%TEMP%\_mei22362\_tcl_data\tzdata\america\punta_arenas
%TEMP%\_mei22362\_tcl_data\tzdata\america\rainy_river
%TEMP%\_mei22362\_tcl_data\tzdata\america\rankin_inlet
%TEMP%\_mei22362\_tcl_data\tzdata\america\recife
%TEMP%\_mei22362\_tcl_data\tzdata\america\regina
%TEMP%\_mei22362\_tcl_data\tzdata\america\resolute
%TEMP%\_mei22362\_tcl_data\tzdata\america\rio_branco
%TEMP%\_mei22362\_tcl_data\tzdata\america\rosario
%TEMP%\_mei22362\_tcl_data\tzdata\america\santa_isabel
%TEMP%\_mei22362\_tcl_data\tzdata\america\santarem
%TEMP%\_mei22362\_tcl_data\tzdata\america\santiago
%TEMP%\_mei22362\_tcl_data\tzdata\america\santo_domingo
%TEMP%\_mei22362\_tcl_data\tzdata\america\sao_paulo
%TEMP%\_mei22362\_tcl_data\tzdata\america\scoresbysund
%TEMP%\_mei22362\_tcl_data\tzdata\america\shiprock
%TEMP%\_mei22362\_tcl_data\tzdata\america\sitka
%TEMP%\_mei22362\_tcl_data\tzdata\america\st_barthelemy
%TEMP%\_mei22362\_tcl_data\tzdata\america\st_johns
%TEMP%\_mei22362\_tcl_data\tzdata\america\st_kitts
%TEMP%\_mei22362\_tcl_data\tzdata\america\st_lucia
%TEMP%\_mei22362\_tcl_data\tzdata\america\st_thomas
%TEMP%\_mei22362\_tcl_data\tzdata\america\st_vincent
%TEMP%\_mei22362\_tcl_data\tzdata\america\swift_current
%TEMP%\_mei22362\_tcl_data\tzdata\america\tegucigalpa
%TEMP%\_mei22362\_tcl_data\tzdata\america\thule
%TEMP%\_mei22362\_tcl_data\tzdata\america\thunder_bay
%TEMP%\_mei22362\_tcl_data\tzdata\america\tijuana
%TEMP%\_mei22362\_tcl_data\tzdata\america\toronto
%TEMP%\_mei22362\_tcl_data\tzdata\america\tortola
%TEMP%\_mei22362\_tcl_data\tzdata\america\vancouver
%TEMP%\_mei22362\_tcl_data\tzdata\america\virgin
%TEMP%\_mei22362\_tcl_data\tzdata\america\whitehorse
%TEMP%\_mei22362\_tcl_data\tzdata\america\winnipeg
%TEMP%\_mei22362\_tcl_data\tzdata\america\yakutat
%TEMP%\_mei22362\_tcl_data\tzdata\america\yellowknife
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\casey
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\davis
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\dumontdurville
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\macquarie
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\mawson
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\mcmurdo
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\palmer
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\rothera
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\south_pole
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\syowa
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\troll
%TEMP%\_mei22362\_tcl_data\tzdata\antarctica\vostok
%TEMP%\_mei22362\_tcl_data\tzdata\arctic\longyearbyen
%TEMP%\_mei22362\_tcl_data\tzdata\asia\aden
%TEMP%\_mei22362\_tcl_data\tzdata\asia\almaty
%TEMP%\_mei22362\_tcl_data\tzdata\asia\amman
%TEMP%\_mei22362\_tcl_data\tzdata\asia\anadyr
%TEMP%\_mei22362\_tcl_data\tzdata\asia\aqtau
%TEMP%\_mei22362\_tcl_data\tzdata\asia\aqtobe
%TEMP%\_mei22362\_tcl_data\tzdata\asia\ashgabat
%TEMP%\_mei22362\_tcl_data\tzdata\asia\ashkhabad
%TEMP%\_mei22362\_tcl_data\tzdata\asia\atyrau
%TEMP%\_mei22362\_tcl_data\tzdata\asia\baghdad
%TEMP%\_mei22362\_tcl_data\tzdata\asia\bahrain
%TEMP%\_mei22362\_tcl_data\tzdata\asia\baku
%TEMP%\_mei22362\_tcl_data\tzdata\asia\bangkok
%TEMP%\_mei22362\_tcl_data\tzdata\asia\barnaul
%TEMP%\_mei22362\_tcl_data\tzdata\asia\beirut
%TEMP%\_mei22362\_tcl_data\tzdata\asia\bishkek
%TEMP%\_mei22362\_tcl_data\tzdata\asia\brunei
%TEMP%\_mei22362\_tcl_data\tzdata\asia\calcutta
%TEMP%\_mei22362\_tcl_data\tzdata\asia\chita
%TEMP%\_mei22362\_tcl_data\tzdata\asia\choibalsan
%TEMP%\_mei22362\_tcl_data\tzdata\asia\chongqing
%TEMP%\_mei22362\_tcl_data\tzdata\asia\chungking
%TEMP%\_mei22362\_tcl_data\tzdata\asia\colombo
%TEMP%\_mei22362\_tcl_data\tzdata\asia\dacca
%TEMP%\_mei22362\_tcl_data\tzdata\asia\damascus
%TEMP%\_mei22362\_tcl_data\tzdata\asia\dhaka
%TEMP%\_mei22362\_tcl_data\tzdata\asia\dili
%TEMP%\_mei22362\_tcl_data\tzdata\asia\dubai
%TEMP%\_mei22362\_tcl_data\tzdata\asia\dushanbe
%TEMP%\_mei22362\_tcl_data\tzdata\asia\famagusta
%TEMP%\_mei22362\_tcl_data\tzdata\asia\gaza
%TEMP%\_mei22362\_tcl_data\tzdata\asia\harbin
%TEMP%\_mei22362\_tcl_data\tzdata\asia\hebron
%TEMP%\_mei22362\_tcl_data\tzdata\asia\ho_chi_minh
%TEMP%\_mei22362\_tcl_data\tzdata\asia\hong_kong
%TEMP%\_mei22362\_tcl_data\tzdata\asia\hovd
%TEMP%\_mei22362\_tcl_data\tzdata\asia\irkutsk
%TEMP%\_mei22362\_tcl_data\tzdata\asia\istanbul
%TEMP%\_mei22362\_tcl_data\tzdata\asia\jakarta
%TEMP%\_mei22362\_tcl_data\tzdata\asia\jayapura
%TEMP%\_mei22362\_tcl_data\tzdata\asia\jerusalem
%TEMP%\_mei22362\_tcl_data\tzdata\asia\kabul
%TEMP%\_mei22362\_tcl_data\tzdata\asia\kamchatka
%TEMP%\_mei22362\_tcl_data\tzdata\asia\karachi
%TEMP%\_mei22362\_tcl_data\tzdata\asia\kashgar
%TEMP%\_mei22362\_tcl_data\tzdata\asia\kathmandu
%TEMP%\_mei22362\_tcl_data\tzdata\asia\katmandu
%TEMP%\_mei22362\_tcl_data\tzdata\asia\khandyga
%TEMP%\_mei22362\_tcl_data\tzdata\asia\kolkata
%TEMP%\_mei22362\_tcl_data\tzdata\asia\krasnoyarsk
%TEMP%\_mei22362\_tcl_data\tzdata\asia\kuala_lumpur
%TEMP%\_mei22362\_tcl_data\tzdata\asia\kuching
%TEMP%\_mei22362\_tcl_data\tzdata\asia\kuwait
%TEMP%\_mei22362\_tcl_data\tzdata\asia\macao
%TEMP%\_mei22362\_tcl_data\tzdata\asia\macau
%TEMP%\_mei22362\_tcl_data\tzdata\asia\magadan
%TEMP%\_mei22362\_tcl_data\tzdata\asia\makassar
%TEMP%\_mei22362\_tcl_data\tzdata\asia\manila
%TEMP%\_mei22362\_tcl_data\tzdata\asia\muscat
%TEMP%\_mei22362\_tcl_data\tzdata\asia\nicosia
%TEMP%\_mei22362\_tcl_data\tzdata\asia\novokuznetsk
%TEMP%\_mei22362\_tcl_data\tzdata\asia\novosibirsk
%TEMP%\_mei22362\_tcl_data\tzdata\asia\omsk
%TEMP%\_mei22362\_tcl_data\tzdata\asia\oral
%TEMP%\_mei22362\_tcl_data\tzdata\asia\phnom_penh
%TEMP%\_mei22362\_tcl_data\tzdata\asia\pontianak
%TEMP%\_mei22362\_tcl_data\tzdata\asia\pyongyang
%TEMP%\_mei22362\_tcl_data\tzdata\asia\qatar
%TEMP%\_mei22362\_tcl_data\tzdata\asia\qostanay
%TEMP%\_mei22362\_tcl_data\tzdata\asia\qyzylorda
%TEMP%\_mei22362\_tcl_data\tzdata\asia\rangoon
%TEMP%\_mei22362\_tcl_data\tzdata\asia\riyadh
%TEMP%\_mei22362\_tcl_data\tzdata\asia\saigon
%TEMP%\_mei22362\_tcl_data\tzdata\asia\sakhalin
%TEMP%\_mei22362\_tcl_data\tzdata\asia\samarkand
%TEMP%\_mei22362\_tcl_data\tzdata\asia\seoul
%TEMP%\_mei22362\_tcl_data\tzdata\asia\shanghai
%TEMP%\_mei22362\_tcl_data\tzdata\asia\singapore
%TEMP%\_mei22362\_tcl_data\tzdata\asia\srednekolymsk
%TEMP%\_mei22362\_tcl_data\tzdata\asia\taipei
%TEMP%\_mei22362\_tcl_data\tzdata\asia\tashkent
%TEMP%\_mei22362\_tcl_data\tzdata\asia\tbilisi
%TEMP%\_mei22362\_tcl_data\tzdata\asia\tehran
%TEMP%\_mei22362\_tcl_data\tzdata\asia\tel_aviv
%TEMP%\_mei22362\_tcl_data\tzdata\asia\thimbu
%TEMP%\_mei22362\_tcl_data\tzdata\asia\thimphu
%TEMP%\_mei22362\_tcl_data\tzdata\asia\tokyo
%TEMP%\_mei22362\_tcl_data\tzdata\asia\tomsk
%TEMP%\_mei22362\_tcl_data\tzdata\asia\ujung_pandang
%TEMP%\_mei22362\_tcl_data\tzdata\asia\ulaanbaatar
%TEMP%\_mei22362\_tcl_data\tzdata\asia\ulan_bator
%TEMP%\_mei22362\_tcl_data\tzdata\asia\urumqi
%TEMP%\_mei22362\_tcl_data\tzdata\asia\ust-nera
%TEMP%\_mei22362\_tcl_data\tzdata\asia\vientiane
%TEMP%\_mei22362\_tcl_data\tzdata\asia\vladivostok
%TEMP%\_mei22362\_tcl_data\tzdata\asia\yakutsk
%TEMP%\_mei22362\_tcl_data\tzdata\asia\yangon
%TEMP%\_mei22362\_tcl_data\tzdata\asia\yekaterinburg
%TEMP%\_mei22362\_tcl_data\tzdata\asia\yerevan
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\azores
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\bermuda
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\canary
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\cape_verde
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\faeroe
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\faroe
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\jan_mayen
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\madeira
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\reykjavik
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\south_georgia
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\st_helena
%TEMP%\_mei22362\_tcl_data\tzdata\atlantic\stanley
%TEMP%\_mei22362\_tcl_data\tzdata\australia\act
%TEMP%\_mei22362\_tcl_data\tzdata\australia\adelaide
%TEMP%\_mei22362\_tcl_data\tzdata\australia\brisbane
%TEMP%\_mei22362\_tcl_data\tzdata\australia\broken_hill
%TEMP%\_mei22362\_tcl_data\tzdata\australia\canberra
%TEMP%\_mei22362\_tcl_data\tzdata\australia\currie
%TEMP%\_mei22362\_tcl_data\tzdata\australia\darwin
%TEMP%\_mei22362\_tcl_data\tzdata\australia\eucla
%TEMP%\_mei22362\_tcl_data\tzdata\australia\hobart
%TEMP%\_mei22362\_tcl_data\tzdata\australia\lhi
%TEMP%\_mei22362\_tcl_data\tzdata\australia\lindeman
%TEMP%\_mei22362\_tcl_data\tzdata\australia\lord_howe
%TEMP%\_mei22362\_tcl_data\tzdata\australia\melbourne
%TEMP%\_mei22362\_tcl_data\tzdata\australia\nsw
%TEMP%\_mei22362\_tcl_data\tzdata\australia\north
%TEMP%\_mei22362\_tcl_data\tzdata\australia\perth
%TEMP%\_mei22362\_tcl_data\tzdata\australia\queensland
%TEMP%\_mei22362\_tcl_data\tzdata\australia\south
%TEMP%\_mei22362\_tcl_data\tzdata\australia\sydney
%TEMP%\_mei22362\_tcl_data\tzdata\australia\tasmania
%TEMP%\_mei22362\_tcl_data\tzdata\australia\victoria
%TEMP%\_mei22362\_tcl_data\tzdata\australia\west
%TEMP%\_mei22362\_tcl_data\tzdata\australia\yancowinna
%TEMP%\_mei22362\_tcl_data\tzdata\brazil\acre
%TEMP%\_mei22362\_tcl_data\tzdata\brazil\denoronha
%TEMP%\_mei22362\_tcl_data\tzdata\brazil\east
%TEMP%\_mei22362\_tcl_data\tzdata\brazil\west
%TEMP%\_mei22362\_tcl_data\tzdata\cet
%TEMP%\_mei22362\_tcl_data\tzdata\cst6cdt
%TEMP%\_mei22362\_tcl_data\tzdata\canada\atlantic
%TEMP%\_mei22362\_tcl_data\tzdata\canada\central
%TEMP%\_mei22362\_tcl_data\tzdata\canada\eastern
%TEMP%\_mei22362\_tcl_data\tzdata\canada\mountain
%TEMP%\_mei22362\_tcl_data\tzdata\canada\newfoundland
%TEMP%\_mei22362\_tcl_data\tzdata\canada\pacific
%TEMP%\_mei22362\_tcl_data\tzdata\canada\saskatchewan
%TEMP%\_mei22362\_tcl_data\tzdata\canada\yukon
%TEMP%\_mei22362\_tcl_data\tzdata\chile\continental
%TEMP%\_mei22362\_tcl_data\tzdata\chile\easterisland
%TEMP%\_mei22362\_tcl_data\tzdata\cuba
%TEMP%\_mei22362\_tcl_data\tzdata\eet
%TEMP%\_mei22362\_tcl_data\tzdata\est
%TEMP%\_mei22362\_tcl_data\tzdata\est5edt
%TEMP%\_mei22362\_tcl_data\tzdata\egypt
%TEMP%\_mei22362\_tcl_data\tzdata\eire
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+0
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+1
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+10
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+11
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+12
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+2
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+3
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+4
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+5
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+6
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+7
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+8
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt+9
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-0
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-1
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-10
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-11
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-12
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-13
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-14
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-2
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-3
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-4
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-5
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-6
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-7
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-8
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt-9
%TEMP%\_mei22362\_tcl_data\tzdata\etc\gmt0
%TEMP%\_mei22362\_tcl_data\tzdata\etc\greenwich
%TEMP%\_mei22362\_tcl_data\tzdata\etc\uct
%TEMP%\_mei22362\_tcl_data\tzdata\etc\utc
%TEMP%\_mei22362\_tcl_data\tzdata\etc\universal
%TEMP%\_mei22362\_tcl_data\tzdata\etc\zulu
%TEMP%\_mei22362\_tcl_data\tzdata\europe\amsterdam
%TEMP%\_mei22362\_tcl_data\tzdata\europe\andorra
%TEMP%\_mei22362\_tcl_data\tzdata\europe\astrakhan
%TEMP%\_mei22362\_tcl_data\tzdata\europe\athens
%TEMP%\_mei22362\_tcl_data\tzdata\europe\belfast
%TEMP%\_mei22362\_tcl_data\tzdata\europe\belgrade
%TEMP%\_mei22362\_tcl_data\tzdata\europe\berlin
%TEMP%\_mei22362\_tcl_data\tzdata\europe\bratislava
%TEMP%\_mei22362\_tcl_data\tzdata\europe\brussels
%TEMP%\_mei22362\_tcl_data\tzdata\europe\bucharest
%TEMP%\_mei22362\_tcl_data\tzdata\europe\budapest
%TEMP%\_mei22362\_tcl_data\tzdata\europe\busingen
%TEMP%\_mei22362\_tcl_data\tzdata\europe\chisinau
%TEMP%\_mei22362\_tcl_data\tzdata\europe\copenhagen
%TEMP%\_mei22362\_tcl_data\tzdata\europe\dublin
%TEMP%\_mei22362\_tcl_data\tzdata\europe\gibraltar
%TEMP%\_mei22362\_tcl_data\tzdata\europe\guernsey
%TEMP%\_mei22362\_tcl_data\tzdata\europe\helsinki
%TEMP%\_mei22362\_tcl_data\tzdata\europe\isle_of_man
%TEMP%\_mei22362\_tcl_data\tzdata\europe\istanbul
%TEMP%\_mei22362\_tcl_data\tzdata\europe\jersey
%TEMP%\_mei22362\_tcl_data\tzdata\europe\kaliningrad
%TEMP%\_mei22362\_tcl_data\tzdata\europe\kiev
%TEMP%\_mei22362\_tcl_data\tzdata\europe\kirov
%TEMP%\_mei22362\_tcl_data\tzdata\europe\kyiv
%TEMP%\_mei22362\_tcl_data\tzdata\europe\lisbon
%TEMP%\_mei22362\_tcl_data\tzdata\europe\ljubljana
%TEMP%\_mei22362\_tcl_data\tzdata\europe\london
%TEMP%\_mei22362\_tcl_data\tzdata\europe\luxembourg
%TEMP%\_mei22362\_tcl_data\tzdata\europe\madrid
%TEMP%\_mei22362\_tcl_data\tzdata\europe\malta
%TEMP%\_mei22362\_tcl_data\tzdata\europe\mariehamn
%TEMP%\_mei22362\_tcl_data\tzdata\europe\minsk
%TEMP%\_mei22362\_tcl_data\tzdata\europe\monaco
%TEMP%\_mei22362\_tcl_data\tzdata\europe\moscow
%TEMP%\_mei22362\_tcl_data\tzdata\europe\nicosia
%TEMP%\_mei22362\_tcl_data\tzdata\europe\oslo
%TEMP%\_mei22362\_tcl_data\tzdata\europe\paris
%TEMP%\_mei22362\_tcl_data\tzdata\europe\podgorica
%TEMP%\_mei22362\_tcl_data\tzdata\europe\prague
%TEMP%\_mei22362\_tcl_data\tzdata\europe\riga
%TEMP%\_mei22362\_tcl_data\tzdata\europe\rome
%TEMP%\_mei22362\_tcl_data\tzdata\europe\samara
%TEMP%\_mei22362\_tcl_data\tzdata\europe\san_marino
%TEMP%\_mei22362\_tcl_data\tzdata\europe\sarajevo
%TEMP%\_mei22362\_tcl_data\tzdata\europe\saratov
%TEMP%\_mei22362\_tcl_data\tzdata\europe\simferopol
%TEMP%\_mei22362\_tcl_data\tzdata\europe\skopje
%TEMP%\_mei22362\_tcl_data\tzdata\europe\sofia
%TEMP%\_mei22362\_tcl_data\tzdata\europe\stockholm
%TEMP%\_mei22362\_tcl_data\tzdata\europe\tallinn
%TEMP%\_mei22362\_tcl_data\tzdata\europe\tirane
%TEMP%\_mei22362\_tcl_data\tzdata\europe\tiraspol
%TEMP%\_mei22362\_tcl_data\tzdata\europe\ulyanovsk
%TEMP%\_mei22362\_tcl_data\tzdata\europe\uzhgorod
%TEMP%\_mei22362\_tcl_data\tzdata\europe\vaduz
%TEMP%\_mei22362\_tcl_data\tzdata\europe\vatican
%TEMP%\_mei22362\_tcl_data\tzdata\europe\vienna
%TEMP%\_mei22362\_tcl_data\tzdata\europe\vilnius
%TEMP%\_mei22362\_tcl_data\tzdata\europe\volgograd
%TEMP%\_mei22362\_tcl_data\tzdata\europe\warsaw
%TEMP%\_mei22362\_tcl_data\tzdata\europe\zagreb
%TEMP%\_mei22362\_tcl_data\tzdata\europe\zaporozhye
%TEMP%\_mei22362\_tcl_data\tzdata\europe\zurich
%TEMP%\_mei22362\_tcl_data\tzdata\gb
%TEMP%\_mei22362\_tcl_data\tzdata\gb-eire
%TEMP%\_mei22362\_tcl_data\tzdata\gmt
%TEMP%\_mei22362\_tcl_data\tzdata\gmt+0
%TEMP%\_mei22362\_tcl_data\tzdata\gmt-0
%TEMP%\_mei22362\_tcl_data\tzdata\gmt0
%TEMP%\_mei22362\_tcl_data\tzdata\greenwich
%TEMP%\_mei22362\_tcl_data\tzdata\hst
%TEMP%\_mei22362\_tcl_data\tzdata\hongkong
%TEMP%\_mei22362\_tcl_data\tzdata\iceland
%TEMP%\_mei22362\_tcl_data\tzdata\indian\antananarivo
%TEMP%\_mei22362\_tcl_data\tzdata\indian\chagos
%TEMP%\_mei22362\_tcl_data\tzdata\indian\christmas
%TEMP%\_mei22362\_tcl_data\tzdata\indian\cocos
%TEMP%\_mei22362\_tcl_data\tzdata\indian\comoro
%TEMP%\_mei22362\_tcl_data\tzdata\indian\kerguelen
%TEMP%\_mei22362\_tcl_data\tzdata\indian\mahe
%TEMP%\_mei22362\_tcl_data\tzdata\indian\maldives
%TEMP%\_mei22362\_tcl_data\tzdata\indian\mauritius
%TEMP%\_mei22362\_tcl_data\tzdata\indian\mayotte
%TEMP%\_mei22362\_tcl_data\tzdata\indian\reunion
%TEMP%\_mei22362\_tcl_data\tzdata\iran
%TEMP%\_mei22362\_tcl_data\tzdata\israel
%TEMP%\_mei22362\_tcl_data\tzdata\jamaica
%TEMP%\_mei22362\_tcl_data\tzdata\japan
%TEMP%\_mei22362\_tcl_data\tzdata\kwajalein
%TEMP%\_mei22362\_tcl_data\tzdata\libya
%TEMP%\_mei22362\_tcl_data\tzdata\met
%TEMP%\_mei22362\_tcl_data\tzdata\mst
%TEMP%\_mei22362\_tcl_data\tzdata\mst7mdt
%TEMP%\_mei22362\_tcl_data\tzdata\mexico\bajanorte
%TEMP%\_mei22362\_tcl_data\tzdata\mexico\bajasur
%TEMP%\_mei22362\_tcl_data\tzdata\mexico\general
%TEMP%\_mei22362\_tcl_data\tzdata\nz
%TEMP%\_mei22362\_tcl_data\tzdata\nz-chat
%TEMP%\_mei22362\_tcl_data\tzdata\navajo
%TEMP%\_mei22362\_tcl_data\tzdata\prc
%TEMP%\_mei22362\_tcl_data\tzdata\pst8pdt
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\apia
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\auckland
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\bougainville
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\chatham
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\chuuk
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\easter
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\efate
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\enderbury
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\fakaofo
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\fiji
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\funafuti
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\galapagos
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\gambier
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\guadalcanal
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\guam
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\honolulu
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\johnston
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\kanton
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\kiritimati
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\kosrae
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\kwajalein
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\majuro
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\marquesas
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\midway
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\nauru
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\niue
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\norfolk
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\noumea
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\pago_pago
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\palau
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\pitcairn
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\pohnpei
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\ponape
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\port_moresby
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\rarotonga
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\saipan
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\samoa
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\tahiti
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\tarawa
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\tongatapu
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\truk
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\wake
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\wallis
%TEMP%\_mei22362\_tcl_data\tzdata\pacific\yap
%TEMP%\_mei22362\_tcl_data\tzdata\poland
%TEMP%\_mei22362\_tcl_data\tzdata\portugal
%TEMP%\_mei22362\_tcl_data\tzdata\roc
%TEMP%\_mei22362\_tcl_data\tzdata\rok
%TEMP%\_mei22362\_tcl_data\tzdata\singapore
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\ast4
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\ast4adt
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\cst6
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\cst6cdt
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\est5
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\est5edt
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\hst10
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\mst7
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\mst7mdt
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\pst8
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\pst8pdt
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\yst9
%TEMP%\_mei22362\_tcl_data\tzdata\systemv\yst9ydt
%TEMP%\_mei22362\_tcl_data\tzdata\turkey
%TEMP%\_mei22362\_tcl_data\tzdata\uct
%TEMP%\_mei22362\_tcl_data\tzdata\us\alaska
%TEMP%\_mei22362\_tcl_data\tzdata\us\aleutian
%TEMP%\_mei22362\_tcl_data\tzdata\us\arizona
%TEMP%\_mei22362\_tcl_data\tzdata\us\central
%TEMP%\_mei22362\_tcl_data\tzdata\us\east-indiana
%TEMP%\_mei22362\_tcl_data\tzdata\us\eastern
%TEMP%\_mei22362\_tcl_data\tzdata\us\hawaii
%TEMP%\_mei22362\_tcl_data\tzdata\us\indiana-starke
%TEMP%\_mei22362\_tcl_data\tzdata\us\michigan
%TEMP%\_mei22362\_tcl_data\tzdata\us\mountain
%TEMP%\_mei22362\_tcl_data\tzdata\us\pacific
%TEMP%\_mei22362\_tcl_data\tzdata\us\samoa
%TEMP%\_mei22362\_tcl_data\tzdata\utc
%TEMP%\_mei22362\_tcl_data\tzdata\universal
%TEMP%\_mei22362\_tcl_data\tzdata\w-su
%TEMP%\_mei22362\_tcl_data\tzdata\wet
%TEMP%\_mei22362\_tcl_data\tzdata\zulu
%TEMP%\_mei22362\_tcl_data\word.tcl
%TEMP%\_mei22362\_tk_data\bgerror.tcl
%TEMP%\_mei22362\_tk_data\button.tcl
%TEMP%\_mei22362\_tk_data\choosedir.tcl
%TEMP%\_mei22362\_tk_data\clrpick.tcl
%TEMP%\_mei22362\_tk_data\comdlg.tcl
%TEMP%\_mei22362\_tk_data\console.tcl
%TEMP%\_mei22362\_tk_data\dialog.tcl
%TEMP%\_mei22362\_tk_data\entry.tcl
%TEMP%\_mei22362\_tk_data\focus.tcl
%TEMP%\_mei22362\_tk_data\fontchooser.tcl
%TEMP%\_mei22362\_tk_data\iconlist.tcl
%TEMP%\_mei22362\_tk_data\icons.tcl
%TEMP%\_mei22362\_tk_data\images\readme
%TEMP%\_mei22362\_tk_data\images\logo.eps
%TEMP%\_mei22362\_tk_data\images\logo100.gif
%TEMP%\_mei22362\_tk_data\images\logo64.gif
%TEMP%\_mei22362\_tk_data\images\logolarge.gif
%TEMP%\_mei22362\_tk_data\images\logomed.gif
%TEMP%\_mei22362\_tk_data\images\pwrdlogo.eps
%TEMP%\_mei22362\_tk_data\images\pwrdlogo100.gif
%TEMP%\_mei22362\_tk_data\images\pwrdlogo150.gif
%TEMP%\_mei22362\_tk_data\images\pwrdlogo175.gif
%TEMP%\_mei22362\_tk_data\images\pwrdlogo200.gif
%TEMP%\_mei22362\_tk_data\images\pwrdlogo75.gif
%TEMP%\_mei22362\_tk_data\images\tai-ku.gif
%TEMP%\_mei22362\_tk_data\license.terms
%TEMP%\_mei22362\_tk_data\listbox.tcl
%TEMP%\_mei22362\_tk_data\megawidget.tcl
%TEMP%\_mei22362\_tk_data\menu.tcl
%TEMP%\_mei22362\_tk_data\mkpsenc.tcl
%TEMP%\_mei22362\_tk_data\msgbox.tcl
%TEMP%\_mei22362\_tk_data\msgs\cs.msg
%TEMP%\_mei22362\_tk_data\msgs\da.msg
%TEMP%\_mei22362\_tk_data\msgs\de.msg
%TEMP%\_mei22362\_tk_data\msgs\el.msg
%TEMP%\_mei22362\_tk_data\msgs\en.msg
%TEMP%\_mei22362\_tk_data\msgs\en_gb.msg
%TEMP%\_mei22362\_tk_data\msgs\eo.msg
%TEMP%\_mei22362\_tk_data\msgs\es.msg
%TEMP%\_mei22362\_tk_data\msgs\fi.msg
%TEMP%\_mei22362\_tk_data\msgs\fr.msg
%TEMP%\_mei22362\_tk_data\msgs\hu.msg
%TEMP%\_mei22362\_tk_data\msgs\it.msg
%TEMP%\_mei22362\_tk_data\msgs\nl.msg
%TEMP%\_mei22362\_tk_data\msgs\pl.msg
%TEMP%\_mei22362\_tk_data\msgs\pt.msg
%TEMP%\_mei22362\_tk_data\msgs\ru.msg
%TEMP%\_mei22362\_tk_data\msgs\sv.msg
%TEMP%\_mei22362\_tk_data\msgs\zh_cn.msg
%TEMP%\_mei22362\_tk_data\obsolete.tcl
%TEMP%\_mei22362\_tk_data\optmenu.tcl
%TEMP%\_mei22362\_tk_data\palette.tcl
%TEMP%\_mei22362\_tk_data\panedwindow.tcl
%TEMP%\_mei22362\_tk_data\pkgindex.tcl
%TEMP%\_mei22362\_tk_data\safetk.tcl
%TEMP%\_mei22362\_tk_data\scale.tcl
%TEMP%\_mei22362\_tk_data\scrlbar.tcl
%TEMP%\_mei22362\_tk_data\spinbox.tcl
%TEMP%\_mei22362\_tk_data\tclindex
%TEMP%\_mei22362\_tk_data\tearoff.tcl
%TEMP%\_mei22362\_tk_data\text.tcl
%TEMP%\_mei22362\_tk_data\tk.tcl
%TEMP%\_mei22362\_tk_data\tkfbox.tcl
%TEMP%\_mei22362\_tk_data\ttk\alttheme.tcl
%TEMP%\_mei22362\_tk_data\ttk\aquatheme.tcl
%TEMP%\_mei22362\_tk_data\ttk\button.tcl
%TEMP%\_mei22362\_tk_data\ttk\clamtheme.tcl
%TEMP%\_mei22362\_tk_data\ttk\classictheme.tcl
%TEMP%\_mei22362\_tk_data\ttk\combobox.tcl
%TEMP%\_mei22362\_tk_data\ttk\cursors.tcl
%TEMP%\_mei22362\_tk_data\ttk\defaults.tcl
%TEMP%\_mei22362\_tk_data\ttk\entry.tcl
%TEMP%\_mei22362\_tk_data\ttk\fonts.tcl
%TEMP%\_mei22362\_tk_data\ttk\menubutton.tcl
%TEMP%\_mei22362\_tk_data\ttk\notebook.tcl
%TEMP%\_mei22362\_tk_data\ttk\panedwindow.tcl
%TEMP%\_mei22362\_tk_data\ttk\progress.tcl
%TEMP%\_mei22362\_tk_data\ttk\scale.tcl
%TEMP%\_mei22362\_tk_data\ttk\scrollbar.tcl
%TEMP%\_mei22362\_tk_data\ttk\sizegrip.tcl
%TEMP%\_mei22362\_tk_data\ttk\spinbox.tcl
%TEMP%\_mei22362\_tk_data\ttk\treeview.tcl
%TEMP%\_mei22362\_tk_data\ttk\ttk.tcl
%TEMP%\_mei22362\_tk_data\ttk\utils.tcl
%TEMP%\_mei22362\_tk_data\ttk\vistatheme.tcl
%TEMP%\_mei22362\_tk_data\ttk\wintheme.tcl
%TEMP%\_mei22362\_tk_data\ttk\xptheme.tcl
%TEMP%\_mei22362\_tk_data\unsupported.tcl
%TEMP%\_mei22362\_tk_data\xmfbox.tcl
%TEMP%\_mei22362\_tkinter.pyd
%TEMP%\_mei22362\_wmi.pyd
%TEMP%\_mei22362\base_library.zip
%TEMP%\_mei22362\icon.ico
%TEMP%\_mei22362\icon_active.ico
%TEMP%\_mei22362\icon_inactive.ico
%TEMP%\_mei22362\icon_winws_running.ico
%TEMP%\_mei22362\libcrypto-3.dll
%TEMP%\_mei22362\libffi-8.dll
%TEMP%\_mei22362\libssl-3.dll
%TEMP%\_mei22362\psutil\_psutil_windows.pyd
%TEMP%\_mei22362\pyexpat.pyd
%TEMP%\_mei22362\python3.dll
%TEMP%\_mei22362\python313.dll
%TEMP%\_mei22362\pywin32_system32\pywintypes313.dll
%TEMP%\_mei22362\select.pyd
%TEMP%\_mei22362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei22362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei22362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei22362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei22362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei22362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei22362\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei22362\tcl86t.dll
%TEMP%\_mei22362\tcl8\8.4\platform-1.0.19.tm
%TEMP%\_mei22362\tcl8\8.4\platform\shell-1.1.4.tm
%TEMP%\_mei22362\tcl8\8.5\msgcat-1.6.1.tm
%TEMP%\_mei22362\tcl8\8.5\tcltest-2.5.8.tm
%TEMP%\_mei22362\tcl8\8.6\http-2.9.8.tm
%TEMP%\_mei22362\tk86t.dll
%TEMP%\_mei22362\unicodedata.pyd
%TEMP%\_mei22362\win32\win32api.pyd
%TEMP%\_mei22362\win32\win32event.pyd
%TEMP%\_mei22362\win32\win32service.pyd
%TEMP%\_mei22362\zlib1.dll
%TEMP%\48m_u82l
%TEMP%\tmpbdn98ih_.ico
%TEMP%\tmpbmixs33g.ico
%TEMP%\tmp8jef2cib.ico
%TEMP%\tmpu9h1w4cj.ico

Network activity

Connects to

'gi##ub.com':443
'80.##0.113.62':80
'oc##.#ectigo.com':80
'ra#.####ubusercontent.com':443
'localhost':49699
'localhost':49703
'localhost':49706

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9a##############
http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCQdzRBRzFu%2BZWZdnrq%2FfG5

Other

'gi##ub.com':443
'ra#.####ubusercontent.com':443
'localhost':49699
'localhost':49700
'localhost':49703
'localhost':49704
'localhost':49706
'localhost':49707

UDP

DNS ASK gi##ub.com
DNS ASK oc##.#ectigo.com
DNS ASK ra#.####ubusercontent.com
DNS ASK google.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Split-Path -Parent 'C:\Launcher.bat'"
'C:\tools\curl\curl.exe' -4 -s -I --fail --connect-timeout 1 --max-time 2 -o nul "https://raw.githubusercontent.com"
'C:\tools\curl\curl.exe' -4 -s -I --fail --connect-timeout 2 --max-time 2 -o nul "https://raw.githubusercontent.com/ALFiX01/GoodbyeZapret/refs/heads/main/GoodbyeZapret_Version"
'C:\tools\curl\curl.exe' -s -o "%TEMP%\GZ_Updater.bat" "https://raw.githubusercontent.com/ALFiX01/GoodbyeZapret/refs/heads/main/GoodbyeZapret_Version"
'C:\tools\tray\goodbyezaprettray.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\B055.tmp\B056.tmp\B057.bat <Full path to file>"
'<SYSTEM32>\cmd.exe' /c powershell -NoProfile -Command "(Get-Item '<Current directory>\').Parent.FullName"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "(Get-Item '<Current directory>\').Parent.FullName"
'<SYSTEM32>\net.exe' session
'<SYSTEM32>\net1.exe' session
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\mode.com' con: cols=80 lines=25
'<SYSTEM32>\cmd.exe' /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
'<SYSTEM32>\timeout.exe' /t 1
'<SYSTEM32>\net1.exe' stop GoodbyeZapret
'<SYSTEM32>\sc.exe' delete GoodbyeZapret
'<SYSTEM32>\net1.exe' stop "WinDivert"
'<SYSTEM32>\sc.exe' delete "WinDivert"
'<SYSTEM32>\net1.exe' stop "WinDivert14"
'<SYSTEM32>\sc.exe' delete "WinDivert14"
'<SYSTEM32>\net1.exe' stop "monkey"
'<SYSTEM32>\sc.exe' delete "monkey"
'<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Config" 2>nul | find /i "GoodbyeZapret_Config"
'<SYSTEM32>\reg.exe' query "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Config"
'<SYSTEM32>\find.exe' /i "GoodbyeZapret_Config"
'<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\ASX\Info" /v "GoodbyeZapret_Config" 2>nul | find /i "GoodbyeZapret_Config"
'<SYSTEM32>\reg.exe' query "HKCU\Software\ASX\Info" /v "GoodbyeZapret_Config"
'<SYSTEM32>\curl.exe' -f -L -# -o "C:\\GoodbyeZapret.zip" "https://github.com/ALFiX01/GoodbyeZapret/raw/refs/heads/main/Files/GoodbyeZapret.zip"
'<SYSTEM32>\chcp.com' 850
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "try { Expand-Archive -Path 'C:\\GoodbyeZapret.zip' -DestinationPath 'C:\\GZ_Temp' -Force -ErrorAction Stop } catch { exit 1 }"
'<SYSTEM32>\robocopy.exe' "C:\\GZ_Temp" "C:\" /E /XD "tools" "configs"
'<SYSTEM32>\robocopy.exe' "C:\\GZ_Temp\tools" "C:\\tools" *.* /NFL /NDL /NJH /NJS /NC /R:0 /W:0
'<SYSTEM32>\robocopy.exe' "C:\\GZ_Temp\tools\tray" "C:\\tools\tray" *.* /NFL /NDL /NJH /NJS /NC /R:0 /W:0
'<SYSTEM32>\robocopy.exe' "C:\\GZ_Temp\tools\curl" "C:\\tools\curl" *.* /NFL /NDL /NJH /NJS /NC /R:0 /W:0
'<SYSTEM32>\robocopy.exe' "C:\\GZ_Temp\configs\Preset" "C:\\configs\Preset" /E
'<SYSTEM32>\tasklist.exe'
'<SYSTEM32>\find.exe' /i "Winws"
'<SYSTEM32>\reg.exe' add "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_LastStartConfig" /t REG_SZ /d "None" /f
'<SYSTEM32>\cmd.exe' /K "C:\\Launcher.bat"
'<SYSTEM32>\cmd.exe' /c powershell -NoProfile -Command "Split-Path -Parent 'C:\Launcher.bat'"
'<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Config" 2>nul | findstr /i "GoodbyeZapret_Config"
'<SYSTEM32>\findstr.exe' /i "GoodbyeZapret_Config"
'<SYSTEM32>\cmd.exe' /c powershell -NoProfile -Command "$Host.UI.RawUI.WindowSize.Width"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "$Host.UI.RawUI.WindowSize.Width"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" 2>nul | find /i "ConsentPromptBehaviorAdmin"
'<SYSTEM32>\find.exe' /i "ConsentPromptBehaviorAdmin"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorUser"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorUser" 2>nul | find /i "ConsentPromptBehaviorUser"
'<SYSTEM32>\find.exe' /i "ConsentPromptBehaviorUser"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection" 2>nul | find /i "EnableInstallerDetection"
'<SYSTEM32>\find.exe' /i "EnableInstallerDetection"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" 2>nul | find /i "EnableLUA"
'<SYSTEM32>\find.exe' /i "EnableLUA"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths" 2>nul | find /i "EnableSecureUIAPaths"
'<SYSTEM32>\find.exe' /i "EnableSecureUIAPaths"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken" /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" 2>nul | find /i "PromptOnSecureDesktop"
'<SYSTEM32>\find.exe' /i "PromptOnSecureDesktop"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures" 2>nul | find /i "ValidateAdminCodeSignatures"
'<SYSTEM32>\find.exe' /i "ValidateAdminCodeSignatures"
'<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v SaveZoneInformation
'<SYSTEM32>\find.exe' "0x1"
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Internet Explorer\Security" /v "DisableSecuritySettingsCheck"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Security" /f /v "DisableSecuritySettingsCheck" /t REG_DWORD /d 1
'<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" | findstr /i "LowRiskFileTypes"
'<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes"
'<SYSTEM32>\findstr.exe' /i "LowRiskFileTypes"
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v LowRiskFileTypes /t REG_SZ /d ".exe;.reg.;.bat.;.vbs;.cmd;.ps1;.zip;.rar;.msi;.msu;.lnk;.7z;.tar.gz;.doc;.docx;.pdf...
'<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v "1806"
'<SYSTEM32>\find.exe' "0x0"
'<SYSTEM32>\cmd.exe' /c reg query "HKCU\Control Panel\International" /v "LocaleName" | findstr /i "LocaleName"
'<SYSTEM32>\reg.exe' query "HKCU\Control Panel\International" /v "LocaleName"
'<SYSTEM32>\findstr.exe' /i "LocaleName"
'<SYSTEM32>\timeout.exe' /t 4
'<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Version"
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Version" /t REG_SZ /d "2.4.1" /f
'<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Version_code"
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Version_code" /t REG_SZ /d "24ST01" /f
'<SYSTEM32>\reg.exe' query "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "Auto-update"
'<SYSTEM32>\find.exe' "1"
'<SYSTEM32>\nslookup.exe' google.com
'<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Software\ALFiX inc.\GoodbyeZapret" /v "Auto-update"
'<SYSTEM32>\sc.exe' query BFE
'<SYSTEM32>\findstr.exe' "STATE"
'<SYSTEM32>\cmd.exe' /c sc query BFE 2>nul | findstr "STATE"
'<SYSTEM32>\sc.exe' qc BFE
'<SYSTEM32>\findstr.exe' "START_TYPE"
'<SYSTEM32>\cmd.exe' /c sc qc BFE 2>nul | findstr "START_TYPE"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq AdguardSvc.exe"
'<SYSTEM32>\find.exe' /I "AdguardSvc.exe"
'<SYSTEM32>\cmd.exe' /c sc query 2>NUL | findstr /I "SERVICE_NAME:" | findstr /I "Killer"
'<SYSTEM32>\sc.exe' query
'<SYSTEM32>\findstr.exe' /I "SERVICE_NAME:"
'<SYSTEM32>\findstr.exe' /I "Killer"
'<SYSTEM32>\cmd.exe' /c sc query 2>NUL | findstr /I "SERVICE_NAME:" | findstr /I "Intel" | findstr /I "Connectivity" | findstr /I "Network"
'<SYSTEM32>\findstr.exe' /I "Intel"
'<SYSTEM32>\findstr.exe' /I "Connectivity"
'<SYSTEM32>\findstr.exe' /I "Network"
'<SYSTEM32>\sc.exe' query "TracSrvWrapper"
'<SYSTEM32>\findstr.exe' /I "SERVICE_NAME"
'<SYSTEM32>\sc.exe' query "EPWD"
'<SYSTEM32>\cmd.exe' /c sc query 2>NUL | findstr /I "SERVICE_NAME:" | findstr /I "SmartByte"
'<SYSTEM32>\findstr.exe' /I "SmartByte"
'<SYSTEM32>\cmd.exe' /c sc query 2>NUL | findstr /I "SERVICE_NAME:" | findstr /I "VPN"
'<SYSTEM32>\findstr.exe' /I "VPN"
'<SYSTEM32>\cmd.exe' /c wmic nicconfig where "IPEnabled=true" get DNSServerSearchOrder /format:table 2>NUL
'<SYSTEM32>\wbem\wmic.exe' nicconfig where "IPEnabled=true" get DNSServerSearchOrder /format:table
'<SYSTEM32>\cmd.exe' /S /D /c" echo {"8.#.8.8", "8.#.4.4"} "
'<SYSTEM32>\findstr.exe' /r /c:"[0-9]"
'<SYSTEM32>\findstr.exe' /i "192\.168\."
'<SYSTEM32>\cmd.exe' /S /D /c" echo "
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GoodbyeZapret" /v "Description"
'<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_OldConfig"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq winws.exe"
'<SYSTEM32>\find.exe' /I /N "winws.exe"
'<SYSTEM32>\cmd.exe' /S /D /c" echo "24ST01" "
'<SYSTEM32>\findstr.exe' /i "24ST01"
'<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq GoodbyeZapretTray.exe"
'<SYSTEM32>\find.exe' /I /N "GoodbyeZapretTray.exe"
'<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Version" 2>nul | find /i "GoodbyeZapret_Version"
'<SYSTEM32>\reg.exe' query "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_Version"
'<SYSTEM32>\find.exe' /i "GoodbyeZapret_Version"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GoodbyeZapret" /v Description
'<SYSTEM32>\cmd.exe' /c dir /b /a:-d "C:\\configs\Preset\*.bat" 2>nul | find /v /c ""
'<SYSTEM32>\cmd.exe' /S /D /c" dir /b /a:-d "C:\\configs\Preset\*.bat" 2>nul"
'<SYSTEM32>\find.exe' /v /c ""
'<SYSTEM32>\cmd.exe' /c dir /b /a:-d "C:\\configs\Custom\*.bat" 2>nul | find /v /c ""
'<SYSTEM32>\cmd.exe' /S /D /c" dir /b /a:-d "C:\\configs\Custom\*.bat" 2>nul"
'<SYSTEM32>\sc.exe' query "GoodbyeZapret"
'<SYSTEM32>\sc.exe' query WinDivert
'<SYSTEM32>\find.exe' /I "RUNNING"
'<SYSTEM32>\sc.exe' query WinDivert14
'<SYSTEM32>\sc.exe' query monkey
'<SYSTEM32>\mode.com' con: cols=92 lines=27
'<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_LastWorkConfig"
'<SYSTEM32>\cmd.exe' /c reg query "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_LastStartConfig" 2>nul | find /i "GoodbyeZapret_LastStartConfig"
'<SYSTEM32>\reg.exe' query "HKCU\Software\ALFiX inc.\GoodbyeZapret" /v "GoodbyeZapret_LastStartConfig"
'<SYSTEM32>\find.exe' /i "GoodbyeZapret_LastStartConfig"

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial